DEBIAN-CVE-2024-36286

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: acquire rcureadlock in instancedestroyrcu syzbot reported that nfreinject could be called without rcureadlock : WARNING: suspicious RCU usage 6.9.0-rc7-syzkaller-02060-g5c1672705a1a 0 Not tainted...

UBUNTU-CVE-2024-36286

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: acquire rcureadlock in instancedestroyrcu syzbot reported that nfreinject could be called without rcureadlock : WARNING: suspicious RCU usage 6.9.0-rc7-syzkaller-02060-g5c1672705a1a 0 Not tainted...

CVE-2022-48691 netfilter: nf_tables: clean up hook list when offload flags check fails

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: clean up hook list when offload flags check fails splice back the hook list so nftchainreleasehook has a chance to release the hooks. BUG: memory leak unreferenced object 0xffff88810180b100 size 96: comm...

DEBIAN-CVE-2022-48654

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkosf: fix possible bogus match in nfosffind nfosffind incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nftosf which can be used to leak stale kernel stack data to userspa...

UBUNTU-CVE-2022-48654

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkosf: fix possible bogus match in nfosffind nfosffind incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nftosf which can be used to leak stale kernel stack data to userspa...

CVE-2021-47174

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapoavx2: Add irqfpuusable check, fallback to non-AVX2 version Arturo reported this backtrace: 709732.358791 WARNING: CPU: 3 PID: 456 at arch/x86/kernel/fpu/core.c:128 kernelfpubeginmask+0xae/0xe0 709732.358793...

CVE-2021-46992

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: avoid overflows in nfthashbuckets Number of buckets being stored in 32bit variables, we have to ensure that no overflows occur in nfthashbuckets syzbot injected a size == 0x40000000 and reported: UBSAN:...

CVE-2021-46915 netfilter: nft_limit: avoid possible divide error in nft_limit_init

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlimit: avoid possible divide error in nftlimitinit divu64 divides u64 by u32. nftlimitinit wants to divide u64 by u64, use the appropriate math function div64u64 divide error: 0000 1 PREEMPT SMP KASAN CPU: 1 PID: 83...

PT-2025-41079

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter conntrack component where the timeout value of an unconfirmed conntrack is handled incorrectly. When setting the timeout via the ctnetlink change timeout...

CLSA-2023-1688072342 Fix of 5 CVEs

CVE-2023-32233 // CVE-url: https://ubuntu.com/security/CVE-2023-32233 - netfilter: nftables: add nftsetisanonymous helper - netfilter: nftables: split set destruction in deactivate and destroy phase - netfilter: nftables: unbind set in rule from commit path - netfilter: nftables: fix set...

SUSE CVE-2016-7917

The nfnetlinkrcvbatch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service infinite loop or out-of-bounds...

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because in the case of an nf_queue verdict with a one-byte nfta_payload attribute an skb_pull can encounter a negative skb->len.

...

Exploit for CVE-2022-36946

CVE-2022-36946 Reported-by: Domingo Dirutigliano and Nicola G...

AZL-10440 CVE-2022-36946 affecting package kernel for versions less than 5.15.67.1-4

nfqnlmangle in net/netfilter/nfnetlinkqueue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service panic because, in the case of an nfqueue verdict with a one-byte nftapayload attribute, an skbpull can encounter a negative skb-len...

kernel security and bug fix update

3.10.0-1160.31.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 vmmm after calling handleuserfault Phili...

Kernel security update: Virtuozzo ReadyKernel patch 115.0 for Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform 2.5, 3.0, and Virtuozzo Hybrid Infrastructure 3.5

The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform, and Virtuozzo Hybrid Infrastructure. Vulnerability id: PSBM-107061 3.10.0-862.20.2.vz7.73.29 to...

UBUNTU-CVE-2017-17448

net/netfilter/nfnetlinkcthelper.c in the Linux kernel through 4.14.4 does not require the CAPNETADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnlcthelperlist data structure is shared across all net namespaces...

Virtuozzo 7 : readykernel-patch (VZA-2017-006)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way nfnetlink validated length of batch messages that could allow a user logged in to a...

Virtuozzo 7 : readykernel-patch (VZA-2017-007)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A double free vulnerability was found in netlinkdump, which could cause a denial of service or possibly other...

Kernel security update: Virtuozzo ReadyKernel patch 11.0 for kernels 3.10.0-327.18.2.vz7.15.2 (Virtuozzo 7.0.0) and 3.10.0-327.36.1.vz7.18.7 (Virtuozzo 7.0.1)

The cumulative Virtuozzo ReadyKernel patch updated with security fixes as well as a usability bug fix. The patch applies to Virtuozzo versions 7.0.0 and 7.0.1. Vulnerability id: PSBM-57511 A flaw was found in the way nfnetlink validated length of batch messages that could allow a user logged in t...