Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: md: initbioset in mddevinit. IO operations may be required before mdrun, such as updating metadata after writing to sysfs. Without bioset, this triggers a NULL pointer dereference, as shown below: BUG: NULL pointer dereference in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: NFSv4: Fixed an error in pnfsmarkrequestcommit, when performing ODIRECT operations. Fixed an error-prone condition in pnfsmarkrequestcommit, when adding a set of write operations to the commit list in order to reschedule them...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed additional out-of-bounds writes from debugfs. CVE-2021-42327 was fixed with the following commit: f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgp...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: remoteproc: imxdsprproc: A custom memory copy implementation was added for i.MX DSP cores. The IRAM is part of the HiFi DSP. According to the hardware specifications, only 32-bit writes are allowed; otherwise, a Kernel panic will...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: x86/kvm: The teardown of PV features also occurs during boot-up. Various PV features Async PF, PV EOI, steal time work through memory shared with the hypervisor. When we resume from hibernation, we must properly teardown all...

Astra Linux – Vulnerability in dcmtk

The service class user SCU of OFFIS DCMTK all versions prior to 3.6.7 is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could enable remote code execution...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: Nilfs2: Do not write dirty data after degrading to read-only. According to the syzbot report, the call to markbufferdirty from nilfssegctordoconstruct outputs a warning with certain patterns after nilfs2 detects metadata corrupti...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Fixed the issue where idisksize could exceed isize in partially written cases. It is possible for idisksize to exceed isize, triggering a warning. genericperformwrite: - copied = iovitercopyfromuseratomiclen // copied...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfs: Fixed a race condition between cache write completion and the setting of ALLQUEUED. When netfslib issues subrequests, these subrequests start processing immediately and may complete before we reach the end of the issuing...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fuse: The fuserelease function contains a race condition between the write2 and close2 calls. This allows pages to become dirty after the fuseFlush - writeinodenow operation. If these pages are not flushed from fuseRelease, there...

Astra Linux – Vulnerability in glibc

A out-of-bounds write vulnerability was discovered in glibc before version 2.31, when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution...

Astra Linux – Vulnerability in Git

Git is a distributed revision control system. git log can display commits in an arbitrary format using its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute. When processing the padding operators, there is an integer overflow in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: mac80211: Fixed an underflow in staticbranchdec for aqldisable. syzbot reported an underflow in staticbranchdec in aqlenablewrite. 0 The issue arises because aqlenablewrite does not serialize concurrent write operations ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: ptrace: Fixed SVE writes on !SME systems When SVE is supported but SME is not supported, a ptrace write to NTARMSVE regset can place the tracee into an invalid state. In this state, non-streaming SVE register data i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nfs: fixed UAF in direct writes In production, we have been encountering the following warnings consistently: ------------ cut here ------------ refcountt: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at...

Astra Linux – Vulnerability in Python 3.11

It allows arbitrary file system writes outside the extraction directory during extraction with the filter="data" parameter. This vulnerability affects users who use the tarfile module to extract untrusted tar archives using methods like TarFile.extractall or TarFile.extract, with the filter=...

Astra Linux – Vulnerability in Qemu

A buffer overflow vulnerability was discovered in the ATI VGA device emulation provided by QEMU. This vulnerability occurs in the ati2dblt routine, during the handling of MMIO write operations, when the guest provides invalid values for the destination display parameters. A malicious guest could...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fixed races among concurrent prealloc/proc write operations. We currently have no protection against concurrent changes to PCM buffer preallocations via proc files. This could potentially lead to UAF or other strange...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: udf: Do not update the file length for failed writes to inline files When writing to an inline file fails or only partially succeeds, we still update the length of the inline data as if the entire write operation was successful...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cachefiles: The maximum subrequest size for cache writes has been set to MAXRWCOUNT. The maximum size of a subrequest that writes to cachefiles is now MAXRWCOUNT, ensuring that we do not exceed the maximum number of writes we can...