Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport’s Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire passes a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback; only advtimeoutexpiresync actually frees it. Thi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ipvti: requires CAPNETADMIN in the device netns for changelink vtichangelink operates on at most two netns: devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftablesoffload: suppress WARNONONCE for ENOMEM in abort path In nftflowruleoffloadabort, WARNONONCEerr is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is a u32 value taken directly from the user-supplied command stream. When...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes that the input ranges are sorted by address and do not overlap each other. Initially, this assumption was intended to be explicitly...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Do not hex dump the attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection remains alive while the CDC slot is fetched: sockhold&smc-sk;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops fail to perform header bounds checks prior to dereferencing pIE-length: - issueassocreq iterates through pmlmeinfo-network.ies to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCIHFLAG32BITONLY A user reported that commit 105c42566a55 “ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585” made the JMicron JMB585 unusable on their board. The failure occurs as...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 “vsock/virtio: stop workers during the .remove” made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue wh...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Audit: Fixed data races involving skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE; meanwhile, kauditd writes to this field via the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes. However, when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix broken rx after throttle If the port is closed while throttled, the read urb is never resubmitted and the port will not receive any further data until the device is reconnected or the driver is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid reqqmap double-read in qla2x00errorentry qla2x00errorentry reads ha-reqqmapque twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xxfreereqque ha-reqqmapqueid =...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth contains two bugs in its shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long...

Astra Linux – vulnerability in Chromium

In Google Chrome on HID, use of “After Free” was permitted prior to version 154.0.8037.57; this allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a specially crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: AppArmor: policyint ensures that list heads are initialized prior to the fail path. If profile creation fails before policyinit is completed, the list heads are not properly initialized, causing profilefree sanity checks to trigg...