Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in Batik of Apache XML Graphics, allowing attackers to access files using a Jar URL. This issue affects Apache XML Graphics Batik version 1.14...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: media:v4l2-core: A potential resource leak was fixed in v4l2fwnodeparselink. If the fwnodegraphgetremoteendpoint function fails, fwnode is known to be NULL. Therefore, fwnodehandlePUT is a no-op. Instead, the reference taken...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix memory leak in ipmcadd1src BUG: Memory leak Unreferenced object: 0xffff888101bc4c00 size 32 Command: “syz-executor527”, PID 360, jiffies 4294807421 age 19.329 seconds Hex dump first 32 bytes: 00 00 00 00 00 00 00 0...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fixed a NULL pointer dereference in amdgpudmi2cxfer. When ddcserviceconstruct is called, it explicitly checks both the link type and whether there is something on the link that will determine whether the pin is...

Astra Linux – Vulnerability in Firefox and Thunderbird

An iframe that was not permitted to run scripts could do so if the user clicked on a javascript: link. This vulnerability affects Firefox 102, Firefox ESR 91.11, Thunderbird 102, and Thunderbird 91.11...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: wifi: ath12k: Avoid accessing uninitialized arvif-ar during beacon missed situations. During beacon missed handling, the ath12k driver iterates over active virtual interfaces vifs and attempts to access the radio object ar via...

Astra Linux – Vulnerability in avahi

In Avahi, including versions 0.6.32 and 0.7, avahi-daemon inadvertently responds to IPv6 unicast queries with source addresses that are not on-link. This allows remote attackers to cause a denial of service traffic amplification and may lead to information leakage by extracting potentially...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: mwifiex: The link must be brought down before the interface is deleted. We can encounter a deadlock situation when using rmmod to remove a driver or during firmware reset. This is because the cfg80211unregisterwdev function mu...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ASoC: audio-graph-card: fixed the refcount leak of cpuep in graphforeachlink. ofgetnextchild returns a node with its refcount incremented, and decrements the refcount of the previous node. Therefore, in the error-prone part of th...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: macvlan: Enforces a consistent minimal MTU. The macvlan mechanism should enforce a minimal MTU of 68, even when creating a link. This patch avoids the current behavior which could lead to crashes in the IPv6 stack if the link is...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: The code correctly moves the list within scdisable. Commit 13bac861952a “IB/hfi1: Fix the abba locking issue with scdisable”. However, the code incorrectly attempts to move a list from one list head to another. As a...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: mcc: preventing shift wrapping in rtw89coremlsrswitch The value of “linkid” comes from the user via debugfs. If it is larger than BITSPERLONG, it will result in shift wrapping, potentially leading to out-of-bounds...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: xdp, net: Fixed a use-after-free in bpfxdplinkrelease. The issue occurs between devgetbyindex and devxdpattachlink. At this point, devxdpuninstall is called. As a result, the xdp link will not be automatically detached when the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ice: Fixed the LAG and VF lock dependencies in iceresetvf. The commit fixes the issue where the ice driver acquires the LAG mutex during iceresetvf. This lock acquisition is placed just before acquiring the VF configuration...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: Configure VRR timings after enabling TRANSDDIFUNCCTL It appears that the ICL may hang when using an MCE if we set TRANSVRRVMAX/FLIPLINE before enabling TRANSDDIFUNCCTL. Personally, I was only able to reproduce such ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: PCI: Fixed the link speed calculation in case of retrain failures. When pciefailedlinkretrain fails to retrain, it attempts to revert to the previous link speed. However, it calculates this speed from the Link Control 2 regist...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: pfcp: The device is destroyed along with the udp socket’s netns structure. The pfcpnewlink function links the device to a specific netns in devnet instead of net, where an udp tunnel socket is created. Even when net is removed, t...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Support deferring bpflink deallocation to after RCU grace period For some program types, the “bpflink” is passed as a “context” that can be used by those BPF programs to retrieve additional information. For example, for...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: 9p: Fixed the fid refcount leak in v9fsvfsgetlink. We now check for protocol versions that are later than required, after a fid has been obtained. Simply move the version check to an earlier stage...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A use-after-free flaw was discovered in the nfcllcpfindlocal function in net/nfc/llcpcore.c within NFC in the Linux kernel. This flaw allows a local user with special privileges to cause a kernel information leak issue...