Astra Linux – Vulnerability in Qemu

A race condition flaw was discovered in the 9pfs server implementation of QEMU, up to and including version 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The greatest threat posed by this vulnerability is to...

Astra Linux – Vulnerability in Intel Microcode

Improper isolation in some IntelR processors’ stream cache mechanism may allow an authenticated user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in xorg-server

A vulnerability was discovered in X.Org. This security flaw occurs because the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths greater than 32 bytes are sent through the XTestFakeInput request. This issue can lead to local...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A out-of-bounds memory access vulnerability was discovered in the vmwgfx driver, located in the vmxgfx/vmxgfxkms.c file within the GPU component of the Linux kernel. The vulnerability affects device files such as '/dev/dri/renderD128 or Dxxx'. This flaw allows a local attacker with a user account...

Astra Linux – Vulnerability in cups

A logic issue has been resolved through improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, and macOS Big Sur 11.6.5. It is possible that an application may gain elevated privileges as a result of this fix...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A use-after-free vulnerability was discovered in the Linux kernel’s ext4 file system, particularly regarding the handling of the additional inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

Astra Linux – Vulnerability in Intel Microcode

Incorrect calculations in the microcode keying mechanism of certain IntelR XeonR D processors with IntelR SGX may allow a privileged user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in ntfs-3g

In NTFS-3G versions before version 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfsinoderealopen, a heap buffer overflow can occur, allowing code execution and escalation of privileges...

Astra Linux – Vulnerability in Linux 5.10

Improper restriction of operations within the bounds of a memory buffer in some IntelR i915 Graphics drivers for Linux before the kernel version 6.2.10 may allow an authenticated user to potentially enable privilege escalation via local access...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. By exploiting vulnerabilities in the Lua script execution environment, an attacker with access to Redis prior to versions 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. T...

Astra Linux – Vulnerability in Linux, Linux-6.1

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs: Ovlcopyupmeta inodedata function skips permission checks when calling ohldosetxattr on Ubuntu kernels...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, and Linux 5.10

A use-after-free vulnerability in the Linux kernel’s netfilter:nftables component can be exploited to achieve local privilege escalation. Adding or removing rules from chain bindings within the same transaction can lead to use-after-free issues. We recommend upgrading to the version after the...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A flaw related to the use of “free” in the Linux kernel’s integrated infrared receiver/transceiver driver was discovered in the way local users detach RC devices. This flaw could be exploited by local users to crash the system or potentially escalate their privileges on the system...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In binder.c, there is a potential way to corrupt memory due to a use after free. This could lead to a local escalation of privileges without the need for additional execution privileges. User interaction is not required for exploitation. Product: Android Versions: Android kernel Android ID:...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in xorg-server. Changing the actions of XKB buttons, such as moving between the touchpad and the mouse, can lead to out-of-bounds memory reads and writes. This may allow for local privilege escalation or potential remote code execution, especially in cases where X11 forwardi...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A flaw was discovered after the free function in the Linux kernel’s Xircom 16-bit PCMCIA PC-card Ethernet driver. A local user could exploit this flaw to crash the system or potentially escalate their privileges on the system...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

An integer overflow vulnerability was discovered in the vmwgfx driver, located in the vmxgfxexecbuf.c file within the GPU component of the Linux kernel. The vulnerability affects device files such as '/dev/dri/renderD128 or Dxxx'. This flaw allows a local attacker with a user account on the syste...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine. This flaw occurs in all versions of Ansible Engine from 2.7.x, 2.8.x, and 2.9.x, as of 2.7.17, 2.8.9, and 2.9.6, respectively. The issue arises when using ansiblefacts as a subkey of itself and promoting it to a variable when inject is enabled. After the...

Astra Linux – Vulnerability in Linux 5.10

There is a vulnerability related to time-of-check to time-of-use issues in the iouringsubsystem’s IORINGOPCLOSE operation in the Linux kernel versions 5.6 to 5.11 inclusive. This vulnerability allows a local user to elevate their privileges to root. Introduced in the version...

Astra Linux – Vulnerability in containerd-app

Containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4, and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer were incorrectly treated as a username, resulting in the evasion of the Kubernetes “runAsNonRoot”...