Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fixed null pointer access to epfile after ep enable. A race condition occurs when ffsfuncepsenable runs concurrently with ffsdatareset. The ffsdataclear function called in ffsdatareset sets ffs-epfiles to NULL...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iommufd: Do not cause an overflow during division for dirty tracking. If pgshift is 63, then BITSPERTYPEbitmap-bitmap pgsize will result in an overflow to 0, which can trigger a division by zero. In this case, the index should...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Treating $Extend records as regular files. Since the commit af153bb63a33 "vfs: catching invalid modes in mayopen" requires that any inode be of one of the types SIFDIR/SIFLNK/SIFREG/SIFCHR/SIFBLK/SIFIFO/SIFSOCK, use SIFREG...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: Verify the inode mode when loading from disk. The inode mode loaded from a corrupted disk may be invalid. Do as described in the commit 0a9e74051313 "isofs: Verify the inode mode when loading from disk"...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: An out-of-bounds access issue in parsesecdesc has been fixed. If osidoffset, gsidoffset, and dacloffset can be greater than smbntsdstruct.size. If they are smaller, it could lead to an out-of-bounds situation. Additionally...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fixed a crash in nfsd4readrelease. When tracing is enabled, the tracenfsdreaddone trace point crashes during the pynfs read.testNoFh test...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbcon: Set fbdisplayi-mode to NULL when the mode is released. Recently, we discovered the following issue through syzkaller: BUG: KASAN: Slab-use-after-free in fbmodeisequal+0x285/0x2f0 A read of size 4 at address ff11000001b3c69...

Astra Linux – Vulnerability in libpng1.6

LIBPNG is a reference library used in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From version 1.6.51 to 1.6.53, there was a potential issue of excessive memory access in the libpng simplified API function pngimagefinishread, when processing...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: SCTP: A potential out-of-bounds exception has been prevented in sctptransportupdaterto. SYZBOAT reported a potential out-of-bounds exception 1. The responsible developer added rtoalphamax and set rtobetamax to 1000. It is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Fixed string copying in parseapplysbmountoptions. The strnlen function cannot be used to copy a non-NUL-terminated string into a NUL-terminated string of possibly larger size. Commit 0efc5990bca5 “string.h: Introduce memtos...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: The return value of f2fsrecoverfsyncdata has been fixed. With the following scripts, a panic will occur in f2fs: bash mkfs.f2fs -f /dev/vdd mount /dev/vdd /mnt/f2fs touch /mnt/f2fs/foo sync echo 111 /mnt/f2fs/foo f2fsio fsy...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: add idatasem protection in ext4destroyinlinedatanolock Fix a race between inline data destruction and block mapping. The function ext4destroyinlinedatanolock changes the inode data layout by clearing EXT4INODEINLINEDATA and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: dice: fixed a buffer overflow in detectstreamformats The function detectstreamformats reads the streamcount value directly from a FireWire device without validating it. This can lead to out-of-bounds writes when a malicious...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: netcp: We have standardized the knavdmaopenchannel function to return NULL on error. This ensures that it consistently returns NULL in case of errors, rather than ERRPTR. Currently, the header...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: tlv320adcx140 – fixed a null pointer issue. The “sndsoccomponent” in “adcx140priv” was only used once and was never set. It was only used to access “dev”, which already exists in “adcx140priv”...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a reference count leak when an invalid session is found during session lookup. When a session is found, but its state is not SMB2SESSIONVALID, it indicates that no valid session was found. However, the reference coun...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will invoke the dotruncate routine, resulting in an uninitialized runlock error reported by syzbo...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Ensuring that pending IRQ work is processed before freeing the ring buffer. A race condition was addressed in this fix, where irqwork could be queued in bpfringbufcommit, but the ring buffer was freed before the work execute...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net:sock section, the issue of a “hardened usercopy panic” in sockrecverrqueue has been fixed. The skbufffclonecache structure was created without defining a usercopy region. Unlike the skbuffheadcache, which properly...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix for use-after-free in ksmbdtreeconnectput under concurrency conditions. Under high concurrency, a tree-connection object tcon is freed during a disconnection path, while another path still holds a reference to it...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PCI: cadence: Check for the existence of cdnspcie::ops before using it. cdnspcie::ops may not be populated by all Cadence glue drivers. This is true for the upcoming Sophgo platform, which does not set ops. Therefore, add a check...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The socket is closed after it has been accepted, even when the per-IP limit is exceeded and a connection attempt fails. When the per-IP connection limit is exceeded in ksmbdkthreadfn, the code sets ret to -EAGAIN and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: makes decodepool more resilient against corrupted osdmaps. If the osdmap is maliciously corrupted in such a way that the encoded length of the cephpgpool envelope is less than what is expected for a particular encoding...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: orangefs: fixed xattr-related buffer overflow issues… Willy Tarreau forwarded me a message from Disclosure , containing the following warning: The helper function xattrkey uses the pointer variable in the loop condition, rather...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed a memory leak in cifsconstructtcon When using a multiuser mount with domain= specified and cifscreds, cifssetcifscreds will set @ctx-domainname, so it needs to be freed before leaving cifsconstructtcon. This...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb/server: A possible reference count leak in smb2sesssetup has been fixed. The reference count of ksmbdsession will leak when a session needs to be reconnected. This issue has been fixed by adding the missing ksmbdusersessionpu...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfs4setupreaddir: Insufficient locking for -dparent-d inode dereferencing. Theoretically, this could lead to an oops error due to a race condition, but I don’t believe anyone would actually exploit this vulnerability on real...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: be2net: Pass wrbparams in case of OS2BMC. The function beinsertvlaninpkt is called with the wrbparams argument being NULL at the besendpkttobmc call site. This may lead to dereferencing a NULL pointer during the processing of a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: In btusb, there is an issue where the cleanup process in btusbdisconnect is performed out of order, leading to a Use-After-Free UAF condition. There is also a KASAN issue in btusbdisconnect: A read operation involvi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation neglects setting the ACL. A NFSv4 client that sets an ACL with a named principal during file creation retrieves the ACL later. It finds that the ACL is only a default ACL based on the mode bits, not the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: In the bitPutcs function, the bound-check glyph index was derived from the character value masked by 0xff or 0x1ff. This may lead to reading beyond the end of the built-in font array, exceeding the actual number o...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Check the length of skb for an unknown CC opcode. In hcicmdCompleteevt, if the command completion event has an unknown opcode, we assume that the first byte of skb-data contains the return status. However, th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Net: Bridge – Fix for use-after-free due to bypassing the port’s state during MST processing 1 Syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be reported a use-after-free issue when deleting an expired fdb. This issue arises d...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fixed out-of-band OOB access during the parseadvmonitorpattern function execution. In the parseadvmonitorpattern function, the value of the length variable is currently limited to HCIMAXEXTADLENGTH251. The size o...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/mempool: fix poisoning order0 pages with HIGHMEM The kernel test has reported: BUG: unable to handle page fault for address: fffba000 PF: supervisor write access in kernel mode PF: errorcode0x0002 - not-present page pde =...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksm: The range-walk function is used to bypass holes in scangetnextrmapitem. Currently, scangetnextrmapitem walks every page address in a VMA to locate mergeable pages. This approach becomes highly inefficient when scanning large...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: AppArmor: Fixed a double-free of nsname in aareplaceprofiles. If nsname is NULL after 1071 error = aaunpackudata, &lh, &nsname; and if ent-nsname contains an nsname in 1089 else if ent-nsname then nsname is assigned the value of...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: soc: ti: k3-socinfo: Fixed the regmap leak that occurs during probe failures. The mmio regmap allocated during the probe never gets freed. We have switched to using the device-managed allocator, so that the regmap is released...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nvme-tcp: A NULL pointer dereference was fixed in the nvmettcpbuildpduiovec function. The commit efa56305908b “nvmet-tcp: Fixed a kernel panic when the host sends an invalid H2C PDU length” added bounds checking for the ttag...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: avoided a data race in l2tptunneldelwork We should only access sk-sksocket when dealing with kernel sockets. syzbot reported the following data race: BUG: KCSAN: data race in l2tptunneldelwork / skcommonrelease Task 5365...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mac80211: ocb: skipping RXnosta when the interface is not joined The ieee80211ocbrxnosta function assumes a valid channel context, which is only present after the JOINOCB operation. RX operations may occur before JOINOCB is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: gve: Fixed corruption in the stats report when the number of queues changes. The driver and the Network Interface Card NIC share a memory region for stats reporting. The NIC calculates its offset within this region based on the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables: Fixed an inverted element activity check in nftmapcatchallactivate. nftmapcatchallactivate includes an inverted element activity check compared to its non-catchall counterpart, nftmapelemactivate, and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check the return value of indxfind to avoid infinite loops We have identified a bug in the ntfs3 file system that can lead to a Denial-of-Service DoS condition. A malformed dentry in the ntfs3 filesystem can cause the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: spi: tegra: A memory leak has been fixed in tegraslinkprobe. In tegraslinkprobe, when platformgetirq fails, it directly returns from the function with an error code, resulting in a memory leak. This issue can be addressed by...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: fixed a memory leak in acp3x pdm DMA operations...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/imx/tve: fixed the probe device leak. Make sure to remove the reference to the DDC device during probe operations when there is a probe failure e.g., probe deferral, as well as during the driver unbinding process...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netdevsim: fixed a race condition related to operations on the bpfboundprogs list. The netdevsim driver lacks a protection mechanism for operations on the bpfboundprogs list. When the nsimbpfcreateprog function performs...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: macvlan: A grace period for resource control is observed in the error path of macvlancommonnewlink. Valis reported that a race condition still occurs after our previous patch. macvlancommonnewlink might have made the device...

Astra Linux – Vulnerability in pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to version 0.6.3, the pyasn1 library was vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion during the decoding of ASN.1 data with deeply nested structures. An attacker could provide a crafted payload containing...