kernel: mlxsw: spectrum: Protect driver from buggy firmware

A vulnerability was found in the Linux kernel's mlxsw spectrum driver, where processing port up/down events leads to a NULL pointer dereference. This issue occurs when the driver fails to handle events for the CPU port, which exists but lacks a corresponding network device, resulting in system...

DEBIAN-CVE-2024-46771

In the Linux kernel, the following vulnerability has been resolved: can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcmconnect below. 0 The repro calls connect to vxcan1, removes vxcan1, and calls connect with ifindex == 0. Calling connect for a BCM socket...

Unspecified Vulnerability in Tenda CH22 (CNVD-2024-40282)

Tenda CH22 is a network device from Tenda, China. A security vulnerability exists in Tenda CH22 version V1.0.0.6, which originates from a buffer overflow vulnerability in the fromqossetting function. No details of the vulnerability are available at this time...

Tenda CH22 安全漏洞

Tenda CH22 is a network device from Tenda, China. A security vulnerability exists in Tenda CH22 version V1.0.0.6, which originates from a buffer overflow vulnerability in the frmL7PlotForm function. No details of the vulnerability are available at this time...

leds: trigger: netdev: Fix kernel panic on interface rename trig notify

...

The vulnerability of CGI microprogramming software for network devices such as Zyxel ATP, USG FLEX, and USG FLEX 50(W)/USG20(W)-VPN allows a hacker to cause service interruptions.

The vulnerability of CGI microprogramming software for network devices such as Zyxel ATP, USG FLEX, and USG FLEX 50W/USG20W-VPN lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to cause service interruptions by sending a...

SerComm Network Device Backdoor Detection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SerComm Network Device Backdoor Detection', 'Description' = %q This module can identify SerComm manufactured network devices which contain a...

CVE-2022-48910

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6mcdown at most once There are two reasons for addrconfnotify to be called with NETDEVDOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them...

UBUNTU-CVE-2022-48910

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6mcdown at most once There are two reasons for addrconfnotify to be called with NETDEVDOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them...

CVE-2022-48910 net: ipv6: ensure we call ipv6_mc_down() at most once

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6mcdown at most once There are two reasons for addrconfnotify to be called with NETDEVDOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them...

CVE-2022-48910

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6mcdown at most once There are two reasons for addrconfnotify to be called with NETDEVDOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them...

CVE-2022-48900

Removed by vendor...

UBUNTU-CVE-2024-42282

In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy netdevice handling Move the freeing of the dummy netdevice from mtkfreedev to mtkremove. Previously, if allocnetdevdummy failed in mtkprobe, eth-dummydev would be NUL...

PT-2024-29833 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A potential NULL pointer dereference in dummy net device handling has been resolved. The issue occurred when alloc netdev dummy failed in mtk probe, causing eth-dummy dev to be NULL. T...

ROS-20240816-12

Vulnerability of setupdscconfig function in drivers/gpu/drm/amd/display/dc/dsc/dcdsc.c module of driver amdgpu of the Linux operating system kernel is related to a lack of input validation. Exploitation the vulnerability could allow an attacker to cause a denial of service A vulnerability in the...

kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: honor table dormant flag from netdev release event path The Linux kernel CVE team has assigned CVE-2024-36005 to this issue. Upstream advisory:...

QEMU NBD Server 安全漏洞

QEMU NBD Server is a QEMU disk network block device server that is open source from QEMU. A security vulnerability exists in QEMU NBD Server that originates from a client keeping a socket open when the server is offline, which can be used to launch a denial-of-service attack via incorrect...

kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv

In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939netdevstart: fix UAF for rxkref of j1939priv It will trigger UAF for rxkref of j1939priv as following. cpu0 cpu1 j1939skbindsocket0, ndev0, ... j1939netdevstart j1939skbindsocket1, ndev0, ... j1939netdevstart...

The vulnerability of Zyxel network device microprogramming software, related to deficiencies in access control, allows attackers to enhance their privileges and upload arbitrary configuration files.

The vulnerability of Zyxel network device microprogramming software is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges and upload arbitrary configuration files...

IR Trends: Ransomware on the rise, while technology becomes most targeted sector

Business email compromise BEC and ransomware were the top threats observed by Cisco Talos Incident Response Talos IR in the second quarter of 2024, together accounting for 60 percent of engagements. Although there was a decrease in BEC engagements from last quarter, it was still a major threat fo...