5367 matches found
CVE-2021-47232
In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free, hold skb ref while in use This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to...
CVE-2021-47355
In the Linux kernel, the following vulnerability has been resolved: atm: nicstar: Fix possible use-after-free in nicstarcleanup This module's remove path calls deltimer. However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running...
SUSE-SU-2024:1730-1 Security update for the Linux Kernel (Live Patch 47 for SLE 15 SP2)
This update for the Linux Kernel 5.3.18-15020024188 fixes several issues. The following security issues were fixed: - CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-macheader bsc1223514. - CVE-2023-1829: Fixed a use-after-free in tcindex that can lead local privilege...
CVE-2021-47355
CVE-2021-47355 relates to the Linux kernel ATM nicstar driver. The issue is a use-after-free in nicstar_cleanup() caused by removing a timer with del_timer() instead of del_timer_sync(), which may allow the timer handler to still run after the device removal. The fix ensures the timer finishes an...
CVE-2021-47341
CVE-2021-47341 concerns the Linux kernel KVM mmio path, where a use-after-free flaw in kvm_vm_ioctl_unregister_coalesced_mmio could enable a flawed memory read (8 bytes) via a read access after the object is freed. The issue is in the ARM64 KVM coalesced_mmio code path and Trace shows a use-after...
CVE-2021-47335
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid racing on fsyncentryslab by multi filesystem instances As syzbot reported, there is an use-after-free issue during f2fs recovery: Use-after-free write at 0xffff88823bc16040 in kfence-10:...
CVE-2021-47302
In CVE-2021-47302, the Linux kernel igc driver is affected by a use-after-free during TX ring reset. The fix cleans the next_to_watch descriptor when cleaning the TX ring, preventing a possible free of an skb that was already freed if igc_poll() runs during a reset. The described impact is memory...
CVE-2021-47232
In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free, hold skb ref while in use This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to...
SUSE-SU-2024:1726-1 Security update for the Linux Kernel (Live Patch 1 for SLE 15 SP5)
This update for the Linux Kernel 5.14.21-150500557 fixes several issues. The following security issues were fixed: - CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in perfreadgroup bsc1216644. - CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi bsc1221302. - CVE-2022-48651:...
SUSE-SU-2024:1707-1 Security update for the Linux Kernel (Live Patch 41 for SLE 15 SP3)
This update for the Linux Kernel 5.3.18-15030059150 fixes several issues. The following security issues were fixed: - CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi bsc1221302. - CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-macheader bsc1223514. - CVE-2023-5250...
Use-after-free
Firefox is vulnerable to a potential use-after-free crash. The vulnerability is due to certain font styles when saving a page to PDF, which can cause a use-after-free condition. Attackers can exploit this vulnerability to execute arbitrary code or crash the application...
CVE-2023-52667
A double-free flaw was found in the Linux kernel ConnectX-4 and Connect-IB cards in the Mellanox driver. This issue could allow a local user to crash the system. Mitigation To mitigate this issue, prevent module mlx5core from being loaded. Please see https://access.redhat.com/solutions/41278 for...
CVE-2024-35835
A double-free vulnerability was found in the arfscreategroups function in the Linux kernel's net/mlx5e driver. This issue could lead to memory corruption or a system crash if exploited, as freeing the same memory twice may cause undefined behavior. Mitigation Mitigation for this issue is either n...
CVE-2024-35856
CVE-2024-35856 affects the Linux kernel Bluetooth btusb mediatek component. The root cause is a double-free of the skb buffer in the coredump path, where hci_devcd_append() frees the skb on error, potentially leading to a double-free if the caller also frees it. The issue is triggered locally and...
CVE-2023-52691 drm/amd/pm: fix a double-free in si_dpm_init
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in sidpminit When the allocation of adev-pm.dpm.dynstate.vddcdependencyondispclk.entries fails, amdgpufreeextendedpowertable is called to free some fields of adev. However, when the control flow...
CVE-2023-52691
CVE-2023-52691 concerns the Linux kernel’s DRM AMD power management path. The issue is a double-free in the AMD GPU driver flow: when allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free fields, and if control flow re...
CVE-2023-52667
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a potential double-free in fsanycreategroups When kcalloc for ft-g succeeds but kvzalloc for in fails, fsanycreategroups will free ft-g. However, its caller fsanycreatetable will free ft-g again through calling...
CVE-2024-35835
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfscreategroups When in allocated by kvzalloc fails, arfscreategroups will free ft-g and return an error. However, arfscreatetable, the only caller of arfscreategroups, will hold this error and ca...
