DPDK: out-of-bounds read/write in vhost_user_set_inflight_fd() may lead to crash

A flaw was found in the vhost library in DPDK. Function vhostusersetinflightfd does not validate msg-payload.inflight.numqueues, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability...

kernel: sfc: fix considering that all channels have TX queues

In the Linux kernel, the following vulnerability has been resolved: sfc: fix considering that all channels have TX queues Normally, all channels have RX and TX queues, but this is not true if modparam efxseparatetxchannels=1 is used. In that cases, some channels only have RX queues and others onl...

kernel: bfq: Avoid merging queues with different parents

In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge and set bic-stablemergebfqq and the moment bfqsetupmerge is called. This...

GSD-2022-1006714 blk-mq: use quiesced elevator switch when reinitializing queues

blk-mq: use quiesced elevator switch when reinitializing queues This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

kernel: sfc: fix considering that all channels have TX queues

In the Linux kernel, the following vulnerability has been resolved: sfc: fix considering that all channels have TX queues Normally, all channels have RX and TX queues, but this is not true if modparam efxseparatetxchannels=1 is used. In that cases, some channels only have RX queues and others onl...

kernel: iavf: Fix adminq error handling

In the Linux kernel, the following vulnerability has been resolved: iavf: Fix adminq error handling iavfallocasqbufs/iavfallocarqbufs allocates with dmaalloccoherent memory for VF mailbox. Free DMA regions for both ASQ and ARQ in case error happens during configuration of ASQ/ARQ registers. Witho...

Microsoft Windows Print Spooler Elevation of Privilege Vulnerability

Print Spooler is a print background processing service that manages all local and network print queues and controls all print jobs.An elevation of privilege vulnerability exists in Microsoft Windows Print Spooler, which stems from improper privilege assignment in the application and can be...

GSD-2022-1006528 ice: Fix crash by keep old cfg when update TCs more than queues

ice: Fix crash by keep old cfg when update TCs more than queues This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.12 by commit...

GSD-2022-1006485 ice: Fix crash by keep old cfg when update TCs more than queues

ice: Fix crash by keep old cfg when update TCs more than queues This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0 by commit...

kernel: ice: Fix memory corruption in VF driver

In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory corruption in VF driver Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when it requests a reset. If PF driver assumes that VF is disabled, while VF still has queues configured, VF may...

kernel: ice: Fix memory corruption in VF driver

In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory corruption in VF driver Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when it requests a reset. If PF driver assumes that VF is disabled, while VF still has queues configured, VF may...

CVE-2021-3839

A flaw was found in the vhost library in DPDK. Function vhostusersetinflightfd does not validate msg-payload.inflight.numqueues, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability...

CVE-2021-46778

Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading SMT. By measuring the contention level on scheduler queues an attacker may potentially leak sensitive...

CVE-2021-46778

A contention-based side channel vulnerability was found in hw. Some AMD CPUs using simultaneous multithreading SMT may allow an attacker to measure the contention level on scheduler queues, leading to potential leakage of sensitive information...

GSD-2022-1004650 block: Fix handling of offline queues in blk_mq_alloc_request_hctx()

block: Fix handling of offline queues in blkmqallocrequesthctx This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.124 by commit...

GSD-2022-1004500 block: Fix handling of offline queues in blk_mq_alloc_request_hctx()

block: Fix handling of offline queues in blkmqallocrequesthctx This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.49 by commit...

GSD-2022-1004445 net: tun: stop NAPI when detaching queues

net: tun: stop NAPI when detaching queues This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.53 by commit...

GSD-2022-1004304 block: Fix handling of offline queues in blk_mq_alloc_request_hctx()

block: Fix handling of offline queues in blkmqallocrequesthctx This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.6 by commit...

Microsoft Azure 加密问题漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A vulnerability exists in Microsoft Azure with cryptographic issues. The following products and versions are affected: Azure Storage Blobs client library for...

GSD-2022-1003837 rtl818x: Prevent using not initialized queues

rtl818x: Prevent using not initialized queues This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.247 by commit...