Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Networks: Fixed a stack overflow issue when LRO is disabled for virtual interfaces. When the features of a virtual interface are updated, the updated features are synchronized with its underlying interfaces. This synchronization...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: uinput – Zero initializes uinputff UploadCompat to prevent information leakage. The struct ffeffectcompat is embedded twice within uinputff UploadCompat and contains internal padding. In particular, there is a gap after...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fixed the race involving destroyworkonstack. The following debug object splat was observed during testing: ODEBUG: Freeing an active object active state 0: 0000000097d23782; Object type: workstruct; Hint:...

Astra Linux – vulnerability in Chromium

A stack buffer overflow in V8 within Google Chrome prior to version 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a specially crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in jq

jq is a command-line JSON processor. In versions 1.8.1 and earlier, the functions jvsetpath, jvgetpath, and delpathssorted in jq’s src/jvaux.c utilize unbounded recursion; the recursion depth is determined solely by the length of an array passed as a path argument by the caller, with no depth lim...

Astra Linux – Vulnerability in busybox

There is a stack overflow vulnerability in ash.c:6030 in busybox before version 1.35. In the environment of the Internet of Vehicles, this vulnerability can lead to the execution of arbitrary code from commands...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside the top interrupt context as uninteresting or irrelevant parts of the stack traces. This aids in stack trace de-duplication,...

Astra Linux – vulnerability in golang-1.19

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A NULL pointer dereference flaw was discovered in the Linux kernel’s ipv4 stack. The socket buffer skb was assumed to be associated with a device before calling ipoptionscompile. However, this assumption does not always hold if the skb is rerouted by ipvs. This issue may allow a local user with...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmfcpreinitdcmds This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep in...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite reads message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block wri...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: The PMK parameter is now passed as binary data, rather than hexadecimal data. It appears that the hexadecimal passphrase mechanism does not work on newer chips/firmwares e.g., BCM4387. There was actually...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Added a depth limit to indxfindbuffer to prevent stack overflow. indxfindbuffer recursively descends the B+ tree index without a depth limit. A malicious NTFS image with circular index node references causes unbounded...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, Sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: pcie: handle randbuf allocation failure The kzalloc in brcmfpciedownloadfwnvram returns null when physical memory runs out. Consequently, if we use getrandombytes to generate random bytes into randbuf, a null...

Astra Linux – vulnerability in linux-6.1, linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in ipmakeskb KMSAN reported uninit-value access in ipmakeskb 1. ipmakeskb tests HDRINCL to determine whether the skb contains an icmphdr. However, HDRINCL can lead to a race condition. If calling...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: sched/taskstack: fix objectisonstack for KASAN tagged pointers When CONFIGKASANSWTAGS and CONFIGKASANSTACK are enabled, the objectisonstack function may produce incorrect results due to the presence of tags in the obj pointer,...

Astra Linux – vulnerability in fig2dev

A flaw was found in xfig. This vulnerability allows potential code execution via local input manipulation through the bezierspline function...

Astra Linux – Vulnerability in binutils

A issue was discovered in cp-demangle.c within GNU libiberty, as part of the GNU Binutils 2.31 package. This issue involves stack exhaustion during the C++ demangling functions provided by libiberty. There is also a stack consumption problem caused by recursive stack frames: cplusdemangletype,...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: Fix potential memory leak The function dwc3qcomprobe allocates memory for a resource structure pointed to by the parentres pointer. This memory is not freed, resulting in a memory leak. Use stack memory to preven...