Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

The nfqnlmangle function in net/netfilter/nfnetlinkqueue.c in the Linux kernel, as of version 5.18.14, allows remote attackers to cause a denial of service panic. This occurs because, in the case of an nfqueue verdict with a one-byte nftapayload attribute, an skbpull operation may encounter a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Actually free the watch object. The freewatch function does everything except actually freeing the watch object. This issue is fixed by adding the missing kfree call. KMEMLEAK generates a report similar to the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check for a potential null return from kmallocarray. Since kmallocarray may return null, the use of 'eventwaitersi.wait' could lead to a null pointer derefrence. Therefore, it is better to check the return value of...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: veth: Ensure that the eth header is in the linear part of the skb structure. After feeding a decapsulated packet to a veth device using actmirred, skbheadlen might be set to 0. However, vethxmit calls devforwardskb, which expects...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/hfi1: Fixed a use-after-free bug related to the mm struct. Under certain conditions, such as MPIAbort, the hfi1 cleanup code may represent the last reference held on the task’s mm. hfi1mmurbunregister then releases the la...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: LZ4: fixed the issue of partial reading beyond the bounds of the buffer during decoding. During partialDecoding, an EOF occurs if either the output buffer is full or if reading further beyond the offset is not possible. In some...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fixed the use of memory after freeing it in scsihexpandernoderemove. The function mpt3sastransportportremove called in scsihexpandernoderemove frees the port field of the sasexpander structure. This leads to a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iommu/omap: Fixed a regression in the probe for NULL pointer dereferencing. The commit 3f6634d997db “iommu: Use the correct method to retrieve iommuops” started causing a NULL pointer dereference for some omap variants:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: A NULL pointer dereference occurred in amdgpudmconnectoraddcommonmodes. In amdgpudmconnectoraddcommonmodes, amdgpudmcreatecommonmode assigns mode to mode, and mode is directly passed to drmmodeprobedadd...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: mxs: Fixed error handling in mxssgtl5000probe. This function only calls ofnodeput in the regular path. It will cause a refcount leak in error-prone paths. For example, when codecnp is NULL, saifnp0 and saifnp1 are not NULL,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: stk1160: If the start stream fails, the buffers should be returned with the state “VB2BUFSTATEQUEUED”. Currently, buffers are returned with the state “VB2BUFSTATEERROR”, which is incorrect. This issue has been fixed. This...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wc938x: fixed an issue where accessing an array was done outside its bounds for an enum type. Accessing enums using integers resulted in accessing an array outside its bounds on platforms like aarch64, where...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: WireGuard: socket: freeskb in send6 when IPv6 is disabled. I received a report of a memory leak: Unreferenced object: 0xffff8881191fc040 size 232 Command: kworker/u17:0, PID: 23193, Jiffies: 4295238848 age: 3464.870 seconds Hex...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: qla2xxx: Fix scheduling while atomic The driver makes a call to the midlayer function fcremoteportdelete, which can put the thread to sleep. The thread that originates the call is in interrupt context. The combination of...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: sm712fb: Fixed a crash in smtcfbwrite When the sm712fb driver writes three bytes to the framebuffer, the driver crashes. The issue is due to an inability to handle a page fault for the address: ffffc90001ffffff. RIP...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - ntfs: Added a sanity check on the allocation size. - ntfsread inodemount calls ntfsmallocnofs with an allocation size of zero. This triggers a bug in the ntfsmalloc function. This issue has been fixed by adding a sanity chec...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in devicepmcheckcallbacks The function devicepmcheckcallbacks can be called under the spin lock in the reported case, it happens from genpdadddevice - devpmdomainset, when the genpd uses spinlocks rather...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: block, bfq: do not move oombfqq Our test report a UAF: 2073.019181 ================================================================== 2073.019188 BUG: KASAN: use-after-free in bfqputbfqq+0xa0/0x168 2073.019191 Written a size 8...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pinctrl: nomadik: Added the missing ofnodeput function in nmkpinctrlprobe. This node pointer is returned by ofparsephandle, and its refcount is incremented in this function. Calling ofnodeput prevents the refcount leak...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: clk-rcg2: Update the logic to calculate the D value for RCG. The display pixel clock has a requirement on certain newer platforms to support M/N as 2/3, and the final D value calculated results in underflow errors. As...