Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in vDPA with the VDUSE backend. Currently, there are no checks in the VDUSE kernel driver to ensure that the size of the device configuration space is consistent with the features advertised by the VDUSE user-space application. In the event of a mismatch, the Virtio driver...

Astra Linux – Vulnerability in Linux 5.15, Linux

Insufficient control flow management for the IntelR 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access...

Astra Linux – Vulnerability in Linux 5.15

The function rpmsgvirtioaddctrldev in the file drivers/rpmsg/virtiorpmsgbus.c in the Linux kernel, prior to version 5.18.4, contains a double-free...

Astra Linux – Vulnerability in Linux 5.15

A flaw in the NULL Pointer Dereference mechanism within the Linux kernel’s NTFS3 driver function attrpunchhole was identified. A local user could exploit this flaw to crash the system...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: iavf: Fixed error handling for reset operations. Do not call iavfclose during error handling for iavfresettask. Doing so may lead to a double call to napidisable, which can cause a deadlock. Removing the VF may cause...

Astra Linux – Vulnerability in Intel Microcode

The sequence of processor instructions may lead to unexpected behavior on some Intel processors. This could potentially allow an authenticated user to enable privilege escalation, information disclosure, or denial of service through local access...

Astra Linux – Vulnerability in Linux

A remote denial-of-service vulnerability was discovered in the Linux kernel’s TIPC kernel module. The while loop in tipclinkxmit encounters an unknown state while attempting to parse SKBs that are not present in the queue. Sending two small UDP packets to a system with a UDP interface causes the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: s390/qeth: fixed a use-after-free in hsci KASAN identified that the address was dereferenced after br2deveventwork was freed. ================================================================== BUG: KASAN: use-after-free in...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RISCV: Kernel mappings of the EFI page table must be synchronized before switching to the EFI page table. The EFI page table is initially created as a copy of the kernel page table. When VMAPSTACK is enabled, kernel stacks are...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mdio: Fixed an unbalanced fwnode reference count in mdiodevicerelease. There is a warning report regarding a refcount leak when probing the mdio device: OF: Error: Memory leak; the expected refcount was 1 instead of 2. The...

Astra Linux – Vulnerability in Linux 5.15

A vulnerability, classified as problematic, has been identified in the Linux kernel. This issue affects the functions unixsockdestructor/unixreleasesock in the file net/unix/afunix.c of the BPF component. The manipulation leading to this issue results in a memory leak. It is recommended that a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Networks: Bridge: MST: Fixed suspicious RCU usage in brmstsetstate. I converted brmstsetstate to RCU to avoid a vlan use-after-free, but I forgot to change the vlangroupdereferencehelper. I switched to using the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: Avoid out-of-bound access in sja1105initl2policing The SJA1105 family has 45 L2 policing table entries SJA1105MAXL2POLICINGCOUNT, while the SJA1110 family has 110 entries SJA1110MAXL2POLICINGCOUNT. However,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: mt7621: Added a sentinel to the quirks table. The current driver lacks a sentinel in the struct socdeviceattribute array, which causes a buffer overflow error when the socdevicematchmt7621pciequirksmatch function is called...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Disallow re-exporting imported GEM objects. Prevent the re-export of imported GEM buffers by adding a custom primehandletofd callback that checks whether the object is imported. If it is imported, return -EOPNOTSUPP...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm/zonedevice: Do not touch the device folio after calling -foliofree. The contents of a device folio can change immediately after calling -foliofree, as the folio may be reallocated by a driver with a different order. Instead of...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor patches that incorrectly cause a sleep state when holding a spinlock in notification handling code. This bug can be triggered by an unprivileged local user, and can lead to kernel panic or deadlock situations...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: rxrpc: Fixed handling of misaligned crypto lengths in packets. Also, fixed the handling of packets with misaligned crypto lengths. Additionally, handled non-ENOMEM errors during decryption by aborting the process. Furthermore,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: greybus: gb-beagleplay: bound bootloader receive buffering The function cc1352bootloaderrx appends each serdev chunk into the rxbuffer before parsing bootloader packets. This helper function can retain leftover bytes between...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: The issue of null pointer dereferencing in paprhvpipedevcreatehandle was fixed. The commit 6d3789d347a7 “papr-hvpipe: converted paprhvpipedevcreatehandle to FDPREPARE” changed the creation handle to FDPREPARE...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Requires the map to be frozen before calculating the map hash Currently, bpfmapgetinfobyfd calculates and caches the hash of the map, regardless of whether the map is frozen or not. This leads to a TOCTOU bug, where user spa...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fixed access to stale wptr mapping. Use drmexec to take both locks—i.e., vmrootbo and wptrobjbo—to properly access the mapping data. This fixes the security issue where wptrobj is unmapped while a queue creation...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647 – A leak in the runtime PM reference count was fixed in sctrl. Three control cases AUTOGAIN, EXPOSUREAUTO, ANALOGUEGAIN directly return without calling pmruntimeput, causing a leak in the runtime PM reference...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Validated the length of inherited ACE SIDs. smbinheritdacl iterates through the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contains the correct SID header before using it,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: greybus: gb-beagleplay: Fixed the sleep in the atomic context in hdlctxFrames. In hdlc Append, usleeprange is called to wait for circular buffer space. However, this call occurs with the txproducerlock a spinlock held via...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: qla2xxx: Fixed the warning message caused by adisc being flushed. The Linux kernel triggered a warning message where a different error code type did not match the expected type. Added additional translations for one erro...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed memory leak. Why Resource release is necessary on the error handling path to prevent memory leaks. How This issue was fixed by adding the kfree function to the error handling path...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix ref leak when switching zones When switching zones or network namespaces without performing a ct clear between them, a reference to the old ct entry is still leaked. This occurs because tcfctskbnfctcached...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validating rxhashkeylen Sashiko points out that rxhashkeylen comes from a uAPI structure and is blindly passed to memcpy, allowing the user space to corrupt kernel memory. A bounds check is performed to prevent memcpy...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: Clear the waitid information before copying it to userspace. The IORINGOPWAITID structure stores its result fields in the struct iowaitid::info structure, and later copies these fields to the userspace siginfo...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: mac80211: A “static” value was dropped from the fast-RX rxresult data structure. The function ieee80211invokefastrx is documented as safe for parallel RX operations. However, the rxresult returned by this function is declar...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: reset: uniphier-glue: Fix possible null-ptr-deref This issue could lead to a null-ptr-deref condition when the resourcesizeres function is called, if platformgetresource returns NULL...

Astra Linux – Vulnerability in Linux 5.15

A vulnerability has been identified in the Linux kernel and is classified as problematic. This vulnerability affects the function l2caprecvacldata in the file net/bluetooth/l2capcore.c of the Bluetooth component. The vulnerability causes a memory leak. It is recommended that a patch be applied to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: hwmon: pt5161l Fixed bugs in pt5161lreadblockdata Two bugs have been fixed in pt5161lreadblockdata: 1. Buffer overrun: The local buffer rbuf is declared as u8 rbuf24, but i2csmbusreadblockdata can return up to I2CSMBUSBLOCKMAX...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: spi: ch341: fixed memory leaks on probe failures. Make sure to unregister the controller, disable the pins, and terminate/free the RX URB in case of probe failures. This helps to mimic disconnection scenarios and avoid memory...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcounter: serialize reset with spinlock A global static spinlock has been added to serialize the fetch+reset operations of the counter, preventing concurrent “dump-and-reset” operations from accessing counter values ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/xe/hdcp: Added a NULL check for mediagt in intelhdcpgsccheckstatus. When media GT is disabled via configfs, there is no allocation for mediagt, which is set to NULL. In such scenarios, intelhdcpgsccheckstatus results in a...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Rejecting empty multisync extensions prevents infinite loops. The v3dgetextensions function iterates over a singly-linked list of ioctl extensions provided by the user space. This list has no bounds on its length. A loca...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: fixed unclocked access during unbind operations. Ensure that the controller is resumed at runtime before disabling it during driver unbind operations, to avoid unclocked register accesses. This issue was...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed an issue where a double-free operation occurred in the createspaceinfosubgroup function. When the kobjectinitandadd function fails, the call chain is as follows: createspaceinfosubgroup → btrfssysfsaddspaceinfotype →...

Astra Linux – Vulnerability in Linux

In memzeroexplicit of compiler-clang.h, there is a possible way to bypass defense in depth due to uninitialized data. This could lead to the disclosure of local information without requiring additional execution privileges. User interaction is not required for exploitation. Product: Android...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ovpn: TCP – Do not dereference NULL from sksocket after tcpclose. When deleting a peer due to the expiration of the keepalive interval, the peer is removed from the OpenVPN hashtable and temporarily inserted into a “release list”...

Astra Linux – Vulnerability in Intel Microcode

A protection mechanism failure in some third- and fourth-generation IntelR XeonR processors, when using IntelR SGX or IntelR TDX, may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in Linux

In the drivers/target/targetcorexcopy.c file within the Linux kernel, prior to version 5.10.7, insufficient identifier checking in the LIO SCSI target code could be exploited by remote attackers to read or write files through directory traversal in an XCOPY request, known as CID-2896c93811e3. For...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rbd: Fixed null-ptr-deref when deviceadddisk fails. The dorbdadd function publishes the device using deviceadd, before calling deviceadddisk. If deviceadddisk fails after deviceadd succeeds, the error path directly calls...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: media: rockchip: rkcif: fixed bugs related to off-by-one errors. Changed the comparisons from vs = to avoid accessing elements beyond the end of arrays. Additionally, use ARRAYSIZE instead of the MAX enum values. Cosmetic issu...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: A memory leak has been fixed in amdxdnaubufmap. The amdxdnaubufmap function allocates memory for sg and internal sg table structures. However, it fails to free that memory if subsequent operations...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: BPF: Limiting the size of BPF program signatures Practical BPF signatures are significantly smaller than KMALLOCMAXCACHESIZE. Allowing larger sizes opens the door for abuse by using excessively large size values and forcing the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cleaned up the amdgpucsparserbos In low-memory conditions, kmalloc may fail. In such situations, unlocking the mutex allows for a clean exit. We no longer need to perform amdgpubolistput, as this function is now handl...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm: Set the old handle to NULL before performing the prime swap in changehandle. There was a potential race condition in changehandle. The ioctl function briefly had a single object with two idir entries; a concurrent gemclos...