Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb does not account for the possibility that pskbmaypull may have moved the skb data, and continues to access the old pointer, resulting in a Use-After-Free UAF condition...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. This is usually fine because the s...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030charger: cancel workers via devm BCI is devm-allocated. Two workers BCI-work and BCI-currentworker dereference it. twl4030bciremove disables charging and masks interrupts. It does not cancel any worker. A...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist via fbvideomodetomodelist is not freed in subsequent error paths. Fix this by calling fbdestroymodelist...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvmgfniswritetracked checks only the supplied memslot; however, page tracking is per-address-space, and shadow pages are shared across all address spaces. With SMM, a GFN c...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block within the current erase block, then utilizes image information regioncount to iterate through entries stored in a fixed...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xxputchip drops the last reference to ha-cs84xx and frees it via qla84xxchiprelease without clearing ha-cs84xx. During teardown, it was executed before scsiremovehost...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected; thus, a large index could bypass...

Astra Linux – vulnerability in Chromium

In Google Chrome on Aura, use of “After Free” after 154.0.8037.57 allows a local attacker to potentially execute arbitrary code outside the sandbox via UI interaction. Chromium security severity: High...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate function may return NULL on failure, but the return value is never checked. When it fails, zdev-aibv becomes NULL and causes an error when...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use printhexdumpdevel to guard key hex dumps Use printhexdumpdevel for dumping sensitive key material in setkey to avoid leaking secrets at runtime when CONFIGDYNAMICDEBUG is enabled...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Ensure 32-bit stack location for o32 promprintf In 64-bit configurations, calling any firmware entry points from a kernel thread other than the initial one results in the stack being placed in the XKPHYS 64-bit memory...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx10: replace BUGON with WARNON There’s no need to crash the kernel for these cases. cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from multiple interfaces:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without performing a NULL check; however, this helper returns NULL when the receiving device has no...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing begins reassembly for active DATA responses prior to matching them to any outstanding sends. The actual matching occurs later, after...