Astra Linux - Vulnerability in Golang-1.23

A malicious module proxy can exploit a flaw in the go command’s validation of module checksums to bypass the checksum database validation process. This vulnerability affects any user who uses a trusted module proxy GOMODPROXY or a checksum database GOSUMDB. A malicious module proxy can serve...

Astra Linux – Vulnerability in Firefox, Thunderbird

In some cases, a stale value might have been used for a global variable during WASM JIT analysis. This led to incorrect compilation and potentially exploitable crashes in the content process. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: dm-verity: Recursive forward error correction has been disabled. There are two issues with this recursive correction mechanism: 1. It may cause a denial-of-service attack. In the fecreadbufs function, there is a loop with 253...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fixed a potential memory leak in otx2inittc. In otx2inittc, if rhashtableinit fails, the variable tc-tcEntriesBitmap, which is allocated from otx2tcallocEntbitmap, is not freed...

Astra Linux – Vulnerability in Linux 5.15

A null pointer dereference issue was detected in the can protocol in the net/can/afcan.c file in Linux before Linux. The mlpriv variable may not be initialized in the receive path of CAN frames. A local user could exploit this flaw to crash the system or potentially cause a denial of service...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

There is a speculative pointer dereferencing issue in the Linux kernel, specifically with the doprlimit function. The value of the resource argument is controlled and is used in pointer arithmetic for the ‘rlim’ variable. This can lead to the leakage of its contents. We recommend upgrading to a...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Added a null pointer check to scomdebuginitone. The kasprintf function returns a pointer to dynamically allocated memory; this pointer may be NULL in case of failure. A null pointer check should be added, and the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: Serialize the qdiscrtablist operation against concurrent get/put calls. The qdiscgetrtab and qdiscputrtab functions mutate the process-global, singly-linked list qdiscrtablist, as well as a simple, non-atomic variab...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: tpm: efi: Use a local variable to calculate the final log size When tpmreadlogefi is called multiple times, which occurs when one loads and unloads a TPM2 driver multiple times, the global variable efitpmfinallogsize will...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc-bus: Fixed a use-after-free issue in fslmcbusremove. In fslmcbusRemove, mc-rootmcbusdev-mcio was passed to fsldestroymcio. However, mc-rootmcbusdev was already freed in fslmcDeviceRemove. As a result, referencing...

Astra Linux – Vulnerability in nss

During ECDSA signature generation, padding is applied in the nonce to ensure that constant-time scalar multiplication is removed. However, this results in variable-time execution that depends on secret data. This vulnerability affects Firefox versions less than 80, as well as Firefox for Android...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: iommu/omap: Fixed buffer overflow in debugfs There are two issues here: 1 The “len” variable needs to be checked before the very first write. Otherwise, if omap2iommudumpctx is called with “bytes” less than 32, it will result ...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed an out-of-bounds access in rpage. When PAGESIZE is 64K, if logreadrst calls readlogpage for the first time, the size of buffer will be equal to DefaultLogPageSize4K. However, for buffer operations like memcpy, if...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Module: Fixed kernel panic when a symbol’s stshndx value is out of bounds The module loader does not check the bounds of the ELF section index in simplifysymbols: c for i = 1; i shsize / sizeofElfSym; i++ const char name =...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8712: fixed an issue with uninit-value in usbread8 and related functions. When r8712usbctrlvendorreq returns a negative value, the “data” stored in usbread8,16,32 will not be initialized. Bug: KMSAN: uninit-value i...

Astra Linux – Vulnerability in Qemu

A stack-based buffer overflow was discovered in the virtio-net device of QEMU. This issue occurs when flushing the TX operation in the virtionetflushtx function, provided that the guest has enabled VIRTIONETFHASHREPORT, VIRTIOFVERSION1, and VIRTIONETFMRGRXBUF. This could allow a malicious user to...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the USB redirector device usb-redir of QEMU. Small USB packets are combined into a single, large transfer request, in order to reduce overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array VLA on th...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: fixed an array-index-out-of-bounds issue in dbAdjTree. Currently, there is a missing bounds check when accessing the dmtstree within dbAdjTree. To address this issue, a boolean variable named “isctl” was added. This variable...

Astra Linux – Vulnerability in dcmtk

DCMTK’s version 3.6.6 does not handle memory release properly. The memory allocated for storing all file information is stored in a global variable called LST, and this memory is not released properly. Making specific requests to the dcmqrdb program can lead to a memory leak. An attacker can use...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tipc: fixed an information leak in tipctopsrvkernsubscr A 8-byte write was used to initialize sub.usherhandle in tipctopsrvkernsubscr. Otherwise, four bytes remained uninitialized when calling setsockopt..., SOLTIPC,.... This...