Astra Linux – Vulnerability in exim4

In Exim before 4.99.2, when utf8 operators are enabled, there is a potential for out-of-bounds reading if large UTF-8 trailing characters are present malformed UTF-8 header data. Information may be disclosed within an error message generated during the processing of an unrelated email message...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: fec: handle pagepooldevallocpages error The fecenetupdatecbd function calls pagepooldevallocpages, but it does not handle the case where NULL is returned. A WARNON!newpage message is generated, but the program still proceeds...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Tracing/histogram: Fixed a potential memory leak in kstrdup. The kfree function is not called in the error path, resulting in the memory allocated by kstrdup not being freed properly. p = param = kstrdupdata-paramsi, GFPKERNEL...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: Adjusted error handling in case of absence of a codec device. The acpigetfirstphysicalnode function may return NULL in several situations e.g., no such device exists, ACPI table error, reference count drops to 0, etc...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drbd: fixed the “LOGIC BUG” in drbdalbeginiononblock Although we ensure that we can perform lcgetcumulative while holding the device-allock spinlock, it may still fail if some other code path decides to use lctrylock at the wrong...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/bnx2x: Prevent access to a freed page in pagepool Fixed a race condition that could lead to system crashes during EEH error handling During EEH error recovery, the bnx2x driver’s transmit timeout logic could create a race...

Astra Linux – Vulnerability in libstb

stbimage is a single-file library licensed under MIT that processes images. It might seem like stbiloadgifmain does not provide any guarantees regarding the content of the output value delays in case of failure. Although it sets delays to zero at the beginning, it does not do so if the image is n...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: gadget: feem: Fixed a memory leak in eemunwrap. The existing code did not handle the failure case of usbepqueue in the command path, potentially leading to memory leaks. Improved error handling to free all allocated...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: EDAC/highbank: Fixed a memory leak in highbankmcprobe. When devresopengroup fails, it returns -ENOMEM without freeing the memory allocated by edacmcalloc. Call edacmcfree at the error handling path to avoid a memory leak. bp:...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fixed multiple UBSAN array-index-out-of-bounds issues. Fixed UBSAN warnings that occur when using a system with 32 physical CPU cores or more, or when the user defines a number of Ethernet queues that is greater than or...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: cifs: fixed the potential use of a null pointer in destroyworkqueue within the error path of initcifs. Dan Carpenter reported a Smack static checker warning: fs/smb/client/cifsfs.c:1981 initcifs Error: We previously assumed th...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fixed a memory leak in the error flow for the subscribe event routine. In the event that the second xainsert function fails, the objevent object is not released. This issue has been fixed by correcting the error...

Astra Linux – Vulnerability in gst-plugins-good1.0

Integer overflow in the avidemux element within the gstavidemuxinvert function, which allows for a heap overwrite during the parsing of AVI files. There is a potential for arbitrary code execution due to the heap overwrite...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Fixed potential error pointer dereferencing in detachpm The issue occurs on the first line: if jpeg-pddevi && !pmruntimesuspendedjpeg-pddevi If jpeg-pddevi is an error pointer, passing it to pmruntimesuspended wi...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed a possible NULL dereference in amdgpurasqueryerrorstatushelper. Returned an invalid error code -EINVAL for invalid block IDs. The following issues have also been fixed: drivers/gpu/drm/amd/amdgpu/amdgpuras.c:118...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: rapidio: rio: Fixed a possible name leak in rioregistermport. If deviceregister returns an error, the name allocated by devsetname needs to be freed. This should be done using putdevice, so that the reference in the error path is...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: xhci: Properly handling isoc Babble and Buffer Overrun events. xHCI 4.9 explicitly prohibits making assumptions that the xHC has released its ownership of a multi-TRB TD when an error occurs in one of the early TRBs. However,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: socinfo: Added kfree in kstrdup. Added kfree in the subsequent error handling steps to avoid memory leaks...

Astra Linux – Vulnerability in binutils

A issue was discovered in the Binary File Descriptor BFD library also known as libbfd, as distributed in GNU Binutils 2.31. An invalid memory access exists in bfdzalloc in opncls.c. Attackers could exploit this vulnerability to cause a denial of service application crash through a crafted ELF fil...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fixed a reference count leak in stubprobe The function usbgetdev is called in stubdevicealloc. When stubprobe fails, usbputdev must be called to release the reference. This issue was fixed by moving usbputdev into the...