Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: TCP/UDP: Fixed memory leaks related to sk and zerocopy SKBS with TX timestamps. Syzkaller reported 0 memory leaks of an UDP socket and ZEROCOPY SKBS. We can reproduce this issue with the following sequence: sk = socketAFINET,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fixed a memory leak in 'host1xremove'. A missing call to 'host1xchannellistfree' was added in the remove function, just as already done in the error handling path of the probe function...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: time/debug: A memory leak was fixed by using debugfslookup. When calling debugfslookup, the result must be processed with dput, otherwise a memory leak will occur over time. To simplify things, simply call debugfslookupandremove,...

Astra Linux – Vulnerability in Firefox and Thunderbird

On some systems—depending on the graphics settings and drivers—it was possible to exploit a vulnerability that allowed for reading data outside the bounds of the allocated memory space, thereby leaking memory data into the images created on the canvas element. This vulnerability affects Firefox...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: AppArmor: A memory leak has been fixed in allocns. After changes in commit a1bd627b46d1 “AppArmor: sharing the profile name during replacement”, the hname member of the struct aapolicy is not a valid slab object; however, it is a...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix memory leak when register device fails If the deviceregister function fails, it should call putdevice to release the reference. The name allocated by devsetname can be freed in the callback functi...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A vulnerability has been discovered in the Linux kernel. It has been identified as a problem. This vulnerability affects the function vsockconnect in the file net/vmwvsock/afvsock.c. Manipulation of this function leads to a memory leak. The complexity of an attack is quite high. Exploitation of...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: wwanhwsim: Fixed a possible memory leak in wwanhwsimdevnew. When a fault is injected while probing a module, if deviceregister fails, and the refcount of the kobject is not decreased to 0, the name allocated in devsetname may ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking data upon a failure of krealloc. Currently, dmaresvgetfences will leak the previously allocated array if the fence iteration is restarted and kreallocarray fails. Free the old array manually, and...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain SAUCE patches that include a memory leak issue in the handling of large responses to AppArmor notifications. This bug can be triggered by a non-privileged local user. The memory leak could lead to resource exhaustion...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor patches that incorrectly attempt to free a pointer that was not previously allocated using kmalloc. At the same time, allocated memory is also leaked. This bug can be triggered by an unprivileged local user, and it can result in corruption of slab...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: Release buffer when fbcondosetfont fails. syzbot is reporting a memory leak at fbcondosetfont, for the commit a5a923038d70 “fbdev: fbcon: Properly revert changes when vcresize fails”. It was overlooked that the buff...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iommu/sprd: The DMA buffer should be released to avoid memory leaks. When attaching to a domain, the driver allocates a DMA buffer, which is used to store the address mapping table. This buffer must be released when the IOMMU...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh’s handling of key exchange KEX processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, especially...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mt76: mt76x02u: fixed a possible memory leak in mt76x02umcusendmsg. Free the skb if mt76ubulkmsg fails in the mt76x02umcusendmsg routine...

Astra Linux – Vulnerability in libvirt

A issue was discovered in qemuDomainGetStatsIOThread in qemu/qemudriver.c within libvirt version 4.10.0 through 6.x, prior to 6.1.0. A memory leak was identified in the virDomainListGetStats libvirt API, which is responsible for retrieving domain statistics when managing QEMU guests. This flaw...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: caif: A memory leak has been fixed in cfctrllinkuprequest. When linktype is unknown, or kzalloc fails in cfctrllinkuprequest, pkt is not released. Add a release process to the error handling logic...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/drv: Fixed a potential memory leak in drmdevinit. drmdevinit will add drmdevinitrelease as a callback. When drmmaddaction fails, the release function will not be added. As a result, the refcnt added by deviceget in...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: hifusb: fixed a memory leak related to urbs in ath9khifusbdealloctxurbs Syzkaller reported a well-known leak of urbs in ath9khifusbdealloctxurbs. The cause of the leak is that the usbgeturb function is called, but th...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in qlt24xxhandleabts The commit 8f394da36a36 “scsi: qla2xxx: Drop TARGETSCFLOOKUPLUNFROMTAG” caused the qlt24xxhandleabts function to return early if tcmqla2xxxfindcmdbytag failed to find a command...