Astra Linux – Vulnerability in Dbus

Before version 1.15.6, D-Bus sometimes allowed unprivileged users to cause dbus-daemon to crash. If a privileged user with control over dbus-daemon used the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: FS: JFS: Fixed the null-ptr-deref read operation in txBegin. Syzkaller reported a issue where txBegin might be called on a superblock within a read-only mounted file system, leading to a NULL pointer dereference. This issue can b...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: jfsdmap: Validates dbl2nbperpage during mounting In jfsdmap.c, on line 381, BLKTODMAP is used to obtain a logical block number within dbFree. dbl2nbperpage, which is the log2 of the number of blocks per page, is passed as an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed the BUGON condition in btrfscancelbalance. Pausing and canceling balance can race to interrupt balance, leading to a BUGON panic in btrfscancelbalance. The BUGON condition in btrfs CancelBalance does not take this ra...

Astra Linux – Vulnerability in sssd

A flaw was discovered in SSSD, where the sssctl command was vulnerable to shell command injection through the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into executing a specially crafted sssctl command, such as using sudo, in order to gain root...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed to avoid potential panic during recovery. During recovery, if FAULTBLOCK is enabled, it is possible that f2fsreservenewblock will return -ENOSPC during recovery, which may trigger a panic. Additionally, if the faul...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fixed RELEASELOCKOWNER The test on socount in nfsd4releaselockowner is pointless and harmful. revert to using checkforlocks, and change it to not sleep. Firstly, it’s harmful. As documented in the kdoc comment for...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fixed possible deadlocks in the system-wide PM code. It is reported that in low-memory situations, the system-wide resume core code may lead to deadlocks. This occurs because asyncscheduledev executes its argument...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfs: Only call foliostartfscache once for each folio. If a network filesystem using netfs implements a clamplength function, it can set subrequest lengths that are smaller than the page size. When we loop through the folios in...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed a UAF in cifsdemultiplexthread There is a UAF when performing xfstests on cifs: BUG: KASAN: Use-after-free in smb2isnetworknamedeleted+0x27/0x160 Reading a size 4 value at address ffff88810103fc08 by task cifsd/923...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

A use-after-free flaw was discovered in the setupasyncwork function in the KSMBD implementation of the in-kernel Samba server and CIFS services in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed resources...

Astra Linux – Vulnerability in Wireshark

A crash in the CMS protocol dissector in Wireshark versions 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows for denial of service through packet injection or malicious capture files...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix supplicant wait loop The OP-TEE supplicant is a user-space daemon, and it is possible for it to be hung, crashed, or terminated mid-processing an OP-TEE RPC call. This issue becomes more complex when there is...

Astra Linux – Vulnerability in cups

The vulnerability of the cupsSNMPStringToOID function in the CUPS printing server is related to the escape from the global buffer. Exploiting this vulnerability allows an attacker to access confidential data and also cause service failures...

Astra Linux – Vulnerability in Linux 5.15

A use-after-free flaw was discovered in the Linux kernel, specifically in the logreplay function within fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and causes a kernel information leak...

Astra Linux – Vulnerability in Linux 5.15

A flaw in memory writing within the Linux kernel’s UDF file system functionality was discovered. This flaw allows a user to trigger certain file operations, which in turn triggers udfwritefi. A local user could exploit this flaw to crash the system or potentially cause other malicious actions...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw involving a null pointer dereference was discovered in the Linux kernel’s UDF file system functionality. This flaw allows a malicious UDF image to trigger the udffilewriteiter function. A local user could exploit this flaw to crash the system. The flaw is present in the Linux kernel versio...

Astra Linux – Vulnerability in Golang-1.15

Avoid versions before 1.15.13 and 1.16.x, as well as those before 1.16.5, which have functions for DNS lookups that do not validate the responses from DNS servers. As a result, a return value might contain an unsafe injection e.g., XSS, which does not conform to the RFC1035 format...

Astra Linux – Vulnerability in Firefox

Another issue in networking: the DNS component. This vulnerability has been fixed in Firefox 150 and Thunderbird 150...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Do not assert that we found a block group item when creating a free space tree. Currently, when building a free space tree using populatefreespacetree, if the block group tree feature is not enabled, we always expect to fi...