Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pmdomain: core: Fix the detach procedure for virtual devices in genpd. If a device is attached to a PM domain using genpddevpmattachbyid, genpd calls pmruntimeenable for the corresponding virtual device that it registers. While...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed an issue where the OOB read was performed in the updatebeaconinfo function’s IE loop. The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 with each iteration, but it only checks that i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: hifusb: Do not dereference hifdev after re-arming the firmware request The ath9khifrequestfirmware function re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: It is now allowed for the subflow rcv wnd to shrink. In MPTCP connections, the window field in the TCP header refers to the MPTCP-level rcvnxt. The right edge of this field should not move backward. This constraint is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight – the sample count was bound to the packet payload. isightpacket extracts the frame count from the device’s ISO packet and checks it only against the claimed ISO length of the device. count =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Invoking pmgenpdremove before freeing genpd. The function pmgenpdremove is called to unregister the module from the global list before releasing the acpgenpd memory. Additionally, the pointer after freeing the memory ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - phonet: pep: fixed a use-after-free in pepgetsb pepgetsb does not consider that pskbmaypull might have relocated the skb data, and continues to access the older pointer, resulting in a Use-After-Free UAF error. - Reproduced...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings on proto context error After a successful BALANCE/PARALLELSUBMIT extension during context creation, an error during the processing of the next user extension causes the siblings array to be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed an issue where the OOB read was performed in the IE parsing loop during OnAssocRsp. The IE parsing loop in OnAssocRsp advances by pIE-length + 2 with each iteration, but it only checks for i length fr...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: armffa: A NULL dereference in ffapartitioninfoget was fixed. The ffapartitioninfoget function passes uuidstr directly to uuidParse, without a NULL check. When a NULL value is passed as an argument, uuidParse calls...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the usb:typec:ucsi:ccg section, firmware images without a ‘:’ record header are rejected. The doflash function searches for the first .cyacd record using the following code: c p = strnchrfw-data, fw-size, ':'; while p eof s =...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: UDP: skb-dev should be cleared before running a sockmap verdict. In the UDP receive path, skb-dev is re-used as devscratch the truesize/state cache set by udpsetdevscratch, through the union struct netdevice dev; unsigned long...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: hci: fixed an out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at the function entry without first checking whether the buffer holds at least one...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevented a malicious dereference in tsi721dbdpc. In a listforeach loop, if we do not find the item we are looking for in the list, then the loop exits with the iterator, which points to invalid memory. This code...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: - In the ISO function, the serializeisosockcleartimerwithsocketlock function should serialize the execution of isosockcleartimer with the socket lock. - The isosockclose function calls isosockcleartimer before...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap In devmap broadcast redirection, the clone operation for packets is performed for all destinations except the last one. For native XDP, the clone path only copies the linear xdpframe data...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: A use-after-free issue was fixed in the chaoskeyrelease function. The chaoskey driver contains a use-after-free bug in its release routine. If the user closes the device file after the USB device is unplugged, a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c – prevents division by zero and arithmetic underflow. The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device’s resolution and width. However, if the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed a possible crash in l2capecredconnrsp. If a dcid is received for a destination CID that has already been assigned, the specification requires that both channels be discarded. However, calling l2capchand...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated. We need to explicitly check the length; otherwise, we might pass a string with a non-null termination to requestmodule...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: ESP: restoring the combined single-frag-length gate. The ESP out-of-place fast path appends the trailer in espoutputhead, before espoutputtail allocates the destination page frag. Currently, the head-side gate checks...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: geneve: It is required that CAPNETADMIN is set in the device’s netns for the changelink function. A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns geneve-net. These differences arise...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: comediparport: handling premature interrupts. Syzbot reported a general protection fault in comedigetissubdevicerunning, which was called from the interrupt handler parportinterrupt in the “comediparport” driver. However, there i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: Synchronization of per-protocol timers before freeing the hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. This struct ppp represents the hdlc-state allocation...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: The decoding of the “bound getversion reply” was incorrect. The handlegetversionreply function uses msg-frontalloclen as the boundary for decoding MONGETVERSIONREPLY. This represents the size of the reused reply buffer,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Firmware: stratix10-svc – Fixed memory leaks and list corruption issues. A memory leak was addressed when genpoolalloc failed, by freeing the allocated memory at the error path. The memory allocation mechanism was changed from...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: A memory leak has been fixed in the ieee80211registerhw function. If kmemdup fails while copying supported band structures, the error path jumps to failrate. This bypasses ratecontroldeinitialize and results in th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode, so that future changes can update CR8 intercepts during vCPU creation,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: The WARNON1 message for malformed packets in the ACK filter has been removed. The schcake ACK filter parses packets to identify duplicate ACK messages if the flow is backlogged. The parsing code includes a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: UBTMC: Check URB actuallength for interrupt-IN notifications. USB UBTMC devices can use an optional interrupt endpoint for notification messages. These messages typically contain two-byte headers that indicate the payload...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KEYS: The overflow issue in keyctlpkeyparamsget2 has been fixed. The length of the internal output buffer was calculated incorrectly, which can lead to an overflow if a too-small buffer is provided. This bug has been fixed by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Purge the outqueue when handling stale COOKIE-ECHO The sctpstreamupdate function is only invoked when the association is moved to COOKIEWAIT during association setup/reconfiguration. In this case, the outbound stream...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftfib: Fixed a stale stack leak caused by the OIFNAME register. For the NFTFIBRESULTOIFNAME parameter, the destination register is declared with len = IFNAMSIZ four 32-bit registers. However, during the lookup-fail...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Firewire: In the network layer, there is a fix for fragmented datagram reassembly. The function fwnetfragnew maintains a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: The stale RX state is cleared upon shutdown. The serial8250releasedma function terminates the RX DMA operation and releases the channel, but leaves rxrunning set to true. If the port is closed while a RX transfer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fixed an out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess calculates the local store offset as address - vma-vmstart, but checks the bounds against vma-vmend instead of the local store size. On 64-bit...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: es1938: Check the return value of sndctlnew1. sndctlnew1 may return NULL when memory allocation fails. sndes1938mixer does not check the return value before dereferencing the pointer, which can lead to a NULL pointer being...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fixed a UAF Use-after-Allocation issue during error handling during the probe phase. Although the 6fire driver had already made several fixes to handle early error handling during the probe phase, it overlooked a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: The RX buffers are refilled before being passed to XDP or used by an skb. The RX error path returns the current descriptor buffer to the BM pool. This only applies while the driver still owns the buffer. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on buildskb failure When buildskb fails in hip04rxpoll, the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrit...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieving ethhdr after a potential skb realloc on RX. The pskbmaypull function in the batadv interface’s rx function could reallocate the buffer behind the skb. Variables that pointed to the old buffer need to be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix for sleep in atomic context in xhcifreestreams When a USB device with active stream endpoints is disconnected, the function xhcifreestreams is called from the hubevent workqueue to free the stream resources. This...

Astra Linux – Vulnerability in Redis

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command specifically, a SET command. NOTE: this issue was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have any safety guarantees related to...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fixed a potential Use-after-Free in smb2isvalidleasebreak. Skipped sessions that are being torn down status == SESEXITING to avoid Use-after-Free vulnerabilities...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fixed a NULL pointer dereference in amdgpudmi2cxfer. When ddcserviceconstruct is called, it explicitly checks both the link type and whether there is something on the link that will determine whether the pin is...

Astra Linux – Vulnerability in Chromium

The use of after free in Compositing in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the File System API of Google Chrome on Windows prior to version 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...