Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netsched: prio: fix a race in priotune Gerrard Tai reported a race condition in PRIO, whenever the SFQ perturb timer fires at the wrong time. The race occurs as follows: CPU 0 CPU 1 1: lock root 2: qdisctreeFlushBacklog 3: unlock...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spmi: In the tracing functions, there was an issue where access occurred beyond the bounds of the buffer. This issue was fixed by using the length “len” instead of “len + 1”. The following is a KASAN log showing the issue: BUG: I...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: validate rx pkttype header length virtbtrxhandle reads the leading pkttype byte from the RX skb and forwards the remainder to hcirecvframe for every event/ACL/SCO/ISO type, without checking that the remaining...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel up to 5.15.2, hwatlutilsfwrpcwait in drivers/net/ethernet/aquantia/atlantic/hwatl/hwatlutils.c enables an attacker who can supply a crafted device to trigger an out-of-bounds write by using a specially crafted length value...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hidsubmitctrl In hidsubmitctrl, the method used to calculate the report length does not account for the possibility that report-size could be zero. When the syzkaller reproducer is run, a report with...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac: A slab-out-of-bounds read occurred in brcmfgetassocies. This bug could occur when associnfo-reqlen, which is a value from a URB provided by a USB device, is larger than the size of the buffer, which is defined as...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in afsupdatevolumestatus The maximum length of volume-vid value is 20 characters. So increase idbuf size up to 24 to avoid overflow. Found by Linux Verification Center linuxtesting.org with SVACE. DH:...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fixed a kernel panic that occurs when the host sends an invalid H2C PDU length. If the host sends an H2CData command with an invalid DATAL value, the kernel may crash in the nvmettcpbuildpduiovec function. The...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the Linux kernel before version 6.3.10. The file fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, resulting in a out-of-bounds read...

Astra Linux – vulnerability in linux-5.15

An issue was found in the Linux kernel prior to version 6.3.4. ksmbd contains an out-of-bounds read in smb2findcontextvals when the namelen parameter in createcontext exceeds the tag length...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: llc: A test for maclen should be performed before reading the MAC header. The LLC layer reads the MAC header using ethhdr, without verifying that the skb contains an Ethernet header. Syzbot was able to access the llcrcv functi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: af9005: Fix null-ptr-deref in af9005i2cxfer In af9005i2cxfer, msg is controlled by the user. When msgi.buf is null and msgi.len is zero, previous checks on msgi.buf will still be performed. Malicious data will eventually...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negative values in cephmonmapDecode This patch fixes unnecessary implicit conversions that change the signedness of bloblen and nummon in cephmonmapDecode. Currently, bloblen and nummon are signed int...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed cmd-req.sg when the PDU length or offset exceeded sgcnt, and then use bogus values of sg-length/offset. This led to...

Astra Linux – Vulnerability in pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to version 0.6.3, the pyasn1 library was vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion during the decoding of ASN.1 data with deeply nested structures. An attacker could provide a crafted payload containing...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated authlength field read from the network triggered a WINPRASSERT failure in rtsreadauthverifiernochecks, causing any FreeRDP client connecting through a malicious RDP Gateway to crash with...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative datalen in ibumadwrite ibumadwrite calculates datalen based on a user-controlled count and the MAD header sizes. When the user-defined MAD header size does not match the RMPP header length, datalen can...

Astra Linux – Vulnerability in Capstone

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and earlier, the length of Skipdata was not checked for bounds. As a result, a user-provided Skipdata callback could cause the csdisasm/csdisasmiter memcpy function to write more than 24 bytes into csinsn.bytes, leading to a heap buffe...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: added a length check for the header A length check has been added to the rndisheader in rndisrmhdr, to ensure that the MessageType, MessageLength, DataOffset, and DataLength fields are present before...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly by the nlagetu32 function. The top-level policy only validates the container;...