Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: uio: Fix use-after-free in uioopen CVE-2023-52439 kernel: net/sched: actmirred: don't override retval if we already lost the skb CVE-2024-26739 kernel: ARM: 9359/1: flush: check if the...

SUSE SLED12 / SLES12 Security Update : libpcap (SUSE-SU-2024:3355-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3355-1 advisory. - CVE-2024-8006: NULL pointer dereference in function pcapfindalldevsex. bsc1230034 - CVE-2023-7256: double fr...

Exploit for NULL Pointer Dereference in Sierrawireless Aleos

CVE-2023-40459 CVE-2023-40459 Unauthenticated DoS PoC Exploit...

Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks

A hacktivist group known as Twelve has been observed using an arsenal of publicly available tools to conduct destructive cyber attacks against Russian targets. "Rather than demand a ransom for decrypting data, Twelve prefers to encrypt victims' data and then destroy their infrastructure with a...

SUSE-SU-2024:3355-1 Security update for libpcap

This update for libpcap fixes the following issues: - CVE-2024-8006: NULL pointer dereference in function pcapfindalldevsex. bsc1230034 - CVE-2023-7256: double free via struct addrinfo in function sockinitaddress. bsc1230020...

Black Basta Ransomware: What You Need to Know

Overview Black Basta is a ransomware group operating as ransomware-as-a-service RaaS, first spotted in April 2022. It is known to use double extortion techniques where the group demands payment for the decryption and non-release of stolen data. Earlier versions of Black Basta share many...

SUSE CVE-2024-46717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1 No skb created yet 2 headersize == 0 no SHAMPO header 3 headerindex + 1 % MLX5ESHAMPOWQHEADERPERPAGE == 0 this is the last page fragment of a SHAMPO...

SUSE CVE-2024-46736

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2renamepath If smb2setpathattr is called with a valid @cfile and returned -EINVAL, we need to call cifsgetwritablepath again as the reference of @cfile was already dropped by previous...

SUSE CVE-2024-46741

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix double free of 'buf' in error path smatch warning: drivers/misc/fastrpc.c:1926 fastrpcreqmmap error: double free of 'buf' In fastrpcreqmmap error path, the fastrpc buffer is freed in fastrpcreqmunmapimpl if unm...

SUSE CVE-2024-46790

In the Linux kernel, the following vulnerability has been resolved: codetag: debug: mark codetags for poisoned page as empty When PGhwpoison pages are freed they are treated differently in freepagesprepare and instead of being released they are isolated. Page allocation tag counters are decrement...

SUSE CVE-2024-46796

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2setpathsize If smb2compoundop is called with a valid @cfile and returned -EINVAL, we need to call cifsgetwritablepath before retrying it as the reference of @cfile was already dropped ...

kernel: ext4: fix double-free of blocks due to wrong extents moved_len

A vulnerability was found in the Linux kernel. This issue occurs in the ext4 function, in ext4moveextents, where an error in updating the movedlen variable can lead to double-free of blocks and corrupt block accounting. This could lead to crashes or undefined behavior...

CLSA-2024-1726651745 kernel: Fix of 4 CVEs

drm/vmwgfx: Validate the box size for the snooped cursor CVE-2022-36280 - USB: eneusb6250: Allocate enough memory for full object CVE-2023-45862 - Bluetooth: L2CAP: Fix attempting to access uninitialized memory CVE-2022-42895 - stm class: Fix a double free in stmregisterdevice CVE-2024-38627...

DEBIAN-CVE-2024-46736

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2renamepath If smb2setpathattr is called with a valid @cfile and returned -EINVAL, we need to call cifsgetwritablepath again as the reference of @cfile was already dropped by previous...

CVE-2024-46741

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix double free of 'buf' in error path smatch warning: drivers/misc/fastrpc.c:1926 fastrpcreqmmap error: double free of 'buf' In fastrpcreqmmap error path, the fastrpc buffer is freed in fastrpcreqmunmapimpl if unm...

DEBIAN-CVE-2024-46741

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix double free of 'buf' in error path smatch warning: drivers/misc/fastrpc.c:1926 fastrpcreqmmap error: double free of 'buf' In fastrpcreqmmap error path, the fastrpc buffer is freed in fastrpcreqmunmapimpl if unm...

UBUNTU-CVE-2024-46741

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix double free of 'buf' in error path smatch warning: drivers/misc/fastrpc.c:1926 fastrpcreqmmap error: double free of 'buf' In fastrpcreqmmap error path, the fastrpc buffer is freed in fastrpcreqmunmapimpl if unm...

UBUNTU-CVE-2024-46796

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2setpathsize If smb2compoundop is called with a valid @cfile and returned -EINVAL, we need to call cifsgetwritablepath before retrying it as the reference of @cfile was already dropped ...

DEBIAN-CVE-2024-46717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1 No skb created yet 2 headersize == 0 no SHAMPO header 3 headerindex + 1 % MLX5ESHAMPOWQHEADERPERPAGE == 0 this is the last page fragment of a SHAMPO...

UBUNTU-CVE-2024-46717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1 No skb created yet 2 headersize == 0 no SHAMPO header 3 headerindex + 1 % MLX5ESHAMPOWQHEADERPERPAGE == 0 this is the last page fragment of a SHAMPO...