Astra Linux – Vulnerability in Linux 5.10, Intel-Microcode

Incomplete cleanup of microarchitectural fill buffers on some Intel processors may allow an authenticated user to potentially enable information disclosure via local access...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fix for the iteration of extrefs during log replay. When calling inodeaddref and processing extrefs, if we jump to the next label, the value of victimname.len is undefined. This occurs because victimname.len wasn’t...

Astra Linux – Vulnerability in Apache2

If the Apache HTTP Server 2.4.53 is configured to perform transformations using modsed, especially in contexts where the input to modsed can be very large, modsed may cause excessive memory allocation and trigger an abort...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Do not cache extents during splitting Caching extents during the splitting process is risky, as it may result in stale extents remaining in the status tree. Moreover, in most cases, the corresponding extent block entries ar...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: llc: Fixed the SAP refcount leak in llcuiautobind. llcuiautobind creates an SAP after selecting a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket’s...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fixed a NULL pointer bug in svmrangesetattr. The processinfo can be NULL if the user does not call kfdioctlacquirevm before calling kfdioctlsvm. Cherry-picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading the conf opt value The l2capgetconfopt function derives the option length from the attacker-controlled opt-len field. It immediately dereferes opt-val as a u8, using...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: A potential memory leak in ipw2100pciinitone has been fixed. The memory allocated in the ipw2100allocdevice function is not freed in some error paths of ipw2100pciinitone. This issue was addressed by converting the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Avoid re-filling the RX queue after teardown. The commit b917507e5ad9 vsock/virtio: Stop workers during .remove made the RX worker jump to its common exit when rxrun is cleared. However, that exit still re-fills the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net module, the guard timestamp cmsgs to real error queue skbs mechanism was addressed. The skbiserrqueue function treats PACKETOUTGOING as the only marker for an skb from the skerrorqueue. This assumption does not hold fo...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: removed WARNONONCE from skmcloop skmcloop can be called for sockets that are neither AFINET nor AFINET6 e.g., AFPACKET sockets when sending packets via raw/packet sockets over virtual devices such as VRF or ipvlan. In such...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: evdev – fixed an issue related to information leakage in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. O...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drbd: Rejects data replies with an out-of-range payload size. The recvdlessread function receives a PDATAREPLY from a peer into the bio of an outstanding read request. The payload length provided by the peer is stored as the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: Rounding up the PTP per-out pin duration The pinduration is converted from the period provided by the user to SJA1105 clock ticks. This value is then passed as the cycletime parameter to futurebasetime. Very...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: Serialize TX state transitions under so-rxlock. The TX state machine so-tx.state is controlled by three contexts: 1. sendmsg claims and progresses a transfer; 2. the RX path handles Flow Control/echo frames; 3. two...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refreshing the nh pointer after ipv6hopjumbo The ipv6hopjumbo function calls pskbtrimrcsum, which can change skb pointers. Let’s recalculate the nh pointer to ensure that any changes won’t cause issues...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: bridge: fixed a stale prevhdr pointer in brip6fragment brip6fragment retrieves prevhdr, a pointer to the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb, skbchecksumhelp reallocates th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Reallocate the update replies for mismatched IDs. The ovsflowcmdnew function preallocates the optional reply skb before acquiring the ovsmutex and before determining which existing flow will be updated. This is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Staging: In most cases involving video devices, avoid double-free operations when there is a failure with the video register. The compregistervideodev function allocates a videodevice using videodevicealloc, and releases it if...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: Cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work, and its handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer overflow issue The function klsi105preparewritebuffer is called by the generic write path. This function uses the bulk-out buffer and its size bulgoutsize, 64 bytes. It stores a two-by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: Bound iinlinexattrsize for inodes without inlinexattr When the flexibleInlinexattr feature is enabled, doread inode the iinlinexattrsize value from disk: c if f2fssbhasflexibleInlinexattrsbi fi-iinlinexattrsize =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fixed a potential UAF Uninitialized Address Fault when the ddgst mismatch occurs. Shivam Kumar identified this vulnerability through vulnerability testing: When the data digest is enabled on an NVMe/TCP connection, and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed issues with WEP length underflow and OOB read during the OnAuth process. OnAuth contains two bugs in the shared-key authentication process. When the Privacy bit is set, rtwwepdecrypt is called without...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: rds: clearing isends on setup unwind The RDS IB connection teardown path is modified so that it can be executed during partial startup and upon repeated shutdown attempts. NULL pointers are used to distinguish resources that...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: A potential out-of-bounds access has been fixed in crushdecode. A message of type CEPHMSGOSDMAP containing a crush map with at least one bucket contains two fields that store information related to the bucket’s algorithm...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppressing UBSAN warnings caused by incorrect field usage The definition of reg-accesswidth changes depending on the reg-spaceid type. The ACPIADRSPACEPLATFORMCOMM type uses accesswidth to indicate the PCC region;...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: vxlan: It is required to have CAPNETADMIN in the device’s netns for the changelink function. A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns vxlan-net. These two netns differ once the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed issues with OOB reads in IE loops in issueassocreq and joincmdhdl. Two IE parsing loops fail to check the header bounds before dereferencing pIE-length: - In issueassocreq, the pmlmeinfo-network.ies i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nflog: The validation of the MAC header was performed before dumping it. The fallback path of dumpmacheader only guards access to the MAC header when skb-macheader != skb-networkheader, without checking...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hiding the shadow VMCS right after VMCLEAR The freenested function frees the shadow VMCS while vmcs01 still points to it. However, because this operation is asynchronous relative to loadedvmcsclear, the vCPU might...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: A use-after-free occurred in rtl8150startxmit. syzbot reported a KASAN slab-use-after-free read in rtl8150startxmit, where the value skb-len was accessed for tx statistics after usbsubmiturb was called. BUG:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: orangefs: Keep the readdir entry size as 64-bit in fillfrompart. fillfrompart calculates the size of a directory entry using the sizet type, but stores it as an u32 value. A value close to U32MAX causes the entry length to be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: The initialization order of the completion function was corrected before devmrequestirq. The driver calls devmrequestirq before initializing the completion function used by the interrupt handler. Since the interrup...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: Reacquiring the GW address after skb realloc The batadvblaisbackbonegw function calls the skbmaypull function, which may reallocate the buffer behind the skb. Variables that pointed to the old buffer need to be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Validated the lcnsfollow field during the logreplay conversion process. logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart tables. During this conversion, the memmove...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - net: slip: Serialize receive processing during buffer reallocation. slreallocbufs replaces rbuff and updates the buffer size while holding sl-lock. slreceivebuf reads these fields and writes data through rbuff without holdin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Remove debugfs files before client teardown The cephDestroyClient function destroys the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can trigger the monmapShow...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: rhashtable: It is necessary to clear the stale iter-p variable upon table restart. The rhashtablewalkstartcheck function has two restart paths when resuming a walk. When iter-walker.tbl is valid, it revalidates iter-p against...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: iforce processes the force-feedback effect index directly from the device. The iforceprocesspacket function handles a status report packet ID 0x02 by taking the force-feedback effect index directly from the device and usin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: The gatemustwaitwritabilitycheckonptepresent function requires a writeable PTE check. The userfaultfdmustwait and userfaultfdhugemustwait functions read the PTE without acquiring the page table lock, and then apply...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Validated the length of the embedded INIT chunk and the length of the address list in the cookie. sctpunpackcookie only checks that the length of the embedded INIT chunk does not exceed the remaining cookie payload, but...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Access to unicastttvnskb-data is only possible after skb realloc. The pskbmaypull function called by batadvgetvid could reallocate the buffer behind the skb. Variables that pointed to the old buffer need to be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed the issue of BO-pin leaking in amdgpubocreatereserved. The amdgpubocreatereserved function only allocates a new BO when boptr struct amdgpubo boptr as the input parameter is NULL. If boptr is not NULL, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Check INITFAILED before calling nvmetrequninit in the digest error path. In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command originates fr...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Do not free the transport used by the ASCONF during DEL-IP processing. In sctpprocessasconf, the transport used to process the ASCONF chunk is cached under asconf-transport == chunk-transport; set once in sctprcv. For an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu – fixed type confusion in CDC union descriptor parsing. The driver currently relies on bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: A potential memory leak has been fixed in hecubafbprobe. The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. This issue was addressed by calling fbdeferrediocleanup...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Parsing of the Bound PR-OUT TransportID into the received buffer The functions corescsi3decodespeciport and corescsi3emulateregisterandmove pass the raw PERSISTENT RESERVE OUT parameter buffer to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: Fixed an issue where the hdrlen value overflows during the ipv6rplsrhdecompress function. The ipv6rplsrhdecompress function calculates: c outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is a type u8. When n is...