Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed potential memory leaks When the driver encounters -ENOMEM while allocating a URB or a buffer, it abends and proceeds to the error handling path, releasing all previously allocated resources. However, when...

Astra Linux – Vulnerability in Qemu

In QEMU 5.0.0, the file hw/usb/hcd-ohci.c contains a stack-based buffer over-read issue, caused by values obtained from the host controller driver...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fecm: Refactor the bind path to use free After a bind/unbind cycle, the ecm-notifyreq remains stale. If a subsequent bind fails, the unified error handling mechanism attempts to free this stale request. This leads to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two distinctly different samples of NEC uPD720200 one with a start/stop bug, one without it were observed to cause IOMMU faults after some “Missed Service Errors”. Th...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: renesas: Fixed the refcount leak bug In usbhsrza1hardwareinit, the offindnodebyname function will return a node pointer with the refcount incremented. We should use ofnodeput when the node pointer is no longer needed...

Astra Linux – Vulnerability in Qemu

QEMU 5.0.0 has a use-after-free issue in the hw/usb/hcd-xhci.c file, as the return value of usbpacketmap is not checked...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-tmio: check return value after calling platformgetresource This vulnerability could lead to a null-ptr-deref error if platformgetresource returns NULL. Therefore, we need to check the return value of this function...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: Fixed a issue where a NULL pointer dereference could occur during full-speed re-enumeration of devices. This occurs when re-enumering full-speed devices after a failed “address device” command. Full-speed devices may need t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Media: usbtv – Keep the device alive while the ALSA card exists. The ALSA PCM callbacks store the driver’s state in pcm-privatedata. An opened PCM file may remain active even after a USB disconnection occurs, because usbtvaudiofr...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: A use-after-free issue was fixed in the chaoskeyrelease function. The chaoskey driver contains a use-after-free bug in its release routine. If the user closes the device file after the USB device is unplugged, a...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel before version 5.13.6, the drivers/usb/host/max3421-hcd.c file allowed physically nearby attackers to cause a denial of service including use-after-free errors and panic conditions by removing a MAX-3421 USB device under certain circumstances...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput function selects a count of 2 whenever the transfer speed is slower than high speed. It never relates this count to ep-maxtransfer. The URB buffe...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ALSA: usb-audio: fixed OOB write operations on Type II inbound URBs In the dataepsetparams function, the size of each URB transfer buffer is calculated before adding the Format Type II transfer delimiter: u-packets = urbpacks;...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt7921: Drop TXRXNOTIFY on non-MMIO buses PKTTYPETXRXNOTIFY is an event exclusive to MMIO operations. However, mt7921rxcheck and mt7921queuerxskb dispatch this event to mt7921mactxfree on every bus. mt7921mactxfree...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fprinter: Only use kref for successful opening of the character device. The printeropen function returns -EBUSY when the character device is already open. However, it increments the dev-kref regardless of the return...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fixed hard lockup issues upon disconnection. If the OOB write Urb submission fails persistently e.g., if the device is being disconnected, the driver may loop indefinitely with interrupts disabled...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Video: fbdev: smscufx: Fixed null-ptr-deref in ufxusbprobe I received a report of a null-ptr-deref issue: Bug: NULL pointer dereferencing in the kernel; address: 0000000000000000 … RIP: 0010:fbdestroymodelist+0x38/0x100 … Call...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, the ffsep0read function holds ffs-mutex when it prepares to go to sleep and wait for an event. When no setup events are pending, it calls...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: Cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work, and its handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect The submitted write URBs are not stopped when the function close is called. Therefore, they need to be stopped unconditionally when the function disconnect is called, to avoid...