CVE-2022-48802 fs/proc: task_mmu.c: don't read mapcount for migration entry

In the Linux kernel, the following vulnerability has been resolved: fs/proc: taskmmu.c: don't read mapcount for migration entry The syzbot reported the below BUG: kernel BUG at include/linux/page-flags.h:785! invalid opcode: 0000 1 PREEMPT SMP KASAN CPU: 1 PID: 4392 Comm: syz-executor560 Not...

CVE-2022-48802

CVE-2022-48802 affects the Linux kernel component involved in /proc task memory reporting. The vulnerability arises from reading the page mapcount during smaps accounting when a THP (huge page) may be split concurrently with MADV_FREE, creating a race that could trigger a kernel BUG in PageDouble...

BIT-NODE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

SUSE-SU-2024:2385-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2021-47555: net: vlan: fix underflow for the realdev refcnt bsc1225467. - CVE-2021-47571: staging: rtl8192e: Fix use after free in rtl92epcidisconnect...

SUSE-SU-2024:2384-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler bsc1224865. - CVE-2021-47311: net: qcom/emac: fix UAF in emacremove bsc122501...

CVE-2024-22018

A flaw was found in the Node.js package. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files they do not have explicit read access to...

SUSE CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

SUSE CVE-2024-36137

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to...

AZL-43213 CVE-2024-22018 affecting package nodejs 20.14.0-13

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

CVE-2024-22018

CVE-2024-22018 describes a vulnerability in Node.js under the experimental permission model when using the --allow-fs-read flag. The issue stems from an inadequate permission model that does not restrict file stats via the fs.lstat API, allowing an attacker to retrieve statistics for files to whi...

CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2362-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2362-1 advisory. The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...

SUSE-SU-2024:2365-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler bsc1224865. - CVE-2021-47311: net: qcom/emac: fix UAF in emacremove bsc1225010. ...

Authorization Bypass

Overview Affected versions of this package are vulnerable to Authorization Bypass via fs.fchown or fs.fchmod operations which can use a "read-only" file descriptor to change the owner and permissions of a file. Note: This is only exploitable for users using the experimental permission when the...

CVE-2024-39276 ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix mbcacheentry's erefcnt leak in ext4xattrblockcachefind Syzbot reports a warning as follows: ============================================ WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mbcachedestroy+0x224/0x290 Modules...

CVE-2024-39276

CVE-2024-39276: Linux kernel ext4 mb_cache_entry e_refcnt leak fixed. In ext4_xattr_block_cache_find(), on failure from ext4_sb_bread() returning -ENOMEM, the ce’s e_refcnt could leak, triggering mb_cache_destroy(). Quick fix: call mb_cache_entry_put() on the -ENOMEM error path. Connected Astra L...

CVE-2024-38625

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check 'folio' pointer for NULL It can be NULL if bmap is called. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprisi...

CVE-2024-38624

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow For example, in the expression: vbo = 2 vbo + skip Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...