CVE-2024-46789

In the Linux kernel, the following vulnerability has been resolved: mm/slub: add check for s-flags in the alloctaggingslabfreehook When enable CONFIGMEMCG & CONFIGKFENCE & CONFIGKMEMLEAK, the following warning always occurs,This is because the following call stack occurred: mempoolalloc...

CVE-2024-46789

CVE-2024-46789 (Linux kernel) details from connected documents show a concrete fix: in mm/slub, the tagging logic now checks s->flags in alloc_tagging_slab_free_hook to avoid calling alloc_tag_add when SLAB_NO_OBJ_EXT or SLAB_NOLEAKTRACE are set. This prevents the NULL ref (ref->ct) and the...

CVE-2024-46747 HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

In the Linux kernel, the following vulnerability has been resolved: HID: cougar: fix slab-out-of-bounds Read in cougarreportfixup reportfixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it...

CVE-2024-46747 HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

In the Linux kernel, the following vulnerability has been resolved: HID: cougar: fix slab-out-of-bounds Read in cougarreportfixup reportfixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it...

CVE-2024-46747

CVE-2024-46747 : In the Linux kernel, the Cougar 500k Gaming Keyboard driver was vulnerable to a slab-out-of-bounds Read in cougar_report_fixup due to a missing verification of the report descriptor size before access. The root cause is in report_fixup not validating the descriptor length prior t...

The vulnerability of the kvm_set_cpuid function in the include/linux/slab.h library of the KVM virtualization subsystem in the Linux operating system allows a hacker to induce a service failure.

The vulnerability of the kvmsetcpuid function in the include/linux/slab.h library of the KVM virtualization subsystem in the Linux kernel is related to improper release of the kvmcpuidentry2 array. Exploiting this vulnerability can allow an attacker to cause a system failure...

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

...

CVE-2024-44987

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...

CVE-2024-44987

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...

CVE-2024-44987 ipv6: prevent UAF in ip6_send_skb()

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...

CVE-2024-44987 ipv6: prevent UAF in ip6_send_skb()

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...

AZL-50254 CVE-2024-44949 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: parisc: fix a possible DMA corruption ARCHDMAMINALIGN was defined as 16 - this is too small - it may be possible that two unrelated 16-byte allocations share a cache line. If one of these allocations is written using DMA and the...

CVE-2024-44973

In the Linux kernel, the following vulnerability has been resolved: mm, slub: do not call doslabfree for kfence object In 782f8906f805 the freeing of kfence objects was moved from deep inside doslabfree to the wrapper functions outside. This is a nice change, but unfortunately it missed one spot ...

UBUNTU-CVE-2024-44949

In the Linux kernel, the following vulnerability has been resolved: parisc: fix a possible DMA corruption ARCHDMAMINALIGN was defined as 16 - this is too small - it may be possible that two unrelated 16-byte allocations share a cache line. If one of these allocations is written using DMA and the...

The vulnerability of the net/packet component in the Linux operating system’s kernel allows a hacker to disclose sensitive information or cause service failures.

The vulnerability of the net/packet component in the Linux operating system’s kernel is related to the presence of access beyond the boundaries of the slab memory area in packetrecvmsg. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a problematic call to the doslabfree function, which could lead to memory corruption and a system crash...

CVE-2024-44946

In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcmsendmsg for the same socket. syzkaller reported UAF in kcmrelease. 0 The scenario is 1. Thread A builds a skb with MSGMORE and sets kcm-seqskb. 2. Thread A resumes building skb from kcm-seqskb but is blocked by...

CVE-2024-44946 kcm: Serialise kcm_sendmsg() for the same socket.

In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcmsendmsg for the same socket. syzkaller reported UAF in kcmrelease. 0 The scenario is 1. Thread A builds a skb with MSGMORE and sets kcm-seqskb. 2. Thread A resumes building skb from kcm-seqskb but is blocked by...

ROS-20240830-01

Vulnerability of the rndissetresponse function in the rndis component of the Linux kernel is related to the "BufOffset + 8" operation, which can cause an integer overflow. Exploitation of the vulnerability could allow an attacker to cause a denial of service A vulnerability in the drm/vrr compone...

CVE-2024-44933

In the Linux kernel, the following vulnerability has been resolved: bnxten : Fix memory out-of-bounds in bnxtfillhwrsstbl A recent commit has modified the code in bnxtreserverings to set the default RSS indirection table to default only when the number of RX rings is changing. While this works fo...