Unbreakable Enterprise kernel security update

4.14.35-2047.523.4.1 - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags Michal Hocko Orabug: 35164196 4.14.35-2047.523.4 - rds: ib: Keep IB MRs on cleanlist unless we are tearing down the pool Hakon Bugge Orabug: 34987235 - rds: ib: Add FRWR related statistics counters Hakon...

PT-2025-18805

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.0-96.el9.x86 64 Description A vulnerability in the Linux kernel has been resolved, specifically in the scsi: qla2xxx module. The issue occurred when a command was completed in the abort path during driver...

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.

...

Debian: Security Advisory (DLA-670-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-310-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-23001

In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulatorget return value expects it to be NULL in the error case, whereas it is actually an error pointer...

CVE-2023-23001

In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulatorget return value expects it to be NULL in the error case, whereas it is actually an error pointer...

Null pointer dereference

In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulatorget return value expects it to be NULL in the error case, whereas it is actually an error pointer...

CVE-2023-23001

CVE-2023-23001 affects Linux kernel prior to 5.16.3, where a misinterpretation of regulator_get’s return value in drivers/scsi/ufs/ufs-mediatek.c treats an error pointer as NULL in the error case. This may lead to improper handling in that path. The vulnerability is addressed by the Linux kernel ...

Linux kernel 代码问题漏洞

The Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel prior to version 5.16.3, which stems from the drivers/scsi/ufs/ufs-mediatek.c file incorrectly handling the return value of regulatorget...

kernel security and bug fix update

5.14.0-162.18.11.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

K16531: Linux kernel vulnerability CVE-2014-4027

Security Advisory Description The rdbuilddevicespace function in drivers/target/targetcorerd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdiskmcp memory by leveraging access to a SCSI...

K17475: Linux kernel vulnerability CVE-2015-5707

Security Advisory Description Integer overflow in the sgstartreq function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iovcount value in a write request. CVE-2015-5707...

K17057: QEMU vulnerabilities CVE-2015-3214, CVE-2015-5154, and CVE-2015-5158

Security Advisory Description CVE-2015-3214 An out-of-bounds memory access flaw, leading to memory corruption or possibly an information leak, was found in QEMU's pitioportread function. A privileged guest user in a QEMU guest, which had QEMU PIT emulation enabled, could potentially, in rare case...

K52136304: SCSI libsas driver vulnerability CVE-2019-15807

Security Advisory Description In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sasexpander.c when SAS expander discovery fails. This will cause a BUG and denial of service. CVE-2019-15807 Impact There is no impact; F5 products are not affected by this vulnerability...

K82131333: Linux kernel vulnerability CVE-2019-19066

Security Advisory Description A memory leak in the bfadimgetstats function in drivers/scsi/bfa/bfadattr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service memory consumption by triggering bfaportgetstats failures, aka CID-0e62395da2bd. CVE-2019-19066 Impact There i...

K11225249: Linux kernel vulnerability CVE-2018-20836

Security Advisory Description An issue was discovered in the Linux kernel before 4.20. There is a race condition in smptasktimedout and smptaskdone in drivers/scsi/libsas/sasexpander.c, leading to a use-after-free. CVE-2018-20836 Impact An attacker can exploit this issue to cause denial of servic...

PT-2025-41119

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to SCSI Enclosure Services SES. Specifically, the issue involves potential out-of-bounds accesses within the ses enclosure data process function...

PT-2025-49663

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s SCSI subsystem, specifically within the ses enclosure data process function. This issue involves a slab-out-of-bounds read condition, potentially...

SUSE CVE-2004-1190

SUSE Linux before 9.1 and SUSE Linux Enterprise Server before 9 do not properly check commands sent to CD devices that have been opened read-only, which could allow local users to conduct unauthorized write activities to modify the firmware of associated SCSI devices...