USN-7295-1 linux-xilinx-zynqmp vulnerabilities

Ye Zhang and Nicolas Wu discovered that the iouring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code...

CVE-2022-49325

CVE-2022-49325 (Linux kernel) : The vulnerability concerns the TCP path where tp->snd_cwnd can be illegal (zero or negative) values. The fix adds accessors to read/set tp->snd_cwnd to catch illegal values earlier; syzbot previously triggered WARN_ON_ONCE(!tp->prior_cwnd) in a commit that...

Important: kernel-livepatch-6.1.119-129.201

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfochangednotify CVE-2024-36899 In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API busregister...

USN-7166-1 linux, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - ACPI...

Security update for the Linux Kernel (Live Patch 43 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059158 fixes several issues. The following security issues were fixed: CVE-2024-36904: tcp: Use refcountincnotzero in tcptwskunique bsc1225733. CVE-2024-43861: Fix memory leak for not ip packets bsc1229553. CVE-2021-47598: schcake: do not call...

CVE-2024-50955

An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service DoS via a crafted TCP message...

CVE-2024-50955

The CVE-2024-50955 issue affects XINJE XD5E-24R (v3.5.3b) and XINJE XL5E-16T (v3.5.3b). The vulnerability arises from how the controllers handle TCP protocol messages, enabling an attacker to cause a Denial of Service through a crafted TCP message. Products/versions: XD5E-24R v3.5.3b and XL5E-16T...

CVE-2024-50955

An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service DoS via a crafted TCP message...

CVE-2024-50955

An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service DoS via a crafted TCP message...

CLSA-2024-1725871927 kernel: Fix of 30 CVEs

gfs2: Fix potential glock use-after-free on unmount CVE-2024-38570 - gfs2: Remove ill-placed consistency check CVE-2024-38570 - gfs2: introduce new gfs2glockassertwithdraw CVE-2024-38570 - gfs2: simplify gdlmputlock with outfree label CVE-2024-38570 - wifi: mt76: replace skbput with skbputzero...

kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

A use-after-free flaw was found in the Linux kernel’s TCP protocol in how a local user triggers a complex race condition during connection to the socket. This flaw allows a local user to crash or potentially escalate their privileges on the system...

kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

A use-after-free flaw was found in the Linux kernel’s TCP protocol in how a local user triggers a complex race condition during connection to the socket. This flaw allows a local user to crash or potentially escalate their privileges on the system...

kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

A use-after-free flaw was found in the Linux kernel’s TCP protocol in how a local user triggers a complex race condition during connection to the socket. This flaw allows a local user to crash or potentially escalate their privileges on the system...

CVE-2024-0760

A flaw was found in the bind9 package, where a malicious client may send many DNS messages over the TCP protocol, leading to instabilities on the server side and potentially causing a denial of service. The server will recover automatically once the attack ceases. Mitigation Mitigation for this...

CVE-2024-39920

A flaw was found in the TCP protocol in RFC 9293. The TCP protocol has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system to any server when that client system is concurrently obtaining TCP data at a slow rate from an...

CVE-2024-39920

The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system to any server, when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the...

CVE-2024-39920

The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system to any server, when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the...

CVE-2024-39920

The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system to any server, when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the...

PT-2024-28734 · Tcp · Tcp

Name of the Vulnerable Software and Affected Versions: TCP protocol affected versions not specified Description: The issue is related to a timing side channel in the TCP protocol, making it easier for remote attackers to infer the content of one TCP connection from a client system to any server...

The vulnerability of the reqsk_queue_alloc() function in the Linux kernel-based TCP protocol implementation allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the reqskqueuealloc function in the net/core/requestsock.c module of the Linux kernel’s TCP protocol implementation is related to deficiencies in the serialization mechanism, leading to competitive access to resources. Exploiting this vulnerability could allow a remote attack...