Ubuntu 22.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-6085-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6085-1 advisory. It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread....

kernel: possible race condition in drivers/tty/tty_buffers.c

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flushtoldisc function. This flaw allows a local user to crash the...

Oracle Linux 9 : kernel (ELSA-2023-2458)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2458 advisory. - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6streamops/inet6dgramops of...

AlmaLinux 9 : kernel-rt (ALSA-2023:2148)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2148 advisory. - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. CVE-2021-26341 - When sending...

RHEL 9 : kernel-rt (RHSA-2023:2148)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2148 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

PT-2025-49491

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-syzkaller-12049-g58390c8ce1bd Description The Linux kernel usbtmc driver had a flaw where it did not check the direction of 0-length ioctl control messages. This could lead to issues when a user submits an...

kernel: possible race condition in drivers/tty/tty_buffers.c

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flushtoldisc function. This flaw allows a local user to crash the...

kernel: loop: Check for overflow while configuring loop

In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can configure a loop using an ioctl call, wherein a configuration of type loopconfig is passed see loioctl's case on line 1550 of drivers/block/loop.c. This proceeds t...

kernel: vmwgfx: out-of-bounds write in vmw_kms_cursor_snoop

An out-of-bounds memory write vulnerability was found in the Linux kernel's vmwgfx driver in vmwkmscursorsnoop due to a missing check of a memcpy length. This flaw allows a local, unprivileged attacker with access to either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an ioctl on...

kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory

An out-of-bounds write flaw was found in the Linux kernel’s framebuffer-based console driver functionality in the way a user triggers ioctl FBIOPUTVSCREENINFO with malicious data. This flaw allows a local user to crash or potentially escalate their privileges on the system...

CLSA-2023-1682416329 Fix CVE(s): CVE-2023-26545, CVE-2022-3903, CVE-2023-1281

Ubuntu: 4.15.0-209.220 bionic/linux: 4.15.0-209.220 -proposed tracker LP: 2011989 CVE-2023-26545 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-1281 - rcu: Upgrade rcuswapprotected to rcureplacepointer - net/sched: tcindex: update imperfect hash filters respectin...

CVE-2023-31085

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in dodivsz,mtd-erasesize, used indirectly by ctrlcdevioctl, when mtd-erasesize is 0...

UBUNTU-CVE-2023-31085

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in dodivsz,mtd-erasesize, used indirectly by ctrlcdevioctl, when mtd-erasesize is 0...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service vulnerability exists in Linux kernel version 6.2, which originates from a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hciuartttyioctl in...

CVE-2022-33282

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback...

Integer overflow

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback...

CVE-2022-33282 Integer overflow to buffer overflow in Automotive Multimedia

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback...

CVE-2022-33282 Integer overflow to buffer overflow in Automotive Multimedia

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback...

CVE-2022-33282

CVE-2022-33282 affects Qualcomm Automotive Multimedia (chipset) where an integer overflow during IOCTL calls in video playback causes memory corruption. Root cause: overflow turning into buffer overflow within IOCTL handling. Impact per CVSS is high on confidentiality, integrity, and availability...

Fedora 38 : kernel (2023-c46eb02bbf)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c46eb02bbf advisory. The 6.2.9 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...