Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist using listforeachentrysafeni, tmp, .... For each expired entry, it sets nsuibusy = true, drops nfsdssclock to invoke...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Squashfs: ensure that the block offset is not negative If a negative offset is read from disk for instance, the offset within a decompressed fragment block, this causes squashfscopydata to perform an out-of-bounds access. The fix...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherits neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller’s arrayblockcheck can only compare the header against itself; thus, a block with valuesize 4 and maxentries 1018 is internally consistent and passes checks...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snddummyprobe blindly trusts that the given devptr-id value is within the proper card index range. It’s fine for the devices the driver itself creates during the module probe;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix response queue over-consumption in qlaconsumeiocb qla24xxprocessresponsequeue advances ringptr past the head IOCB before dispatching; thus, by the time qlaconsumeiocb runs, ringptr already points to the first...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU’s BHS declares...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Be sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouseinputmapping caches the first hidinput's inputdev in msc-input while the report descriptor is parsed; the rest of the driver treats a non-NULL...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz sets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE to 256 bytes for the layout update4 body written by the layout driver. The flexfiles record can exceed this limit...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: hardening gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long; its rotateleft helper passe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes Commit 25e5cb780e62 “nvme-tcp: fix possible crash in writezeroes processing” established that blkrqpayloadbytes must not be read without first checking blkrqnrphyssegment...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when the module exits. On...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don’t overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. Meanwhile, GSOMAXSIZE = 8 GSOMAXSEGS = 8...