Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: selinux: Avoid dereferencing sksocket in selinuxsctpbindconnect. In selinuxsctpbindconnect, sk-sksocket is dereferenced to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is...

Astra Linux – Vulnerability in gst-plugins-base1.0

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2readsynchuint function, located in id3v2.c. If id3v2readsynchuint is called with a null work-hdr.framedata, the pointer guint8 data is accessed without validatio...

Astra Linux – vulnerability in Apache2

In Apache HTTP Server 2.4.59 and earlier, a null pointer dereference vulnerability in modproxy allows an attacker to crash the server via a malicious request. Users are advised to upgrade to version 2.4.60, which fixes this issue...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrmupdateaeparams Normally, x-replayesn and x-preplayesn should be allocated at xfrmallocreplaystateesn... in xfrmstateconstruct..., hence xfrmupdateaeparams... is okay to update them. However, the curren...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fix null pointer dereference in tracingerrlogopen Fix an issue in the ‘tracingerrlogopen’ function. The function does not call ‘seqopen’ when the file is opened only with write permissions, which results in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Drivers: vmbus: Check for channel allocation before looking up relid. relid2channel assumes that the vmbus channel array is already allocated when it is called. However, in situations like kdump/kexec, not all relids will be rese...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fixed a race condition during reboot During system reboot, cpufreqsuspend is called via the kernelrestart - deviceshutdown path. Unlike the normal system suspend path, the reboot path does not call freezeprocesses, so...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference The 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks; thus, there is a possibility that when uuidcount != 0 but uuids is NULL, a NUL...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decodechooseargs A message of type CEPHMSGOSDMAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crushdecode, an array of maxbuckets CRUSH buckets is...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Protect sysfs discipline callbacks from accessing unallocated private data Several sysfs show/store handlers invoke a discipline callback that dereferences device-private, either directly or via the DASDDEFINEATTR macr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible null-ptr-deref in ocfs2setbufferuptodate During cleanup, if flags without OCFS2BHREADAHEAD are present, it may trigger a NULL pointer dereference in ocfs2setbufferuptodate when bh is NULL...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL pointer dereference in bonddoioctl In bonddoioctl, slavedev is obtained via devgetbyname, which may return NULL if the requested interface name does not exist. However, the subsequent slavedbg call is place...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ubi: Fixed potential null-ptr-deref in ubifreevolume This will lead to a null-ptr-deref in the following scenario: uifinit ubiaddvolume cdevadd - if it fails, call killvolumes deviceregister killvolumes - if ubiaddvolume fails,...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: nbd: call genlunregisterfamily first in nbdcleanup Otherwise, there may be a race condition between module removal and the handling of netlink commands, which can lead to the oops as shown below: BUG: kernel NULL pointer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: Features are now recalculated after XDP is disabled, fixing the issue of null dereferencing. Features are recalculated when XDP is disabled. Before: bash ip li set dev eth0 xdp obj xdpdummy.bpf.o sec xdp ip li set dev...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac: A NULL pointer dereference occurred in the brcmftxfinalize function. When the device is removed or the kernel module is unloaded, a potential NULL pointer dereference may occur. The following sequence leads to the...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: mmcspi: fix error handling in mmcspiprobe If mmcaddhost fails, it does not need to call mmcremovehost, or it will cause a null‑ptr dereference, as deleting a device that was never added in mmcremovehost can lead to this issu...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: tracing: kprobe: Fix potential null-ptr-deref on traceeventfile in kprobeeventgentestexit When tracegeteventfile failed, genkretprobetest will be assigned as the error code. If module kprobeeventgentest is removed now, the null...