13948 matches found
CVE-2024-36002 dpll: fix dpll_pin_on_pin_register() for multiple parent pins
In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllpinonpinregister for multiple parent pins In scenario where pin is registered with multiple parent pins via dpllpinonpinregister.., all belonging to the same dpll device. A second call to dpllpinonpinunregister...
CVE-2024-35987
CVE-2024-35987 relates to the Linux kernel on RISCV NOMMU. The issue arose from enabling a linear mapping that used RAM below the kernel load address, which breaks NOMMU because PAGE_OFFSET is fixed to the load address. As a result mm initialization can start at mem_map and corrupt adjacent kerne...
CVE-2024-35980 arm64: tlb: Fix TLBI RANGE operand
In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Fix TLBI RANGE operand KVM/arm64 relies on TLBI RANGE feature to flush TLBs when the dirty pages are collected by VMM and the page table entries become write protected during live migration. Unfortunately, the operand...
CVE-2024-35977 platform/chrome: cros_ec_uart: properly fix race condition
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecuart: properly fix race condition The crosecuartprobe function calls devmserdevdeviceopen before it calls serdevdevicesetclientops. This can trigger a NULL pointer dereference: BUG: kernel NULL pointer...
CVE-2024-35970 af_unix: Clear stale u->oob_skb.
In the Linux kernel, the following vulnerability has been resolved: afunix: Clear stale u-oobskb. syzkaller started to report deadlock of unixgclock after commit 4090fa373f0e "afunix: Replace garbage collection algorithm.", but it just uncovers the bug that has been there since commit 314001f0bf9...
CVE-2024-35967 Bluetooth: SCO: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported scosocksetsockopt is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset include/linux/sockptr.h:49...
CVE-2024-35966 Bluetooth: RFCOMM: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt user input syzbot reported rfcommsocksetsockoptold is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset...
CVE-2024-35950 drm/client: Fully protect modes[] with dev->mode_config.mutex
In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes with dev-modeconfig.mutex The modes array contains pointers to modes on the connectors' mode lists, which are protected by dev-modeconfig.mutex. Thus we need to extend modes the same protection or ...
SUSE: Security Advisory (SUSE-SU-2024:1675-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-35947
In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUGON in control parser Fix a BUGON from 2009. Even if it looks "unreachable" I didn't really look, lets make sure by removing it, doing prerr and return -EINVAL instead...
CVE-2024-35921
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix oops when HEVC init fails The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed i...
CVE-2024-35920
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...
UBUNTU-CVE-2024-35942
In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mp-blk-ctrl: imx8mpblk: Add fdcc clock to hdmimix domain According to i.MX8MP RM and HDMI ADD, the fdcc clock is part of hdmi rx verification IP that should not enable for HDMI TX. But actually if the clock is...
CVE-2024-35921
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix oops when HEVC init fails The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed i...
CVE-2024-35932 drm/vc4: don't check if plane->state->fb == state->fb
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: don't check if plane-state-fb == state-fb Currently, when using non-blocking commits, we can see the following kernel warning: 110.908514 ------------ cut here ------------ 110.908529 refcountt: underflow; use-after-free...
CVE-2024-35921
CVE-2024-35921 affects the Linux kernel media/mediatek vcodec HEVC decoding path. The stateless HEVC decoder stored the instance pointer in the context even on initialization failure, leading to a use-after-free when the pointer was freed during deinit. The documented workaround is to store the i...
CVE-2024-35898
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix potential data-race in nftflowtabletypeget nftunregisterflowtabletype within nfflowinetmoduleexit can concurrent with nftflowtabletypeget within nftablesnewflowtable. And thhere is not any protection when...
CVE-2024-35883
In the Linux kernel, the following vulnerability has been resolved: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxxspiprobe In function pci1xxxxspiprobe, there is a potential null pointer that may be caused by a failed memory allocation by the function devmkzalloc. Hence, a...
CVE-2024-35916
In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix NULL pointer dereference in sanitycheck If due to a memory allocation failure mockchain returns NULL, it is passed to dmafenceenableswsignaling resulting in NULL pointer dereference there. Call...