Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A use-after-free vulnerability in the Linux kernel’s afunix component can be exploited to achieve local privilege escalation. The unixstreamsendpage function attempts to add data to the last skb in the peer’s recv queue without locking the queue. This creates a race condition where...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A use-after-free vulnerability was discovered in the Linux kernel’s netfilter subsystem, specifically in the net/netfilter/nftablesapi.c file. Improper error handling related to NFTMSGNEWRULE allows a dangling pointer to be used within the same transaction, leading to a use-after-free...

Astra Linux – Vulnerability in Intel Microcode

Improper input validation in the XmlCli feature for UEFI firmware on some Intel processors may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in Intel Microcode

Improper handling of overlap between protected memory ranges in some IntelR XeonR 6 processors with IntelR TDX may allow a privileged user to potentially enable an escalation of privileges through local access...

Astra Linux – Vulnerability in ofono

oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in the X.Org Server Overlay Window. A use-after-free could lead to local privilege escalation. If a client explicitly destroys the compositor overlay window also known as COW, the Xserver will retain a dangling pointer to that window in the CompScreen structure, which will...

Astra Linux – Vulnerability in edk2

Null pointer dereferencing in Tianocore EDK2 may allow an authenticated user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in Linux 5.15

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to gain local privilege escalation. The perfgroupdetach function did not check the attachstate of the event’s siblings before calling addeventtogroups. However, removeonexec allowed calling listdelevent...

Astra Linux – Vulnerability in Intel Microcode

Improper input validation in some IntelR TDX module software prior to version 1.5.05.46.698 may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Cryptohome’s Google Chrome version prior to 88.0.4324.96 allowed a local attacker to perform OS-level privilege escalation through a crafted file...

Astra Linux – Vulnerability in libraw

Buffer overflow vulnerability in LibRaw Linux/unix v0.20.0 allows attackers to escalate privileges through the LibRawbufferdatastream::getschar, int function in /src/libraw/src/librawdatastream.cpp...

Astra Linux – Vulnerability in Linux

A flaw was discovered in the JFS filesystem code within the Linux kernel, which allows a local attacker to cause the system to panic by enabling the ability to set extended attributes. This can lead to memory corruption or an escalation of privileges. The most significant threat posed by this...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Security. The supported versions affected by this vulnerability are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A use-after-free vulnerability exists in the netfilter component of the Linux kernel’s code, specifically the nftables module. This vulnerability can be exploited to achieve local privilege escalation. Due to a race condition between the netlink control plane transaction and the garbage collectio...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A vulnerability related to out-of-bounds memory access was discovered in the Linux kernel’s XFS file system, regarding how a user restores an XFS image after a failure with a dirty log journal. This vulnerability allows a local user to crash the system or potentially escalate their privileges on...

Astra Linux – Vulnerability in Linux 5.10

A use-after-free flaw was discovered in the Linux kernel’s iouring subsystem. This flaw occurs when a user sets up a ring using IORINGSETUPIOPOLL, with multiple tasks completing submissions within that ring. This flaw allows a local user to crash the system or escalate their privileges on the...

Astra Linux – Vulnerability in freeipa

A privilege escalation from the host to the domain vulnerability was identified in the FreeIPA project. By default, the FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account, allowing users to create services with the same canonical name as the REALM admin...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected MariaDB installations. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL...

Astra Linux – Vulnerability in Linux

A vulnerability was discovered in the Linux kernel, where a reference count leak occurs in the llcpsockbind function, leading to a use-after-free condition. This could result in privilege escalation...

Astra Linux – Vulnerability in xorg-server

A use-after-free flaw was identified in the X.Org X server and Xwayland within the miSyncDestroyFence function. A client that sets up multiple fence triggers may trigger a use-after-free function pointer call. An attacker could connect to the X server to set up a fence and wait for it, then anoth...