PT-2025-6743

Name of the Vulnerable Software and Affected Versions DAS U-Boot versions prior to 2025.01-RC1 Description A stack consumption issue occurs in the sqfs size function in DAS U-Boot through a crafted squashfs filesystem with deep symlink nesting. This issue affects the SquashFS symlink resolution...

PT-2025-6745

Name of the Vulnerable Software and Affected Versions Das U-Boot versions prior to 2025.01-rc1 Description The issue is related to an off-by-one error in the sqfs search dir function, which leads to heap memory corruption when listing SquashFS directories. This error occurs because the path...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Squashfs: sanity check for symbolic link sizes Syzkiller reports a bug named “KMSAN: uninit-value in picklink”. This issue is caused by an uninitialized page, which ultimately results from reading a corrupted symbolic link siz...

PT-2025-30818

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to Squashfs filesystem handling. A Syzkaller report identified a “shift-out-of-bounds” bug occurring when mounting a Squashfs filesystem...

CLSA-2024-1733158910 kernel: Fix of 6 CVEs

hwmon: ibmpex Fix possible UAF when ibmpexregisterbmc fails CVE-2022-49029 - ppp: fix pppasyncencode illegal access CVE-2024-50035 - ext4: no need to continue when the number of entries is 1 CVE-2024-49967 - net/packet: fix slab-out-of-bounds access in packetrecvmsg CVE-2022-20368 - packet: in...

CLSA-2024-1733142398 kernel: Fix of 6 CVEs

hwmon: ibmpex Fix possible UAF when ibmpexregisterbmc fails CVE-2022-49029 - ppp: fix pppasyncencode illegal access CVE-2024-50035 - ext4: no need to continue when the number of entries is 1 CVE-2024-49967 - net/packet: fix slab-out-of-bounds access in packetrecvmsg CVE-2022-20368 - packet: in...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Prevent UAF in proccpusetshow CVE-2024-43853 In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media CVE-2024-43854 ...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bpf: Silence a warning in btftypeidsize CVE-2023-54247 In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to memcgroupidr CVE-2024-43892 In the Linux kernel, the...

OPENSUSE-SU-2024:0342-1 Security update for lxc

This update for lxc fixes the following issues: lxc was updated to 6.0.2: The LXC team is pleased to announce the release of LXC 6.0.2! This is the second bugfix release for LXC 6.0 which is supported until June 2029. As usual this bugfix releases focus on stability and hardening. Some of the...

CLSA-2024-1729870301 kernel: Fix of 12 CVEs

ftrace: Fix possible use-after-free issue in ftracelocation CVE-2024-38588 - ftrace: Fix possible warning on checking all pages used in ftraceprocesslocs CVE-2024-38588 - ftrace: Store the order of pages allocated in ftracepage CVE-2024-38588 - ftrace: Check if pages were allocated before calling...

CLSA-2024-1729869774 kernel: Fix of 12 CVEs

ftrace: Fix possible use-after-free issue in ftracelocation CVE-2024-38588 - ftrace: Fix possible warning on checking all pages used in ftraceprocesslocs CVE-2024-38588 - ftrace: Store the order of pages allocated in ftracepage CVE-2024-38588 - ftrace: Check if pages were allocated before calling...

The vulnerability of the squashfs_read inode() function in the squashfs file system of Linux kernels allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the squashfsread inode function in the fs/squashfs/inode.c file of the squashfs file system in the Linux kernel is related to the use of an uninitialized variable. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CLSA-2024-1728935304 kernel: Fix of 12 CVEs

xfs: don't walk off the end of a directory data block CVE-2024-41013 - net/sched: clsu32: fix netns refcount changes in u32change CVE-2022-29581 - net/packet: fix slab-out-of-bounds access in packetrecvmsg CVE-2022-20368 - openvswitch: fix OOB access in reservesfasize CVE-2022-2639 - net: sched:...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization CVE-2024-46713 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd CVE-2024-46734 In the...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-46744)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46744 advisory. - In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link siz...

Squashfs: sanity check symbolic link size

...

CLSA-2024-1728584513 Fix of 20 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-38588 - ftrace: Fix possible warning on checking all pages used in ftraceprocesslocs - ftrace: Fix possible use-after-free issue in ftracelocation CVE-url: https://ubuntu.com/security/CVE-2024-46744 - Squashfs: sanity check symbolic link size CVE-url:...

CLSA-2024-1728584192 Fix of 20 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-38588 - ftrace: Fix possible warning on checking all pages used in ftraceprocesslocs - ftrace: Fix possible use-after-free issue in ftracelocation CVE-url: https://ubuntu.com/security/CVE-2024-46744 - Squashfs: sanity check symbolic link size CVE-url:...

CLSA-2024-1728583928 Fix of 18 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-46802 - drm/amd/display: added NULL check at start of dcvalidatestream CVE-url: https://ubuntu.com/security/CVE-2024-46818 - drm/amd/display: fix sporadic multiple aux transaction failure - drm/amd/display: Check gpioid before used as array index...

SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2024:3566-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3566-1 advisory. The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...