Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The issue of “use-after-free” of conn-preauthinfo in the concurrent SMB2 NEGOTIATE process has been fixed. conn-preauthinfo represents information about a shared connection state struct preauthintegrityinfo, kmalloc-96. Th...

Astra Linux – Vulnerability in ICU

It was discovered that International Components for Unicode ICU-20850 v66.1 contains a use after free bug in the pkgcreateWithAssemblyCode function in the tools/pkgdata/pkgdata.cpp file...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - net: dsa: felix: do not use devres for mdiobus. As explained in the commits: - 74b6d7d13307: “net: dsa: realtek: register the MDIO bus using devres”. - 5135e96a3dd2: “net: dsa: do not allocate the slavemiibus using devres”...

Astra Linux – Vulnerability in Chromium

The use of after-free in WebRTC in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/qedr: Fixed the qedrcreateuserqp error flow. Avoid the following warning by ensuring that allocated resources are freed in case qedrinituserqueue fails. ----------- Cut here --- WARNING: CPU: 0 PID: 143192 at...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - dm clone: Fixed a UAF Use-after-Free in clonedtr. - Dmclone also has the same UAF issue when dmresume and dmdestroy are executed concurrently. Therefore, the timer is canceled again in clonedtr...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: tegra20-slink: Fixed a UAF Use-after-Allocation issue in tegraslinkremove. After calling spiunregistermaster, the refcount of the master will be decreased to 0, and it will be freed in spicontrollerrelease. The device data...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.77, using Tab Strip in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Using after-free in Proxy in Google Chrome before version 149.0.7827.103 allowed a remote attacker to execute arbitrary code through malicious network traffic. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: A use-after-free issue was fixed in the asynchronous open function. Yang Erkun reported that when two threads open files at the same time and are forced to abort before a response is received, the call to nfsreleaseseqid...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Use memblockfreelate to free xbc memory to the buddy allocator. In the code for freeing xbc memory in xbcexit, memblock might have transferred memory to the buddy allocator. Therefore, it doesn’t make sense to free...

Astra Linux – Vulnerability in Chromium

Before version 95.0.4638.54, using "use after free" in Dev Tools in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

The use of after-free in Views in Google Chrome before version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel before version 6.4.12, amdgpucswaitallfences in drivers/gpu/drm/amd/amdgpu/amdgpucs.c contains a use-of-fence issue...

Astra Linux – Vulnerability in Chromium

Using “after free” in V8 in Google Chrome before version 150.0.7871.46 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of after-free in the Input mechanism in Google Chrome before version 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in connman

In ConnMan version 1.41, a man-in-the-middle attack against a WISPR HTTP query could cause a use-after-free error in WISPR handling, resulting in crashes or code execution...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: Synchronization of per-protocol timers before freeing the hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. This struct ppp represents the hdlc-state allocation...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Audit: Fixed a potential use-after-free in auditdelrule. The auditdelrule function destroys the e-rule.exe object via auditremovemarkrule. This occurs before unlinking the rule from RCU-visible filter lists and waiting for a grac...