Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bridge: brndsend: Linearize the skb before parsing ND options. The brndsend function parses neighbor discovery options from ns-opt and assumes that these options are located in the linear part of the request. Its callers only...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Reallocate the update replies for mismatched IDs. The ovsflowcmdnew function preallocates the optional reply skb before acquiring the ovsmutex and before determining which existing flow will be updated. This is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: Do not force the CLOSE state on an invalidseqrst packet without checking the direction. An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 – corrected the typo in the F55 transmitter electrode count. During the detection of the F55 sensor, the transmitter TX electrode count was incorrectly assigned the value of the receiver RX electrode count d...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: afs: Fixed the callback service message parsers to pass through -EAGAIN. The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - For mptcp: The issue of uninitialized localid being retained in the syncookie MPJOIN reconstruction has been fixed. - The function mptcptokenjoincookieinitstate restores remotenonce, localnonce, backup, joinid, token, and ms...

Astra Linux – Vulnerability in openexr

OpenEXR provides the specification and reference implementation of the EXR file format, a image storage format for the motion picture industry. In versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there was an integer overflow in ImageChannel::resize, which led t...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

FFmpeg before version 8.1 has an integer overflow, resulting in an out-of-bounds write operation through CENC Common Encryption subsample data into libavformat/mov.c...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pwm: lpc32xx: Remove handling of PWM channels Since the LPC32xx PWM controllers have only one output, which is registered as the only PWM device/channel per controller, it is known in advance that pwm-hwpwm value is always 0. Bas...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: selinux: It is required that every boolean value be defined. pbools.nprim comes from the policy image, regardless of how many boolean values follow it. The condindexbool function fills boolvaltostruct at value - 1. Therefore, if...

Astra Linux – Vulnerability in Chromium

The use of after-free in the Guest View component in Google Chrome before version 149.0.7827.103 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 5.15, Linux

In the Linux kernel, the following vulnerability has been resolved: erofs: Fix for pcluster use-after-free on UP platforms During stress testing with CONFIGSMP disabled, KASAN reports the following issue: ================================================================== BUG: KASAN: Use-after-fre...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb:dwc3:st: fix probed platform device ref count on probe error path The probe function never performs any platform device allocation. Therefore, the error path “undoplatformdevalloc” is completely spurious. It simply reduces th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fixed an out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess calculates the local store offset as address - vma-vmstart, but checks the bounds against vma-vmend instead of the local store size. On 64-bit...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm: Avoid leaving partial pfn mappings in error cases. As Jann points out, PFN mappings are special. Unlike normal memory mappings, there is no lifetime information associated with the mapping—it’s just a raw mapping of PFNs,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm raid: fixed access issues beyond the end of the raid member array. When the dm-raid table is loaded using raidctr, dm-raid allocates an array rs-devsrs-raiddisks for the raid device members. rs-raiddisks is determined by the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: Disallowed overlapping input ranges for damonsetregions. damonsetregions assumes that the input ranges are sorted by address and do not overlap each other. Therefore, this assumption was initially expected to be...

Astra Linux – Vulnerability in TIF format

A vulnerability was discovered in the libtiff library. This flaw causes a heap buffer overflow issue due to the TIFFTAGINKNAMES and TIFFTAGNUMBEROFINKS values...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. A specially crafted JPEG file can cause the JPEG parser in grub2 to incorrectly check the boundaries of its internal buffers, leading to an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is still a concer...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: smc: Fixed a use-after-free in pnetfindbasendev. syzbot reported a use-after-free of netdevice in pnetfindbasendev, which was called during connect. 0 smcpnetfindismresource retrieves skdstgetsk-dev and passes it to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fixed a page overflow in sevdbgcrypt for the ENCRYPT path. In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff, but not by the destination page offset PAGESIZE - doff...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech – fixed an array out-of-bounds issue in focaltechprocessrelpacket. Made finger2 and also finger1 unsigned; if the finger index in the packet is 0, subtracting 1 results in an array index that overflows above the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ibmasm: Fixed an issue where the heap was overread in the ibmasmsendi2omessage function. The ibmasmsendi2omessage function uses getdotcommandsize to calculate the byte count for memcpytoio, but this value is derived from...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: nci: fixed an issue where uninit-value was left uninitialized in the RF discover/activated NTF handlers. ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket both parse a notification into an on-stack struct that is not...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fixed a potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed during subsequent error paths. This issue was addressed by calling...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: wifi: iwlwifi: mvm: fix an issue where the TXF key sanitizer might have an off-by-one error. iwlmvmfrobtxfkeyiter tracks the last matched byte position in the loop variable ‘i’. When a full key match is found match == keylen,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Prevent Spectre v1 gadget construction in sysrtas. Smatch warns: arch/powerpc/kernel/rtas.c:1932 dosysrtas warning: potential Spectre issue with ‘args args’ r local limit The ‘nargs’ and ‘nret’ locals originate from...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fixed an infinite loop that occurred when parsing an invalid IRQ value. When an invalid value is passed via the “eisairqedge=” kernel command-line parameter e.g., “eisairqedge=16,5”, the eisairqsetup function prints...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the XDR length calculation in nfsd4ffencodelayoutget. The XDR buffer size calculation in nfsd4ffencodelayoutget contains multiple errors that can lead to either an out-of-bounds write or the leakage of uninitialize...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: HID: Multitouch: fixed an out-of-bounds bit access in mtioflags mtioFlags is a single unsigned long variable, but functions like mtprocessSlot, mtreleasePendingPalms, and mtreleaseContacts use it as a per-slot bitmap indexed by t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: Check the client ownership when canceling a copy-notify stateid. On the OFFLOADCANCEL path clp != NULL, the managecpntfstate function freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the usb:typec:ucsi:ccg section, firmware images without a ‘:’ record header are rejected. The doflash function searches for the first .cyacd record using the following code: c p = strnchrfw-data, fw-size, ':'; while p eof s =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fqpie: Clamp the default quantum to avoid signed overflow. The fqpieinit function sets q-quantum = pschedmtuqdiscdevsch without clamping it. A device with a very large MTU e.g., a dummy device with maxmtu == 0 and a...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Avoid dividing by 0 in mbupdateavgfragmentsize when the block bitmap is corrupted. The issue arises when the block bitmap is corrupted, and dividing by 0 may occur during this function. To mitigate this risk, it is necessar...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu – fixed type confusion in CDC union descriptor parsing. The driver currently relies on bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead t...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fixed a null pointer crash in mtkdrmcrtcfinishpageflip. It is possible that mtkcrtc-event is NULL in mtkdrmcrtcfinishpageflip. The pendingneedsvblank value is set by mtkcrtc-event, but in mtkdrmcrtcatomicFlush, it...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A vulnerability was discovered in the Linux kernel before version 6.5.9. This vulnerability could be exploited by local users who have access to MMIO registers through the user space. Incorrect access checks in the VC handler, along with improper emulation of MMIO accesses using the SEV-ES...

Astra Linux – Vulnerability in Chromium

In Google Chrome, before version 150.0.7871.47, races in DataTransfer allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Protection was added to the device queue against concurrent access. In the dasdprofilestart function, the number of requests on the device queue is counted. However, access to the device queue is not protected against...

Astra Linux – Vulnerability in Chromium

The use of after-free in Skia in Google Chrome before version 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in WebKit2GTK

A memory corruption issue has been resolved through improved input validation. This issue is fixed in Safari 18.1, iOS 18.1, iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, and watchOS 11.1. Processing maliciously crafted web content may lead to an unexpected process crash...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: crypto: qat – fix DMA transfer direction When CONFIGDMAAPIDEBUG is enabled, during the execution of the crypto self-test for QAT crypto algorithms, the function adddmaentry reports a warning indicating that overlapping mapping...

Astra Linux – Vulnerability in Chromium

Before version 150.0.7871.47, using the “After Free” feature in Google Chrome extensions allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code through a crafted Chrome extension. Chromium security severity: Critical...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi – Check the validity of the card index during the probe. The virmidi driver blindly trusts that the given devptr-id value is within the appropriate card index range during the probe. It’s fine for the devices create...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Power: Supply: bq256xx – Drain usbwork before freeing the charger. The USB-PHY notifier queues usbwork, and the handler of usbwork calls powersupplychangedbq-charger. The devm action only unregisters the notifier, but it was...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: goodix – clamps the device-reported contact count The goodixtsreadinputreport function copies the number of touch points reported by the device into an on-stack buffer: u8 pointdata2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACT...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtnat: rejects unsupported target families The xtnat SNAT and DNAT target handlers assume that the IP-family conntrack state is present. This allows them to dereference a NULL pointer when instantiated from an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: xprtrdma: Repost Receive buffers for malformed replies The rpcrdmawcreceive function decrements the transport’s Receive count for each incomplete reply before dispatching a successful Receive to rpcrdmareplyhandler. The handle...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: AppArmor: The recursive approach used for removing profiles has been replaced with an iterative one. The profile removal code uses recursion when removing nested profiles, which can lead to exhaustion of the kernel’s stack and...