CLSA-2024-1727817133 Fix of 73 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26752 - l2tp: pass correct message length to ip6appenddata CVE-url: https://ubuntu.com/security/CVE-2021-47188 - scsi: ufs: core: Improve SCSI abort handling CVE-url: https://ubuntu.com/security/CVE-2024-26677 - rxrpc: Fix delayed ACKs to not set the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: venus: Fixed the issue where a use-after-free occurred in vdecclose. It seems that there might be a potential use-after-free when using vdecclose. The firmware will add the buffer release process to the work queue through...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Media: Venus: HFI parser refactoring of packet parsing logic wordscount represents the number of words in the total payload, while data points to the payload of various properties within it. When wordscount reaches the last word,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi parser: A check was added to avoid out-of-bound access. There is a possibility that initcodecs may be invoked multiple times during manipulation of the payload from video firmware. In such cases, if codecscount...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: avoid null dereference in deinit. If venusprobe fails at pmruntimeputsync, it first calls hfiDestroy, and then hficoredeinit. Since hfiDestroy sets core-ops to NULL, hficoredeinit can no longer call the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: venus: protection against spurious interrupts during probing. Ensure that the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hficreate, it’s possible that an interrupt...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Media: Venus: HFI – Add a check to handle incorrect queue size. qsize represents the size of the shared queue between the driver and the firmware. The firmware can modify this value to an invalid, large value. In such situations,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: venus: Fixed an issue where OOB reading occurred due to a missing payload-bound check. Currently, the eventseqchanged handler processes a variable number of properties sent by the firmware. The number of properties is...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Venus: pmhelpers: Fixed a warning in the OPP phase during the probe. Fixed the following WARN messages that were triggered during the Venus driver probe in version 5.19.0-rc8-next-20220728: WARNING: CPU: 7 PID: 339 at...

Malicious Package

Overview eclipse-spectron-webdriver-venus-babel is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001444)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001444 advisory. In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free bug in venusremove due to race condition in venusprobe, core-wo...

Vulnerability-Assessment-Penetration-Testing-Engagement-X-Company

VAPT Report — Venus & Napping X Company Engagement Vulnerab...

ROS-20260804-73-0023

The vulnerability of the qcom/venus/core.c component in the Linux operating system’s kernel is related to incorrect initialization of resources. Exploiting this vulnerability allows an attacker to cause service failures...

ROS-20260804-73-0022

The vulnerability of the qcom/venus/hfivenus.c component in the Linux operating system is related to reading data from the buffer beyond its allowable limits. Exploiting this vulnerability allows an attacker to cause a service failure...

Malicious Package

Overview hermes-venus-cosmos-rest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: media: venus: vdec: A possible memory leak issue has been fixed. The implementation of venushelperallocdpbbufs allows for an early return on an error path when checking the ID from idaallocmin. This would prevent the earlier buff...

ROS-20260403-73-0021

A vulnerability in the venus component of the Linux operating system kernel is related to reading outside the allowed data buffer boundaries. Exploitation of the vulnerability allows an attacker to cause a denial of service...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the coregetv4 function in the drivers/media/platform/qcom/venus/pmhelpers.c file of the Linux multimedia device driver framework is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause service failures...

Linux Driver Heap Buffer Overflow DoS

The vulnerability of the venushelperallocdpbbufs function in the drivers/media/platform/qcom/venus/helpers.c file, a driver for supporting multimedia devices in the Linux operating system, is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005127)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005127 advisory. In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free bug in venusremove due to race condition in venusprobe, core-wo...