Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. This is the size of the reused reply buffer, not the number of bytes actually receive...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the driver state in pcm-privatedata. An open PCM file can outlive a USB disconnect because usbtvaudiofree uses sndcardfreewhenclosed. The...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. Since chsegcount is a u3...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe The aloop driver blindly trusts that the given devptr-id value is within the proper card index range during probe. It’s acceptable for the devices created by the driver itself at th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. Currently, it does this by using skbreallocheadroom, copies skb-sk ownership, consumes t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen may be smaller than the length later programmed into the DMA scatterlist. Currently, the allocation size is calculated as:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915mcugetstanss If a peer’s VHT/HE MCS map contains no supported spatial streams all fields set to 0x3, the loop exits with nss == 0 and the function returns u8-1 255. This value is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfbpciregister The function radeonfbpciregister allocates memory for modelist by calling radeoncheckmodes, which in turn calls fbaddvideomode. This memory is appended to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.mhigh is saturated 0xFFFFFFFFFFFFFFFF and addition of lower bits overflows. The condition r01.mhigh product.mhigh does not handle th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that after truncating a file...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can cause this addition to exceed pelen, resulting in ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: flowdissector: check device type before reading ETHADDRS skbflowdissect unconditionally reads 12 bytes from ethhdrskb when FLOWDISSECTORKEYETHADDRS is requested. This assumes that the skb contains a valid Ethernet header at...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...