127 matches found
Linux munmap() Race Condition / Use-After-Free
Linux munmap has a race condition with pagemapread that leads to a page use-after-free condition...
CVE-2022-22071
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music...
SUSE CVE-2024-56765
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close callback in vasvmops struct The mapping VMA address is saved in VAS window struct when the paste address is mapped. This VMA address is used during migration to unmap the paste address if the window...
DEBIAN-CVE-2024-56765
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close callback in vasvmops struct The mapping VMA address is saved in VAS window struct when the paste address is mapped. This VMA address is used during migration to unmap the paste address if the window...
AZL-54126 CVE-2024-53109 affecting package kernel for versions less than 6.6.64.2-1
In the Linux kernel, the following vulnerability has been resolved: nommu: pass NULL argument to vmaiterprealloc When deleting a vma entry from a maple tree, it has to pass NULL to vmaiterprealloc in order to calculate internal state of the tree, but it passed a wrong argument. As a result, nommu...
CVE-2024-50223
In the Linux kernel, the following vulnerability has been resolved: sched/numa: Fix the potential null pointer dereference in tasknumawork When running stress-ng-vm-segv test, we found a null pointer dereference error in tasknumawork. Here is the backtrace: 323676.066985 Unable to handle kernel...
CVE-2024-50223 sched/numa: Fix the potential null pointer dereference in task_numa_work()
In the Linux kernel, the following vulnerability has been resolved: sched/numa: Fix the potential null pointer dereference in tasknumawork When running stress-ng-vm-segv test, we found a null pointer dereference error in tasknumawork. Here is the backtrace: 323676.066985 Unable to handle kernel...
UBUNTU-CVE-2024-46741
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix double free of 'buf' in error path smatch warning: drivers/misc/fastrpc.c:1926 fastrpcreqmmap error: double free of 'buf' In fastrpcreqmmap error path, the fastrpc buffer is freed in fastrpcreqmunmapimpl if unm...
CVE-2024-42317
In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: avoid PMD-size page cache if needed xarray can't support arbitrary page cache size. the largest and supported page cache size is defined as MAXPAGECACHEORDER by commit 099d90642a71 "mm/filemap: make MAXPAGECACHEORD...
CVE-2023-52438: Use After Free
In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc-vma pointer isn't safe as it can race with munmap. As of commit dd2283f2605e "mm: mmap: zap...
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress...
kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry
A flaw was found in include/asm-generic/tlb.h in the Linux kernel due to a race condition unmapmappingrange versus munmap. This issue allows a device driver to free a page while it still has stale TLB entries...
kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry
A flaw was found in include/asm-generic/tlb.h in the Linux kernel due to a race condition unmapmappingrange versus munmap. This issue allows a device driver to free a page while it still has stale TLB entries...
kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry
A flaw was found in include/asm-generic/tlb.h in the Linux kernel due to a race condition unmapmappingrange versus munmap. This issue allows a device driver to free a page while it still has stale TLB entries...
kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry
A flaw was found in include/asm-generic/tlb.h in the Linux kernel due to a race condition unmapmappingrange versus munmap. This issue allows a device driver to free a page while it still has stale TLB entries...
kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry
A flaw was found in include/asm-generic/tlb.h in the Linux kernel due to a race condition unmapmappingrange versus munmap. This issue allows a device driver to free a page while it still has stale TLB entries...
SUSE CVE-2009-0024
The sysremapfilepages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vmfile structure member, and the mmapregion and domunmap functions...
SUSE CVE-2012-3511
Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...
SUSE CVE-2020-29369
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions expanddownwards and expandupwards and page-table free operations from an munmap call, aka CID-246c320a8cfe...
An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap) a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.
...