CLSA-2024-1723806933 Fix of 55 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-39467 - f2fs: fix to do sanity check on ixattrnid in sanitycheckinode CVE-url: https://ubuntu.com/security/CVE-2024-36940 - pinctrl: core: delete incorrect free in pinctrlenable CVE-url: https://ubuntu.com/security/CVE-2024-38659 - enic: Validate leng...

bpf: Fix overrunning reservations in ringbuf

...

kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets.

in linux kernel r8169, when transmitting small fragmented packets, invalid entries were inserted into the transmit ring buffer, leading to calls to dmaunmapsingle with a null address...

kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets.

in linux kernel r8169, when transmitting small fragmented packets, invalid entries were inserted into the transmit ring buffer, leading to calls to dmaunmapsingle with a null address...

kernel: tracing: Restructure trace_clock_global() to never block

In the Linux kernel, the following vulnerability has been resolved: tracing: Restructure traceclockglobal to never block It was reported that a fix to the ring buffer recursion detection would cause a hung machine when performing suspend / resume testing. The following backtrace was extracted fro...

kernel: tracing: Restructure trace_clock_global() to never block

In the Linux kernel, the following vulnerability has been resolved: tracing: Restructure traceclockglobal to never block It was reported that a fix to the ring buffer recursion detection would cause a hung machine when performing suspend / resume testing. The following backtrace was extracted fro...

SUSE CVE-2024-41009

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

CVE-2024-41009

An out-of-bounds memory access flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to crash the system. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of...

CVE-2024-41009

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

DEBIAN-CVE-2024-41009

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

CVE-2024-41009

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

UBUNTU-CVE-2024-41009

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

CVE-2024-41009 bpf: Fix overrunning reservations in ringbuf

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

CVE-2024-41009 bpf: Fix overrunning reservations in ringbuf

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

CVE-2024-41009 bpf: Fix overrunning reservations in ringbuf

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

CVE-2024-41009

The CVE-2024-41009 issue affects the Linux kernel BPF ringbuf implementation. It occurs when two reservations overlap in a power-of-2 sized ring buffer, enabling a BPF program to edit a header in a later chunk and corrupt the earlier chunk’s header, potentially crashing the kernel. The root cause...

kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets.

in linux kernel r8169, when transmitting small fragmented packets, invalid entries were inserted into the transmit ring buffer, leading to calls to dmaunmapsingle with a null address...

ALSA-2024:4583 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: TIPC message reassembly use-after-free remote code execution vulnerability CVE-2024-36886 kernel: ethernet: hisilicon: hns: hnsdsafmisc: fix a possible array overflow in hnsdsafgesrstbypo...

CVE-2024-40907

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...

UBUNTU-CVE-2024-40907

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...