DEBIAN-CVE-2024-43830

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs attributes before calling deactivate Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate callback and freed by the deactivat...

CVE-2024-43830

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs attributes before calling deactivate Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate callback and freed by the deactivat...

UBUNTU-CVE-2024-43830

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs attributes before calling deactivate Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate callback and freed by the deactivat...

CVE-2024-43830 leds: trigger: Unregister sysfs attributes before calling deactivate()

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs attributes before calling deactivate Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate callback and freed by the deactivat...

CVE-2024-43830

CVE-2024-43830 : Linux kernel vulnerability in leds: trigger race. The issue arises when unregistering trigger sysfs attributes after deactivate(), creating a window where trigger-data could be referenced post-free. The documented fix moves device_remove_groups() to before deactivate(), ensuring ...

CVE-2024-42268

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on that host, it misses taking devlink lock before calling devlinkremotereloadactionsperforme...

CVE-2024-42268 net/mlx5: Fix missing lock on sync reset reload

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on that host, it misses taking devlink lock before calling devlinkremotereloadactionsperforme...

GitHub Actions Script Injection in `ultralytics/actions`

Summary The Ultralytics action available at https://github.com/marketplace/actions/ultralytics-actions is vulnerable to GitHub Actions script injection. If anyone uses the action within a workflow that runs on the pullrequesttarget trigger, then an attacker can inject arbitrary code into that...

CVE-2024-42233

In the Linux kernel, the following vulnerability has been resolved: filemap: replace pteoffsetmap with pteoffsetmapnolock The vmf-ptl in filemapfaultrecheckptenone is still set from handleptefault. But at the same time, we did a pteunmapvmf-pte. After a pteunmapvmf-pte unmap and rcureadunlock, th...

The vulnerability of the GTime2str function in the ASN1 Parser library of the libcurl library allows a attacker to trigger an octath in the service.

The vulnerability of the GTime2str function in the ASN1 Parser library of the libcurl library is related to reading beyond the memory boundaries. Exploiting this vulnerability could allow a malicious actor to trigger an octath in the service...

AZL-48261 CVE-2024-42114 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211ATTRTXQQUANTUM values syzbot is able to trigger softlockups, setting NL80211ATTRTXQQUANTUM to 2^31. We had a similar issue in schfq, fixed with commit d9e15a273306 "pktsched: fq: do not accept sill...

DEBIAN-CVE-2024-42114

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211ATTRTXQQUANTUM values syzbot is able to trigger softlockups, setting NL80211ATTRTXQQUANTUM to 2^31. We had a similar issue in schfq, fixed with commit d9e15a273306 "pktsched: fq: do not accept sill...

DEBIAN-CVE-2024-41037

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: fix null deref on system suspend entry When system enters suspend with an active stream, SOF core calls hwparamsuponresume. On Intel platforms with HDA DMA used to manage the link DMA, this leads to call...

The vulnerability of Siemens SCALANCE industrial switches, related to bypassing authentication through spoofing, allows a intruder to trigger a maintenance failure.

The vulnerability of Siemens SCALANCE industrial switches relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability can allow a malicious actor to trigger a service failure remotely...

PT-2024-7517 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the smb2 async writev function in the Linux kernel, which is responsible for handling server re-repick on subrequest retry. When a subrequest is marked for...

RUSTSEC-2024-0405 op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime. It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic = msg = throw new...

CVE-2022-48861

In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vpvdparemove When vpvdpa driver is unbind, vpvdpa is freed in vdpaunregisterdevice and then vpvdpa-mdev.pcidev is dereferenced in vpmodernremove, triggering use-after-free. Call Trace of unbinding driv...

AZL-62592 CVE-2024-40999 affecting package kernel 6.6.126.1-1

In the Linux kernel, the following vulnerability has been resolved: net: ena: Add validation for completion descriptors consistency Validate that first flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur. A new reset reason for R...

CVE-2024-40962

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes Shin'ichiro reported that when he's running fstests' test-case btrfs/167 on emulated zoned devices, he's seeing the following NULL pointer dereference in...

DEBIAN-CVE-2024-40951

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL pointer dereference in ocfs2aborttrigger bdev-bdsuper has been removed and commit 8887b94d9322 change the usage from bdev-bdsuper to bassocmap-host-isb. Since ocfs2 hasn't set bh-bassocmap, it will trigger NULL...