Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fixed a segmentation fault in rxecompqueuepkt. In rxecompqueuepkt, an incoming response packet is enqueued into the resppkts queue. Then, it is decided whether to run the completer task inline or schedule it. Finally, t...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: net: lltemac: Ensure that the skb is freed when it is completely used. By using the TX BD to track the skb pointer, we can efficiently free the skb buffer after the frame has been transmitted. However, to avoid freeing the skb...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: inet: Sk-skrxdst was converted to RCU rules. The syzbot reported various issues related to early demux processing. One of these issues is included in this changelog 1. Sk-skrxdst uses RCU protection without proper documentatio...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fixed a memory leak in mt7615mcuwtblstaadd. In mt7615mcuwtblstaadd, an skb object named sskb is allocated. If the subsequent call to mt76connacmcuallocwtblreq fails, the function returns an error without releasing t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The can: hi311x module has corrected the ndochangemtu function to prevent buffer overflows. Sending a PFPACKET allows bypassing the CAN driver’s logic and directly reaching the xmit function of the CAN driver. The only check...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ICE: xsk: prohibit usage of non-balanced queue ID Fix the following scenario: 1. ethtool -L $IFACE rx 8 tx 96 2. xdpsock -q 10 -t -z The above refers to a situation where a user wants to attach an XSK socket in txonly mode at a...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can result in the callback being fired later, thereby causing a use-after-free when using the channel. This vulnerability can be exploited by a malicious...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: can: xilinxcan: xcanwriteframe – Fixed the issue of a use-after-free of the transmitted SKB. canputechoskb takes ownership of the SKB, and it may be freed during or after the call. However, xilinxcan xcanwriteframe continues t...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: nbd: Fixed an issue where the process got hung during disconnection of a device. In our tests, “qemu-nbd” triggered a hung process: INFO: Task “qemu-nbd”: 11445 is blocked for more than 368 seconds. Not tainted...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: i2c: Fixed a skb memory leak in the receive path. When midev-allowrx is set to false, the newly allocated skb is not consumed by netifrx. It is necessary to free the skb directly...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tcp/dccp: Do not use timerpending in reqskqueueunlink. Martin KaFai Lau reported a use-after-free in reqsktimerhandler. We are encountering a use-after-free related to a bpf program attached to tracetcpretransmitsynack. The...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: mcast: added RCU protection to mldnewpack The mldnewpack function can be called without holding RTNL or RCU. It should be noted that we can no longer use sockallocsendskb, because ipv6.igmpsk relies on GFPKERNEL...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: mctp: It now takes ownership of the skb in mctplocaloutput. Currently, mctplocaloutput only takes ownership of the skb on a successful operation. In some cases where mctplocaloutput fails, we might leak the skb. Ownership of...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: SCO: Fixed UAF in scosocktimeout. The conn-sk might have been unlinked/freed while waiting for scoconnlock. Therefore, this check determines whether conn-sk is still valid by verifying that it is part of scosklist...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: TCP/UDP: Fixed memory leaks related to sk and zerocopy SKBS with TX timestamps. Syzkaller reported 0 memory leaks of an UDP socket and ZEROCOPY SKBS. We can reproduce this issue with the following sequence: sk = socketAFINET,...

Astra Linux – Vulnerability in Tomcat9

Check-time/use-time TOCTOU race condition vulnerability in Apache Tomcat: When creating Unix domain sockets, an unauthorized local user can access the Unix domain socket. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, and from 9.0.42...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sunrpc: Clearing the XPRTSOCKUPDTIMEOUT when resetting the transport. Since the transport-sock has been set to NULL during the reset of the transport, the XPRTSOCKUPDTIMEOUT also needs to be cleared. Otherwise, the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: net: rds: Do not hold the sock lock when canceling work from rdstcpresetcallbacks. The syzbot is reporting a lockdep warning at rdstcpresetcallbacks 1. The related commit is ac3615e7f3cffe2a “RDS: TCP: Reduce code duplication in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fixed the acceptqueue memory leak Since the final stages of socket destruction may be delayed, it is possible that virtiotransportrecvlisten will be called after the acceptqueue has been flushed, but before the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: TLS: Fixed a race condition between TX work scheduling and socket closure. Similar to previous commits, the submitting thread recvmsg/sendmsg may exit as soon as the async crypto handler’s call completes. Reordering the...