Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmicglinkaltmode: fix drmbridge use-after-free A recent DRM series that claimed to simplify support for “transparent bridges” and handling of probe deferments ironically exposed a use-after-free issue in the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/panel: fixed a possible null pointer dereferencing issue. In versatilepanelgetmodes, the return value of drmmodeduplicate is assigned to mode, which could lead to a NULL pointer dereferencing issue if drmModeduplicate fails. ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/tests: helpers: Avoid a driver UAF When using drmkunithelperallocdrmdevice, the driver may be referenced by device-managed resources until the device is freed. This typically happens later than when the kunit-managed resource...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: fixed a memory leak in generatelfpdataptrs When size != 0 || ptrs-lvdsentries != 3, the program attempts to use free on ptrs. However, ptrs is not created by calling kzmalloc; instead, it is obtained through a...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validated the box size for the snooped cursor. Invalid user-space DMA surface copies could potentially cause an overflow when copying data from the surface to the snooped image, leading to crashes. To address this...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: “Revert ‘drm/prime: Use dmabuf from GEM object instance’” This reversion is achieved through the commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8. The dmabuf field in the struct drmgemobject is not stable throughout the lifetime o...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fixed a use-after-free in r535gsprpcpush. The RPC container is released after being passed to r535gsprpcsend. When sending the initial fragment of a large RPC and passing the caller’s RPC container, the container wil...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/xe/sync: Fixed the memory leak caused by improper release of the user fence when dmafencechainalloc fails. When dmafencechainalloc fails, it is necessary to properly release the reference to the user fence to prevent a memory...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fixed a missing runtime PM reference in ccsmodestore. ccsmodestore calls xegtreset, which internally invokes xepmruntimegetnoresume. This function requires the caller to already hold an outer runtime PM reference, and war...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Added a bounds check on patindex to prevent out-of-bounds kernel reads in madvise. When a user provides a bogus patindex value through the madvise IOCTL, the xepatindexgetcohmode function performs an array access without...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/client: Do not destroy NULL modes. The modes in drcmclientmodesetprobe may fail to be allocated using kcalloc. If this occurs, we jump to out, and modesDestroy is called on it. This action will dereference modes. This could...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/vc4: Fixed deadlock issues during DSI device attachment The attachment of a DSI device to a DSI host is performed while the host device’s lock is held. Unregistering the host device in the “device attachment” error path...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: lib/fonts: Fixed undefined behavior in bit shifting for getdefaultfont. Shifting a signed 32-bit value by 31 bits is undefined; therefore, the significant bit was changed to unsigned. The UBSAN warning “calltrace” is as follow...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-generic: prohibiting potential out-of-bounds accesses The fbdev test in IGT may write after EOF, leading to out-of-bound accesses for DRM drivers that use fbdev-generic. For example, running the fbdev test on an...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/tilcdc: Fixed the cleanup actions in case of a failed probe. The drmkmshelperpollfini and drmatomichelpershutdown helpers should only be called when the device has been successfully registered. Currently, these functions a...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/i915: The issue of NULL pointer dereferencing was addressed by checking newcrtcstate. intelatomicgetnewcrtcstate may return NULL, unless the crtc state was previously obtained using intelatomicgetcrtcstate. Therefore, we must...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Do not overwrite the KMS surface dirty tracker. We were overwriting the surface’s dirty tracker, which caused a memory leak...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/xe: A memory leak has been fixed in xevmmadviseioctl. When the validation of checkboargsaresane fails, the code jumps to the new freevmas cleanup label to properly release the allocated resources. This ensures proper cleanup ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/gud: Fixed UBSAN warnings UBSAN reported an invalid value for the bool type: 101.165172 drm Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1 101.213360 gud 2-3.2:1.0: drm fb1: guddrmfb frame buffer device 101.213426...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm: A use-after-free issue in drmgetunique has been fixed. There is a time-of-check-to-time-of-use error in drmgetunique, caused by retrieving fpriv-master before locking the device’s master mutex. An example of this error can b...