kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng

A vulnerability was found in the hwrng component of the Linux kernel, which caused a deadlock when reading from /dev/hwrng into memory and mmap-ed from /dev/hwrng. This issue is triggered by a recursive read during a page fault and allows a local, authenticated attacker to cause a denial of servi...

kernel: io_uring/kbuf: hold io_buffer_list reference over mmap

CVE-2024-35880 is a vulnerability in the Linux kernel's iouring subsystem, specifically related to how kernel buffers kbuf are handled during memory mapping mmap operations. The flaw stems from a situation where a buffer can be unregistered prematurely while it is still being used, leading to a...

CLSA-2024-1731348593 kernel: Fix of 18 CVEs

mm: call the securitymmapfile LSM hook in remapfilepages CVE-2024-47745 - slip: make slhcremember more robust against malicious packets CVE-2024-50033 - drm/amdkfd: amdkfdfreegttmem clear the correct pointer CVE-2024-49991 - firmwareloader: Block path traversal CVE-2024-47742 - ext4: avoid OOB...

SUSE CVE-2022-49030

In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 maxentries will overflow u32 when mapping producer page and data pages. Only casting maxentries to sizet is not enough, because...

CVE-2022-48981

In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drmgemshmemmmap doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free...

CVE-2022-49030

In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 maxentries will overflow u32 when mapping producer page and data pages. Only casting maxentries to sizet is not enough, because...

DEBIAN-CVE-2022-49030

In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 maxentries will overflow u32 when mapping producer page and data pages. Only casting maxentries to sizet is not enough, because...

DEBIAN-CVE-2022-48981

In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drmgemshmemmmap doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free...

UBUNTU-CVE-2022-48981

In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drmgemshmemmmap doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free...

UBUNTU-CVE-2022-49030

In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 maxentries will overflow u32 when mapping producer page and data pages. Only casting maxentries to sizet is not enough, because...

CVE-2022-49030 libbpf: Handle size overflow for ringbuf mmap

In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 maxentries will overflow u32 when mapping producer page and data pages. Only casting maxentries to sizet is not enough, because...

CVE-2022-49030 libbpf: Handle size overflow for ringbuf mmap

In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 maxentries will overflow u32 when mapping producer page and data pages. Only casting maxentries to sizet is not enough, because...

CVE-2022-49030 libbpf: Handle size overflow for ringbuf mmap

In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 maxentries will overflow u32 when mapping producer page and data pages. Only casting maxentries to sizet is not enough, because...

CVE-2022-49030

The CVE-2022-49030 issue affects the Linux kernel component libbpf, specifically a size overflow in ringbuf mmap when mapping producer and data pages. The root cause is an overflow of the 32-bit read/write region size (max 2GB ringbuf on x86-64) due to computing 2 * max_entries, which can overflo...

AZL-50975 CVE-2024-47745 affecting package kernel for versions less than 6.6.56.1-5

In the Linux kernel, the following vulnerability has been resolved: mm: call the securitymmapfile LSM hook in remapfilepages The remapfilepages syscall handler calls dommap directly, which doesn't contain the LSM security check. And if the process has called personalityREADIMPLIESEXEC before and...

AZL-50713 CVE-2024-47745 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: mm: call the securitymmapfile LSM hook in remapfilepages The remapfilepages syscall handler calls dommap directly, which doesn't contain the LSM security check. And if the process has called personalityREADIMPLIESEXEC before and...

DEBIAN-CVE-2024-47745

In the Linux kernel, the following vulnerability has been resolved: mm: call the securitymmapfile LSM hook in remapfilepages The remapfilepages syscall handler calls dommap directly, which doesn't contain the LSM security check. And if the process has called personalityREADIMPLIESEXEC before and...

UBUNTU-CVE-2024-47745

In the Linux kernel, the following vulnerability has been resolved: mm: call the securitymmapfile LSM hook in remapfilepages The remapfilepages syscall handler calls dommap directly, which doesn't contain the LSM security check. And if the process has called personalityREADIMPLIESEXEC before and...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from improper handling of a size overflow in the libbpf's ringbuf mmap operation, which could affect mmap...

UBUNTU-CVE-2024-47674

In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw...