Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: stmmac – ensure that ptprate is not set to 0 before configuring EST. If the value of ptprate, which was previously recorded in the driver, happens to be 0, this invalid value will be propagated up to the EST configuration,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: synclinked regs must preserve subregdef Range propagation must not affect subregdef marks. Otherwise, the following example is rewritten incorrectly by the verifier when the BPFFTESTRNDHI32 flag is set: 0: call bpfktimegetns...

Astra Linux – Vulnerability in Chromium

Uninitialized use in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb-len The packet length retrieved from skb data may be larger than the actual socket buffer length up to 9026 bytes. In such cases, the cloned skb passed through the network stack may...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables: The backend for setting up DEAD bits was changed to use the GC transaction API. The old and buggy gc API and the busy mark approach have been replaced with the GC transaction API. No set elements are remov...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - dm cache: Fixed the write hang issue in passthrough mode. The invalidateremove function has incomplete logic for handling write operations after cache invalidation. It sets up the remapped write operations for the overwriteb...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: corrected the incorrect validation of the numaces field in smbacl. parsedcal now validates numaces to allocate an array of posixacestatearray. If numaces is greater than ULONGMAX / sizeofstruct smbace++, it results in a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - BPF: The rcureadlockTraceheld function in bpfmaplookuppercpuelem needs to be checked. The bpfmaplookuppercpuelem helper function is also available for sleepable BPF programs. When BPF JIT is disabled or on a 32-bit host,...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source project that provides a graphical login to remote machines using the Microsoft Remote Desktop Protocol RDP. xrdp versions prior to 0.9.21 contain a “Out of Bound Read” issue in the libxrdpsendtochannel function. There are no known solutions to this problem. Users are advise...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15, and 8.0.x below 8.0.2, when using the SOAP extension to connect to a SOAP server, a malicious SOAP server may return malformed XML data as a response. This could cause PHP to access a null pointer, resulting in a crash...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fixed a memory leak that occurred during registration failures. The allocated device name is never released when there are registration failures with early ULPI devices. This issue was addressed by initializing the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The capacity of the Dirty Page Table is validated during the logreplay copylcns operation. During the analysis phase of the $LogFile journal replay process, logreplay copies LCNs from each action log record into an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: kcm: Use WRITEONCE when changing lower-level socket callbacks. The kcmattach function replaces the skdataready and skwritespace callbacks of a live lower-level TCP socket with KCM handlers. The kcmunattach function restores...

Astra Linux – Vulnerability in libio-compress-perl

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. The parseOutputGlob function wraps the output glob string provided by the caller within double quotes and stores it in the parser state. Then, the getFiles function...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pmdomain: core: Fix the detach procedure for virtual devices in genpd. If a device is attached to a PM domain using genpddevpmattachbyid, genpd calls pmruntimeenable for the corresponding virtual device that it registers. While...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed an issue where the OOB read was performed in the updatebeaconinfo function’s IE loop. The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 with each iteration, but it only checks that i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: hifusb: Do not dereference hifdev after re-arming the firmware request The ath9khifrequestfirmware function re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: It is now allowed for the subflow rcv wnd to shrink. In MPTCP connections, the window field in the TCP header refers to the MPTCP-level rcvnxt. The right edge of this field should not move backward. This constraint is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight – the sample count was bound to the packet payload. isightpacket extracts the frame count from the device’s ISO packet and checks it only against the claimed ISO length of the device. count =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Invoking pmgenpdremove before freeing genpd. The function pmgenpdremove is called to unregister the module from the global list before releasing the acpgenpd memory. Additionally, the pointer after freeing the memory ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - phonet: pep: fixed a use-after-free in pepgetsb pepgetsb does not consider that pskbmaypull might have relocated the skb data, and continues to access the older pointer, resulting in a Use-After-Free UAF error. - Reproduced...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings on proto context error After a successful BALANCE/PARALLELSUBMIT extension during context creation, an error during the processing of the next user extension causes the siblings array to be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed an issue where the OOB read was performed in the IE parsing loop during OnAssocRsp. The IE parsing loop in OnAssocRsp advances by pIE-length + 2 with each iteration, but it only checks for i length fr...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: armffa: A NULL dereference in ffapartitioninfoget was fixed. The ffapartitioninfoget function passes uuidstr directly to uuidParse, without a NULL check. When a NULL value is passed as an argument, uuidParse calls...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the usb:typec:ucsi:ccg section, firmware images without a ‘:’ record header are rejected. The doflash function searches for the first .cyacd record using the following code: c p = strnchrfw-data, fw-size, ':'; while p eof s =...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: UDP: skb-dev should be cleared before running a sockmap verdict. In the UDP receive path, skb-dev is re-used as devscratch the truesize/state cache set by udpsetdevscratch, through the union struct netdevice dev; unsigned long...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: hci: fixed an out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at the function entry without first checking whether the buffer holds at least one...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevented a malicious dereference in tsi721dbdpc. In a listforeach loop, if we do not find the item we are looking for in the list, then the loop exits with the iterator, which points to invalid memory. This code...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: - In the ISO function, the serializeisosockcleartimerwithsocketlock function should serialize the execution of isosockcleartimer with the socket lock. - The isosockclose function calls isosockcleartimer before...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap In devmap broadcast redirection, the clone operation for packets is performed for all destinations except the last one. For native XDP, the clone path only copies the linear xdpframe data...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: A use-after-free issue was fixed in the chaoskeyrelease function. The chaoskey driver contains a use-after-free bug in its release routine. If the user closes the device file after the USB device is unplugged, a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c – prevents division by zero and arithmetic underflow. The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device’s resolution and width. However, if the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed a possible crash in l2capecredconnrsp. If a dcid is received for a destination CID that has already been assigned, the specification requires that both channels be discarded. However, calling l2capchand...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated. We need to explicitly check the length; otherwise, we might pass a string with a non-null termination to requestmodule...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: ESP: restoring the combined single-frag-length gate. The ESP out-of-place fast path appends the trailer in espoutputhead, before espoutputtail allocates the destination page frag. Currently, the head-side gate checks...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: udf: The validation of the sparing table length is performed based on the number of entries, not the number of bytes. The udfloadsparablemap function accepts a sparing table when the condition sizeofst +...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: geneve: It is required that CAPNETADMIN is set in the device’s netns for the changelink function. A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns geneve-net. These differences arise...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: comediparport: handling premature interrupts. Syzbot reported a general protection fault in comedigetissubdevicerunning, which was called from the interrupt handler parportinterrupt in the “comediparport” driver. However, there i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: Synchronization of per-protocol timers before freeing the hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. This struct ppp represents the hdlc-state allocation...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: The decoding of the “bound getversion reply” was incorrect. The handlegetversionreply function uses msg-frontalloclen as the boundary for decoding MONGETVERSIONREPLY. This represents the size of the reused reply buffer,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Firmware: stratix10-svc – Fixed memory leaks and list corruption issues. A memory leak was addressed when genpoolalloc failed, by freeing the allocated memory at the error path. The memory allocation mechanism was changed from...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: A memory leak has been fixed in the ieee80211registerhw function. If kmemdup fails while copying supported band structures, the error path jumps to failrate. This bypasses ratecontroldeinitialize and results in th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode, so that future changes can update CR8 intercepts during vCPU creation,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: The WARNON1 message for malformed packets in the ACK filter has been removed. The schcake ACK filter parses packets to identify duplicate ACK messages if the flow is backlogged. The parsing code includes a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: UBTMC: Check URB actuallength for interrupt-IN notifications. USB UBTMC devices can use an optional interrupt endpoint for notification messages. These messages typically contain two-byte headers that indicate the payload...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KEYS: The overflow issue in keyctlpkeyparamsget2 has been fixed. The length of the internal output buffer was calculated incorrectly, which can lead to an overflow if a too-small buffer is provided. This bug has been fixed by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Purge the outqueue when handling stale COOKIE-ECHO The sctpstreamupdate function is only invoked when the association is moved to COOKIEWAIT during association setup/reconfiguration. In this case, the outbound stream...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftfib: Fixed a stale stack leak caused by the OIFNAME register. For the NFTFIBRESULTOIFNAME parameter, the destination register is declared with len = IFNAMSIZ four 32-bit registers. However, during the lookup-fail...