CVE-2024-44975

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: fix panic caused by partcmdupdate We find a bug as below: BUG: unable to handle page fault for address: 00000003 PGD 0 P4D 0 Oops: 0000 1 PREEMPT SMP NOPTI CPU: 3 PID: 358 Comm: bash Tainted: G W I 6.6.0-10893-g60d...

CVE-2024-44975 cgroup/cpuset: fix panic caused by partcmd_update

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: fix panic caused by partcmdupdate We find a bug as below: BUG: unable to handle page fault for address: 00000003 PGD 0 P4D 0 Oops: 0000 1 PREEMPT SMP NOPTI CPU: 3 PID: 358 Comm: bash Tainted: G W I 6.6.0-10893-g60d...

CVE-2024-44960

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for...

DEBIAN-CVE-2024-44962

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel ca...

AZL-49980 CVE-2024-44962 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel ca...

CVE-2024-44962

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel ca...

CVE-2024-44960

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for...

UBUNTU-CVE-2024-44962

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel ca...

CVE-2024-44962

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel ca...

CVE-2024-44962 Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel ca...

CVE-2024-44962 Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel ca...

CVE-2024-44962

The CVE affects the Linux kernel Bluetooth btnxpuart driver. Root cause: when unloading btnxpuart, a timer is not reliably shut down, so if the timer is modified during unload it may fire and invoke the timer callback after the driver is gone, causing a kernel panic. The fix is to replace del_tim...

CVE-2024-44960 usb: gadget: core: Check for unset descriptor

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for...

kernel: mm/huge_memory: don't unpoison huge_zero_folio

A vulnerability was found in the Linux kernel's memory management component in the unpoisonmemory function, where it involves improper handling of hugezerofolio when memory failures occur, which can lead to a kernel panic due to an erroneous reference count...

kernel: mm/huge_memory: don't unpoison huge_zero_folio

A vulnerability was found in the Linux kernel's memory management component in the unpoisonmemory function, where it involves improper handling of hugezerofolio when memory failures occur, which can lead to a kernel panic due to an erroneous reference count...

PT-2024-5986

Name of the Vulnerable Software and Affected Versions: FreeBSD affected versions not specified NetApp ONTAP 9 formerly Clustered Data ONTAP PlayStation 5 versions prior to 7.61 Description: A use-after-free vulnerability exists in the umtx op system call within FreeBSD. This vulnerability arises...

FreeBSD -- Multiple vulnerabilities in libnv

Problem Description: CVE-2024-45287 is a vulnerability that affects both the kernel and userland. A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the parsed data. CVE-2024-45288 is a...

FreeBSD-SA-24:14.umtx

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:14.umtx Security Advisory The FreeBSD Project Topic: umtx Kernel panic or Use-After-Free Category: core Module: kern Announced: 2024-09-04 Credits: Synacktiv...

FreeBSD -- umtx Kernel panic or Use-After-Free

Problem Description: Concurrent removals of such a mapping by using the UMTXSHMDESTROY sub-request of UMTXOPSHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. Impact: A malicious code exercizing the UMTXSHMDESTRO...

GHSA-VR26-JCQ5-FJJ8 Denial of service in quinn-proto when using `Endpoint::retry()`

Summary As of quinn-proto 0.11, it is possible for a server to accept, retry, refuse, or ignore an Incoming connection. However, calling retry on an unvalidated connection exposes the server to a likely panic in the following situations: - Calling refuse or ignore on the resulting validated...