RLSA-2024:0134 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: use after free in unixstreamsendpage CVE-2023-4622 kernel: vmwgfx: reference count issue leads to use-after-free in surface handli...

kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user...

kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Linux Kernel Denial of Service Vulnerability (CNVD-2024-14766)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service attack vulnerability exists in the Linux Kernel. The vulnerability is due to a memory leak found in ctnetlinkcreateconntrack in...

DEBIAN-CVE-2023-6270

A flaw was found in the ATA over Ethernet AoE driver in the Linux kernel. The aoecmdcfgpkts function improperly updates the refcnt on struct netdevice, and a use-after-free can be triggered by racing between the free on the struct and the access through the skbtxq global queue. This could lead to...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel. The vulnerability is due to the aoecmdcfgpkts function in the Linux kernel's ATA over Ethernet AoE driver incorrectly...

SUSE CVE-2023-7192

A memory leak problem was found in ctnetlinkcreateconntrack in net/netfilter/nfconntracknetlink.c in the Linux Kernel. This issue may allow a local attacker with CAPNETADMIN privileges to cause a denial of service DoS attack due to a refcount overflow...

Linux Kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service attack vulnerability exists in the Linux Kernel. The vulnerability is due to a memory leak found in ctnetlinkcreateconntrack in...

mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table-getrefcount == 0 in dict0dict.cc...

kernel: media: dvbdev: adopts refcnt to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: adopts refcnt to avoid UAF dvbunregisterdevice is known that prone to use-after-free. That is, the cleanup from dvbunregisterdevice releases the dvbdevice even if there are pointers stored in file-privatedata still...

kernel: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()

In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: fix refcount leak in pcigetdevwrapper As the comment of pcigetdomainbusandslot says, it returns a PCI device with refcount incremented, so it doesn't need to call an extra pcidevget in pcigetdevwrapper, and the PCI...

Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6503-1)

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6503-1 advisory. Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local...

kernel: net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change()

A flaw was found in the sunrpc module in the Linux kernel. A missing decrement of the reference count when an error occurs can cause a memory leak, and a missing check can cause a NULL pointer dereference, potentially resulting in a denial of service...

kernel: Linux kernel: Resource exhaustion in amdgpu due to PCI device reference count leak

A flaw was found in the Linux kernel's drm/amdgpu component. A missing call to pcidevput in the amdgpuatrmgetbios function leads to a PCI device reference count leak. A local attacker could exploit this to cause resource exhaustion, potentially resulting in a Denial of Service DoS...

kernel: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in hswephaslimitsbox pcigetdevice will increase the reference count for the returned 'dev'. We need to call pcidevput to decrease the reference count. Since 'dev' is only used in...

kernel: Linux kernel: Denial of Service due to PCI device reference count leak

A flaw was found in the Linux kernel. A local low-privileged user could exploit a reference count leak in the drm/amdgpu component. This vulnerability, related to how PCI Peripheral Component Interconnect devices are managed, could lead to a Denial of Service DoS by exhausting system resources...

kernel: soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow

A reference count underflow flaw was found in the Linux kernel's SoundWire bus driver. When pmruntimeresumeandget returns an error -EACCES, the code continues execution and calls pmruntimeput at the end, even though the usage count was never incremented. This causes a usage count underflow in the...

kernel: irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix error handling in gicpopulateppipartitions ofgetchildbyname returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. When kcalloc fails, it missing ofnodeput and...

kernel: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data

A reference-count flaw was found in the Linux kernel Berkeley Packet Filter BPF sockmap implementation. When processing messages with remaining data, the same Transmission Control Protocol TCP socket reference could be released more than once. A local user running BPF sockmap programs could use...