Astra Linux – Vulnerability in Firefox and Thunderbird

A website could have obscured the fullscreen notification by using a URL that was processed by an external program, such as a mailto URL. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbi...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fix deadlock in smb2findsmbtcon Unlock cifstcpseslock before calling cifsputsmbses to avoid such deadlocks...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: padata: Fixed the pd UAF issue once and for all. There is a race condition/UAF in padatareorder that persists even after the initial commit. A reference count is incremented at the beginning of the process in padatadoparallel, an...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: llc: Calling sockorphan at the release time syzbot reported an interesting trace 1 caused by a stale pointer to sk-skwq in a closed llc socket. In the commit ff7b11aa481f "net: socket: setting sock-sk to NULL after calling...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm, slub: fixed a potential memory leak in kmemcacheopen. In the error path, the slub cache’s randomseq value might be leaked. This issue was addressed by using kmemcacherelease to release all relevant resources...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed an issue where inode lists were leaked during backref walking in findparentnodes. During backref walking, when findparentnodes is called, if we are dealing with a data extent and an error occurs while resolving...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Memory: Samsung; Exynos5422-DMC: Fixed the refcount leak in ofgetdramtimings. ofparsephandle returns a node pointer with a refcount incremented. We should use ofnodeput on it when it is no longer needed. This function does not...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a Blob URL is loaded through some unusual user interaction, it may have been loaded by the system principal, granting additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: EDAC/mc: Fixed the error path ordering in edacmcalloc. When the mci-pvtinfo allocation in edacmcalloc fails, the error path will call putdevice, which will ultimately call the device’s release function. However, the initializatio...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fixed the potential NULL pointer dereferencing issue. If sdprobe encounters an error before sdkp-device is initialized, sdzbcreleasedisk is called. This leads to a NULL pointer dereferencing issue when sdiszoned is call...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: greybus: Fixed a use-after-free bug in gbinterfacerelease due to a race condition. In gbinterfacecreate, &intf-modeswitchcompletion is bound to gbinterfacemodeswitchwork. It will then be initiated by gbinterfacerequestmodeswitch...

Astra Linux – Vulnerability in Parsec

The vulnerability of the pdp-ls utility in the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: plfxlc: Removed an erroneous assertion in plfxlcmacrelease The plfxlcmacrelease function includes an assertion that checks whether mac-lock is held. This assertion is incorrect, because even if it were possible, it would no...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dax: Fixed the issue where daxmappingrelease was called after the free operation. A test using CONFIGDEBUGKOBJECTRELEASE to remove a device-related dax region e.g., using modprobe -r daxhmem results in the following output:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xen: Fixed the issue where resources were not properly released in xenbusdevprobe This patch addresses a issue with the xenbusdevprobe function. In the xenbusdevprobe function, within the if err branch at line 313, the program...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: ata: libata-core: Fixed null pointer dereference on error If the ataportalloc call in atahostalloc fails, atahostrelease will be called. However, the code in atahostrelease attempts to free the members of the ataport struct...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cpufreq: schedutil: Use kobject release method to free sugovtunables The struct sugovtunables is protected by the kobject, so we cannot free it directly. Otherwise, we would receive a call trace like this: ODEBUG: free active...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: caam – Fixed the pointer passed to caamqishutdown. The type of the last parameter given to devmaddactionorreset is "struct caamdrvprivate ", but in caamqishutdown, it is casted to "struct device ". Pass the correct...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Remove the spinlockbh operation when releasing resources after uploading. Session resources are used by the firmware and driver when the session is offloaded. Once the session is uploaded, these resources are no...