Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: A potential memory leak in ipw2100pciinitone has been fixed. The memory allocated in the ipw2100allocdevice function is not freed in some error paths of ipw2100pciinitone. This issue was addressed by converting the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Avoid re-filling the RX queue after teardown. The commit b917507e5ad9 vsock/virtio: Stop workers during .remove made the RX worker jump to its common exit when rxrun is cleared. However, that exit still re-fills the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net module, the guard timestamp cmsgs to real error queue skbs mechanism was addressed. The skbiserrqueue function treats PACKETOUTGOING as the only marker for an skb from the skerrorqueue. This assumption does not hold fo...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: removed WARNONONCE from skmcloop skmcloop can be called for sockets that are neither AFINET nor AFINET6 e.g., AFPACKET sockets when sending packets via raw/packet sockets over virtual devices such as VRF or ipvlan. In such...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: evdev – fixed an issue related to information leakage in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. O...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drbd: Rejects data replies with an out-of-range payload size. The recvdlessread function receives a PDATAREPLY from a peer into the bio of an outstanding read request. The payload length provided by the peer is stored as the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: Rounding up the PTP per-out pin duration The pinduration is converted from the period provided by the user to SJA1105 clock ticks. This value is then passed as the cycletime parameter to futurebasetime. Very...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: Serialize TX state transitions under so-rxlock. The TX state machine so-tx.state is controlled by three contexts: 1. sendmsg claims and progresses a transfer; 2. the RX path handles Flow Control/echo frames; 3. two...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refreshing the nh pointer after ipv6hopjumbo The ipv6hopjumbo function calls pskbtrimrcsum, which can change skb pointers. Let’s recalculate the nh pointer to ensure that any changes won’t cause issues...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: bridge: fixed a stale prevhdr pointer in brip6fragment brip6fragment retrieves prevhdr, a pointer to the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb, skbchecksumhelp reallocates th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Reallocate the update replies for mismatched IDs. The ovsflowcmdnew function preallocates the optional reply skb before acquiring the ovsmutex and before determining which existing flow will be updated. This is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Staging: In most cases involving video devices, avoid double-free operations when there is a failure with the video register. The compregistervideodev function allocates a videodevice using videodevicealloc, and releases it if...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: Cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work, and its handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer overflow issue The function klsi105preparewritebuffer is called by the generic write path. This function uses the bulk-out buffer and its size bulgoutsize, 64 bytes. It stores a two-by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: Bound iinlinexattrsize for inodes without inlinexattr When the flexibleInlinexattr feature is enabled, doread inode the iinlinexattrsize value from disk: c if f2fssbhasflexibleInlinexattrsbi fi-iinlinexattrsize =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed issues with WEP length underflow and OOB read during the OnAuth process. OnAuth contains two bugs in the shared-key authentication process. When the Privacy bit is set, rtwwepdecrypt is called without...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: rds: clearing isends on setup unwind The RDS IB connection teardown path is modified so that it can be executed during partial startup and upon repeated shutdown attempts. NULL pointers are used to distinguish resources that...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: A potential out-of-bounds access has been fixed in crushdecode. A message of type CEPHMSGOSDMAP containing a crush map with at least one bucket contains two fields that store information related to the bucket’s algorithm...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppressing UBSAN warnings caused by incorrect field usage The definition of reg-accesswidth changes depending on the reg-spaceid type. The ACPIADRSPACEPLATFORMCOMM type uses accesswidth to indicate the PCC region;...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: vxlan: It is required to have CAPNETADMIN in the device’s netns for the changelink function. A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns vxlan-net. These two netns differ once the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed issues with OOB reads in IE loops in issueassocreq and joincmdhdl. Two IE parsing loops fail to check the header bounds before dereferencing pIE-length: - In issueassocreq, the pmlmeinfo-network.ies i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nflog: The validation of the MAC header was performed before dumping it. The fallback path of dumpmacheader only guards access to the MAC header when skb-macheader != skb-networkheader, without checking...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hiding the shadow VMCS right after VMCLEAR The freenested function frees the shadow VMCS while vmcs01 still points to it. However, because this operation is asynchronous relative to loadedvmcsclear, the vCPU might...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: A use-after-free occurred in rtl8150startxmit. syzbot reported a KASAN slab-use-after-free read in rtl8150startxmit, where the value skb-len was accessed for tx statistics after usbsubmiturb was called. BUG:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: orangefs: Keep the readdir entry size as 64-bit in fillfrompart. fillfrompart calculates the size of a directory entry using the sizet type, but stores it as an u32 value. A value close to U32MAX causes the entry length to be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: The initialization order of the completion function was corrected before devmrequestirq. The driver calls devmrequestirq before initializing the completion function used by the interrupt handler. Since the interrup...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: Reacquiring the GW address after skb realloc The batadvblaisbackbonegw function calls the skbmaypull function, which may reallocate the buffer behind the skb. Variables that pointed to the old buffer need to be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Validated the lcnsfollow field during the logreplay conversion process. logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart tables. During this conversion, the memmove...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - net: slip: Serialize receive processing during buffer reallocation. slreallocbufs replaces rbuff and updates the buffer size while holding sl-lock. slreceivebuf reads these fields and writes data through rbuff without holdin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Remove debugfs files before client teardown The cephDestroyClient function destroys the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can trigger the monmapShow...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: iforce processes the force-feedback effect index directly from the device. The iforceprocesspacket function handles a status report packet ID 0x02 by taking the force-feedback effect index directly from the device and usin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: The gatemustwaitwritabilitycheckonptepresent function requires a writeable PTE check. The userfaultfdmustwait and userfaultfdhugemustwait functions read the PTE without acquiring the page table lock, and then apply...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Validated the length of the embedded INIT chunk and the length of the address list in the cookie. sctpunpackcookie only checks that the length of the embedded INIT chunk does not exceed the remaining cookie payload, but...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Access to unicastttvnskb-data is only possible after skb realloc. The pskbmaypull function called by batadvgetvid could reallocate the buffer behind the skb. Variables that pointed to the old buffer need to be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed the issue of BO-pin leaking in amdgpubocreatereserved. The amdgpubocreatereserved function only allocates a new BO when boptr struct amdgpubo boptr as the input parameter is NULL. If boptr is not NULL, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Check INITFAILED before calling nvmetrequninit in the digest error path. In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command originates fr...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Do not free the transport used by the ASCONF during DEL-IP processing. In sctpprocessasconf, the transport used to process the ASCONF chunk is cached under asconf-transport == chunk-transport; set once in sctprcv. For an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu – fixed type confusion in CDC union descriptor parsing. The driver currently relies on bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: A potential memory leak has been fixed in hecubafbprobe. The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. This issue was addressed by calling fbdeferrediocleanup...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Parsing of the Bound PR-OUT TransportID into the received buffer The functions corescsi3decodespeciport and corescsi3emulateregisterandmove pass the raw PERSISTENT RESERVE OUT parameter buffer to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: Fixed an issue where the hdrlen value overflows during the ipv6rplsrhdecompress function. The ipv6rplsrhdecompress function calculates: c outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is a type u8. When n is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error The gp2ap002readraw function calls pmruntimegetsync before reading the lux value. However, if gp2ap002getlux fails, the function returns directly. This bypasses the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Can: bcm: track a single source interface for ANYDEV timeout/throttle operations. An ANYDEV RX operation if index == 0 with an active RX timeout and/or throttle timer does not have defined semantics when matching frames from...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: radio-si476x: Unregister v4l2device on probe failure The si476xradioprobe function registers radio-v4l2dev before allocating the V4L2 controls and before registering the video device. If any of these steps fail, the probe...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: The issue of UAF Use-After-Free was fixed by addressing the problem of decrementing sbi-nrpages in f2fswriteendio. The xfstests case “generic/107” and syzbot both reported a situation where a NULL pointer was dereferenced...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: udf: Validation of free block extents against the partition length The udffreeblocks function checks the logical block number and count against the partition length. However, the extent offset is dropped from this final value. A...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fixed a potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed during subsequent error paths. This issue was addressed by calling...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: For the cdrom function, the issue of out-of-bounds read from the stack was addressed in CDROMVOLCTRL. The mmcioctlcdromvolume function first reads the audio control mode page into a 32-byte stack buffer, with cgc-buflen set to 24...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: Fixed the condition in ‘nandselecttarget’. ‘cs’ here must be within the range 0:nanddevntargets...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu – fixed a heap-buffer-overflow issue in imspcuprocessdata The imspcuprocessdata function processes incoming URB data byte by byte. However, it fails to check whether the readpos index exceeds IMSPCUBUFSIZE. If a...