USN-6221-1 linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities

It was discovered that a race condition existed in the overlay file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service system crash. CVE-2021-20321 It was discovered that the virtual terminal vt device implementation in the Linux kernel contain...

SUSE-SU-2023:2782-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-35828: Fixed a use-after-free flaw inside renesasusb3remove in drivers/usb/gadget/udc/renesasusb3.c bsc1212513. - CVE-2023-35823: Fixed a...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:2534-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2534-1 advisory. The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security...

SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2023:2501-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2501-1 advisory. The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

Important: kernel

Issue Overview: There is a potential deadlock in the eBPF subsystem in the Linux kernel. The default sysctl configuration "kernel.unprivilegedbpfdisabled" on Amazon Linux does not allow unprivileged users to use eBPF. CVE-2023-0160 A denial of service problem was found, due to a possible recursiv...

CBL Mariner 2.0 Security Update: hyperv-daemons / kernel (CVE-2023-2513)

The version of hyperv-daemons / kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-2513 advisory. - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it...

CVE-2023-34256

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4groupdesccsum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend again...

UBUNTU-CVE-2023-34256

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4groupdesccsum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend again...

CVE-2023-34256

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4groupdesccsum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend again...

Amazon Linux AMI : kernel (ALAS-2023-1744)

The version of kernel installed on the remote host is prior to 4.14.314-164.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1744 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inod...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-045)

The version of kernel installed on the remote host is prior to 5.4.242-155.348. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-045 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-032)

The version of kernel installed on the remote host is prior to 5.10.179-166.674. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-032 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

kernel: Linux kernel (ext4): Memory leak due to improper handling of krealloc failure

A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability occurs due to improper handling of memory allocation failures when the krealloc function returns NULL within ext4fcrecordmodifiedinode. A local user could potentially exploit this flaw, leading to a memory leak. This memor...

kernel: Linux kernel ext4: Information Disclosure via uninitialized memory leak in fast-commit journal

A flaw was found in the Linux kernel. A local attacker could exploit an information disclosure vulnerability by not properly zeroing out unused space at the end of fast-commit journal blocks in the ext4 filesystem. This could lead to the leakage of uninitialized memory to disk, potentially allowi...

kernel: ext4: don't set up encryption key during jbd2 transaction

A flaw exists in the ext4 filesystem implementation in the Linux kernel such that the function ext4unlink extended a journaling transaction too far so that it included a call to ext4findentry. However, ext4findentry may need to set up a directory’s encryption key — which can cause a deadlock when...

kernel: ext4: fix deadlock due to mbcache entry corruption

A deadlock vulnerability was found in the ext4 filesystem in the Linux kernel. When manipulating extended attribute xattr blocks, a race condition in non-atomic bitfield updates can cause the mbcache entry state to become corrupted. This leads to an infinite loop in ext4xattrblockset where the co...

PT-2025-41051

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc4-syzkaller-62821-gcb231e2f67ec Description The Linux kernel contains a flaw in the ext4 filesystem implementation. Specifically, the ext4 evict inode function accesses an uninitialized value, potentially...

CVE-2023-2513

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

AZL-26689 CVE-2023-2513 affecting package kernel for versions less than 5.15.112.1-1

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

Design/Logic Flaw

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...