Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-7192: kernel: refcount leak in ctnetlink_create_conntrack() CVE-2023-54321: In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential null-ptr-deref in device_add() CVE-2023-54317: In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page CVE-2023-54306: In the Linux kernel, the following vulnerability has been resolved: net: tls: avoid hanging tasks on the tx_lock CVE-2023-54305: In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted CVE-2023-54260: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix lost destroy smbd connection when MR allocate failed CVE-2023-54243: In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free CVE-2023-54198: In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() CVE-2023-54190: In the Linux kernel, the following vulnerability has been resolved: leds: led-core: Fix refcount leak in of_led_get() CVE-2023-54107: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: dropping parent refcount after pd_free_fn() is done CVE-2023-54057: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter CVE-2023-54046: In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly CVE-2023-54024: In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy target device if coalesced MMIO unregistration fails CVE-2023-53840: In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access CVE-2023-53820: In the Linux kernel, the following vulnerability has been resolved: loop: loop_set_status_from_info() check before assignment CVE-2023-53814: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix dropping valid root bus resources with .end = zero CVE-2023-53790: In the Linux kernel, the following vulnerability has been resolved: bpf: Zeroing allocated object from slab in bpf memory allocator CVE-2023-53789: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Improve page fault error reporting CVE-2023-53783: In the Linux kernel, the following vulnerability has been resolved: blk-iocost: fix divide by 0 error in calc_lcoefs() CVE-2023-53765: In the Linux kernel, the following vulnerability has been resolved: dm cache: free background tracker's queued work in btracker_destroy CVE-2023-53756: In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Fix crash due to uninitialized current_vmcs CVE-2023-53709: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rb_move_tail and rb_check_pages CVE-2023-53695: In the Linux kernel, the following vulnerability has been resolved: udf: Detect system inodes linked into directory hierarchy CVE-2023-53678: In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix system suspend without fbdev being initialized CVE-2023-53671: In the Linux kernel, the following vulnerability has been resolved: srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL CVE-2023-53643: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery CVE-2023-53610: In the Linux kernel, the following vulnerability has been resolved: irqchip: Fix refcount leak in platform_irqchip_probe CVE-2023-53606: In the Linux kernel, the following vulnerability has been resolved: nfsd: clean up potential nfsd_file refcount leaks in COPY codepath CVE-2023-53594: In the Linux kernel, the following vulnerability has been resolved: driver core: fix resource leak in device_add() CVE-2023-53590: In the Linux kernel, the following vulnerability has been resolved: sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop CVE-2023-53511: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix fget leak when fs don't support nowait buffered read CVE-2023-53506: In the Linux kernel, the following vulnerability has been resolved: udf: Do not bother merging very long extents CVE-2023-53494: In the Linux kernel, the following vulnerability has been resolved: crypto: xts - Handle EBUSY correctly CVE-2023-53482: In the Linux kernel, the following vulnerability has been resolved: iommu: Fix error unwind in iommu_group_alloc() CVE-2023-53477: In the Linux kernel, the following vulnerability has been resolved: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation CVE-2023-53427: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix warning and UAF when destroy the MR list CVE-2023-53423: In the Linux kernel, the following vulnerability has been resolved: objtool: Fix memory leak in create_static_call_sections() CVE-2023-53411: In the Linux kernel, the following vulnerability has been resolved: PM: EM: fix memory leak with using debugfs_lookup() CVE-2023-53409: In the Linux kernel, the following vulnerability has been resolved: drivers: base: component: fix memory leak with using debugfs_lookup() CVE-2023-53408: In the Linux kernel, the following vulnerability has been resolved: trace/blktrace: fix memory leak with using debugfs_lookup() CVE-2023-53390: In the Linux kernel, the following vulnerability has been resolved: drivers: base: dd: fix memory leak with using debugfs_lookup() CVE-2023-53381: In the Linux kernel, the following vulnerability has been resolved: NFSD: fix leaked reference count of nfsd4_ssc_umount_item CVE-2023-53373: In the Linux kernel, the following vul
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.19-30.43 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.19-30.43.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.19-30.43.amzn2023 |
Vulnerabilities 69
-
High 7.8
A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user det…
-
High 7.8CVE-2023-1829 Public exploit
Use-after-free in tcindex (traffic control index filter) in the Linux Kernel
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting…
-
High 7.8
arm64: efi: Make efi_rt_lock a raw_spinlock
In the Linux kernel, the following vulnerability has been resolved: arm64: efi: Make efi_rt_lock a raw_spinlock Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs the following: BUG: sleeping function called from invalid context at kernel/lo…
-
High 7.8
cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
In the Linux kernel, the following vulnerability has been resolved: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels The cacheinfo sets up the shared_cpu_map by checking whether the caches with the same index are shared between CPUs. …
-
High 7.8
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
In the Linux kernel, the following vulnerability has been resolved: rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails If getting an ID or setting up a work queue in rbd_dev_create() fails, use-after-free on rbd_dev->rbd_client, rbd_dev->sp…
-
High 7.8
crypto: seqiv - Handle EBUSY correctly
In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…
-
High 7.8
cifs: Fix warning and UAF when destroy the MR list
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix warning and UAF when destroy the MR list If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR: WARN…
-
High 7.8
crypto: xts - Handle EBUSY correctly
In the Linux kernel, the following vulnerability has been resolved: crypto: xts - Handle EBUSY correctly As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request. However, …
-
High 7.8
udf: Do not bother merging very long extents
In the Linux kernel, the following vulnerability has been resolved: udf: Do not bother merging very long extents When merging very long extents we try to push as much length as possible to the first extent. However this is unnecessarily complicated and not re…
-
High 7.8
nvme-tcp: don't access released socket during error recovery
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery While the error recovery work is temporarily failing reconnect attempts, running the 'nvme list' command causes a kernel NULL poin…
-
High 7.8
udf: Detect system inodes linked into directory hierarchy
In the Linux kernel, the following vulnerability has been resolved: udf: Detect system inodes linked into directory hierarchy When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious …
-
High 7.8
bpf: Zeroing allocated object from slab in bpf memory allocator
In the Linux kernel, the following vulnerability has been resolved: bpf: Zeroing allocated object from slab in bpf memory allocator Currently the freed element in bpf memory allocator may be immediately reused, for htab map the reuse will reinitialize special…
-
High 7.8
crypto: essiv - Handle EBUSY correctly
In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…
-
High 7.8
blk-cgroup: dropping parent refcount after pd_free_fn() is done
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: dropping parent refcount after pd_free_fn() is done Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is c…
-
High 7.8
tty: fix out-of-bounds access in tty_driver_lookup_tty()
In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking wheth…
-
High 7.8
netfilter: ebtables: fix table blob use-after-free
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_…
-
High 7.8
dm flakey: don't corrupt the zero page
In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page When we need to zero some range on a block device, the function __blkdev_issue_zero_pages submits a write bio with the bio vector pointing to the zero p…
-
High 7.5
NFSD: fix leaked reference count of nfsd4_ssc_umount_item
In the Linux kernel, the following vulnerability has been resolved: NFSD: fix leaked reference count of nfsd4_ssc_umount_item The reference count of nfsd4_ssc_umount_item is not decremented on error conditions. This prevents the laundromat from unmounting the…
-
High 7.5
nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
In the Linux kernel, the following vulnerability has been resolved: nfsd: clean up potential nfsd_file refcount leaks in COPY codepath There are two different flavors of the nfsd4_copy struct. One is embedded in the compound and is used directly in synchronou…
-
High 7.5
net: tls: avoid hanging tasks on the tx_lock
In the Linux kernel, the following vulnerability has been resolved: net: tls: avoid hanging tasks on the tx_lock syzbot sent a hung task report and Eric explains that adversarial receiver may keep RWIN at 0 for a long time, so we are not guaranteed to make fo…
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 5.5
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion …
-
Medium 5.5
A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a…
-
Medium 5.5
driver core: location: Free struct acpi_pld_info *pld before return false
In the Linux kernel, the following vulnerability has been resolved: driver core: location: Free struct acpi_pld_info *pld before return false struct acpi_pld_info *pld should be freed before the return of allocation failure, to prevent memory leak, add the AC…
-
Medium 5.5
watchdog: Fix kmemleak in watchdog_cdev_register
In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix kmemleak in watchdog_cdev_register kmemleak reports memory leaks in watchdog_dev_register, as follows: unreferenced object 0xffff888116233000 (size 2048): comm ""modprobe"", pid…
-
Medium 5.5
xsk: check IFF_UP earlier in Tx path
In the Linux kernel, the following vulnerability has been resolved: xsk: check IFF_UP earlier in Tx path Xsk Tx can be triggered via either sendmsg() or poll() syscalls. These two paths share a call to common function xsk_xmit() which has two sanity checks wi…
-
Medium 5.5
firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: …
-
Medium 5.5
misc: vmw_balloon: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: misc: vmw_balloon: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things…
-
Medium 5.5
udf: Do not update file length for failed writes to inline files
In the Linux kernel, the following vulnerability has been resolved: udf: Do not update file length for failed writes to inline files When write to inline file fails (or happens only partly), we still updated length of inline data as if the whole write succeed…
-
Medium 5.5
genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
In the Linux kernel, the following vulnerability has been resolved: genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() If ipi_send_{mask|single}() is called with an invalid interrupt number, all the local variables there will be NULL. ipi_send…
-
Medium 5.5
USB: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: USB: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just…
-
Medium 5.5
block: be a bit more careful in checking for NULL bdev while polling
In the Linux kernel, the following vulnerability has been resolved: block: be a bit more careful in checking for NULL bdev while polling Wei reports a crash with an application using polled IO: PGD 14265e067 P4D 14265e067 PUD 47ec50067 PMD 0 Oops: 0000 [#1] S…
-
Medium 5.5
drivers: base: dd: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: drivers: base: dd: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things…
-
Medium 5.5
trace/blktrace: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: trace/blktrace: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things si…
-
Medium 5.5
drivers: base: component: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: drivers: base: component: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make…
-
Medium 5.5
PM: EM: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: PM: EM: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, j…
-
Medium 5.5
objtool: Fix memory leak in create_static_call_sections()
In the Linux kernel, the following vulnerability has been resolved: objtool: Fix memory leak in create_static_call_sections() strdup() allocates memory for key_name. We need to release the memory in the following error paths. Add free() to avoid memory leak.
-
Medium 5.5
Kernel: refcount leak in ctnetlink_create_conntrack()
A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.
-
Medium 4.7
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file ne…
-
Unscored —
drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref due to drmm_mode_config_init() drmm_mode_config_init() will call drm_mode_create_standard_properties() and won't check the ret value. When drm_mode_create_st…
-
Unscored —
In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as t…
-
Unscored —
An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a …
-
Unscored —
vfio/type1: prevent underflow of locked_vm via exec()
In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of locked_vm via exec() When a vfio container is preserved across exec, the task does not change, but it gets a new mm with locked_vm=0, and loses the count from…
-
Unscored —
USB: uhci: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: USB: uhci: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler…
-
Unscored —
netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix percpu counter block leak on error path when creating new netns Here is the stack where we allocate percpu counter block: +-< __alloc_percpu +-< xt_percpu_counter_all…
-
Unscored —
PM: domains: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: PM: domains: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpl…
-
Unscored —
VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
In the Linux kernel, the following vulnerability has been resolved: VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a …
-
Unscored —
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
In the Linux kernel, the following vulnerability has been resolved: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the nu…
-
Unscored —
iommu: Fix error unwind in iommu_group_alloc()
In the Linux kernel, the following vulnerability has been resolved: iommu: Fix error unwind in iommu_group_alloc() If either iommu_group_grate_file() fails then the iommu_group is leaked. Destroy it on these error paths. Found by kselftest/iommu/iommufd_fail_…
-
Unscored —
io_uring: fix fget leak when fs don't support nowait buffered read
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix fget leak when fs don't support nowait buffered read Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1] Do the following steps can reproduce this BUG: mount -…
-
Unscored —
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
In the Linux kernel, the following vulnerability has been resolved: sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop With this refcnt added in sctp_stream_priorities, we don't need to traverse all streams to check if the prio is used by oth…
-
Unscored —
driver core: fix resource leak in device_add()
In the Linux kernel, the following vulnerability has been resolved: driver core: fix resource leak in device_add() When calling kobject_add() failed in device_add(), it will call cleanup_glue_dir() to free resource. But in kobject_add(), dev->kobj.parent has …
-
Unscored —
irqchip: Fix refcount leak in platform_irqchip_probe
In the Linux kernel, the following vulnerability has been resolved: irqchip: Fix refcount leak in platform_irqchip_probe of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add miss…
-
Unscored —
srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
In the Linux kernel, the following vulnerability has been resolved: srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL Commit 994f706872e6 ("srcu: Make Tree SRCU able to operate without snp_node array") assumes that cpu 0 is always online. However, …
-
Unscored —
drm/i915: Fix system suspend without fbdev being initialized
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix system suspend without fbdev being initialized If fbdev is not initialized for some reason - in practice on platforms without display - suspending fbdev should be skipped during…
-
Unscored —
ring-buffer: Handle race between rb_move_tail and rb_check_pages
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at…
-
Unscored —
KVM: VMX: Fix crash due to uninitialized current_vmcs
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Fix crash due to uninitialized current_vmcs KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is upd…
-
Unscored —
dm cache: free background tracker's queued work in btracker_destroy
In the Linux kernel, the following vulnerability has been resolved: dm cache: free background tracker's queued work in btracker_destroy Otherwise the kernel can BUG with: [ 2245.426978] =========================================================================…
-
Unscored —
blk-iocost: fix divide by 0 error in calc_lcoefs()
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: fix divide by 0 error in calc_lcoefs() echo max of u64 to cost.model can cause divide by 0 error. # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model divide error:…
-
Unscored —
iommu/amd: Improve page fault error reporting
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Improve page fault error reporting If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always…
-
Unscored —
PCI: Fix dropping valid root bus resources with .end = zero
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix dropping valid root bus resources with .end = zero On r8a7791/koelsch: kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unrefe…
-
Unscored —
loop: loop_set_status_from_info() check before assignment
In the Linux kernel, the following vulnerability has been resolved: loop: loop_set_status_from_info() check before assignment In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow erro…
-
Unscored —
usb: early: xhci-dbc: Fix a potential out-of-bound memory access
In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xd…
-
Unscored —
KVM: Destroy target device if coalesced MMIO unregistration fails
In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy target device if coalesced MMIO unregistration fails Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bu…
-
Unscored —
iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format …
-
Unscored —
leds: led-core: Fix refcount leak in of_led_get()
In the Linux kernel, the following vulnerability has been resolved: leds: led-core: Fix refcount leak in of_led_get() class_find_device_by_of_node() calls class_find_device(), it will take the reference, use the put_device() to drop the reference when not nee…
-
Unscored —
cifs: Fix lost destroy smbd connection when MR allocate failed
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix lost destroy smbd connection when MR allocate failed If the MR allocate failed, the smb direct connection info is NULL, then smbd_destroy() will directly return, then the connection…
-
Unscored —
ext4: refuse to create ea block when umounted
In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted The ea block expansion need to access s_root while it is already set as NULL when umount is triggered. Refuse this request to avoid panic.
-
Unscored —
driver core: fix potential null-ptr-deref in device_add()
In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential null-ptr-deref in device_add() I got the following null-ptr-deref report while doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50556.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1032.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1076.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1077.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1118.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1829.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1998.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2985.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-45863.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53171.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53197.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53200.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53202.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53211.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53216.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53234.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53240.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53250.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53254.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53259.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53279.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53295.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53307.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53332.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53359.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53366.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53373.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53381.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53390.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53408.html