Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-36031: In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation CVE-2024-35827: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() CVE-2024-35826: In the Linux kernel, the following vulnerability has been resolved: block: Fix page refcounts for unaligned buffers in __bio_release_pages() CVE-2024-35823: In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters CVE-2024-35815: In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion CVE-2024-35809: In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal CVE-2024-35805: In the Linux kernel, the following vulnerability has been resolved: dm snapshot: fix lockup in dm_exception_table_exit CVE-2024-35804: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty CVE-2024-35801: In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD CVE-2024-35800: In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel CVE-2024-35791: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() CVE-2024-27437: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable of exclusive INTx IRQ CVE-2024-27435: In the Linux kernel, the following vulnerability has been resolved: nvme: fix reconnection fail due to reserved tag allocation CVE-2024-27390: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() CVE-2024-27389: In the Linux kernel, the following vulnerability has been resolved: pstore: inode: Only d_invalidate() is needed CVE-2024-27388: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array CVE-2024-27065: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not compare internal table flags on updates CVE-2024-27047: In the Linux kernel, the following vulnerability has been resolved: net: phy: fix phy_get_internal_delay accessing an empty array CVE-2024-27038: In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dereference CVE-2024-27025: In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_start CVE-2024-26977: In the Linux kernel, the following vulnerability has been resolved: pci_iounmap(): Fix MMIO mapping leak CVE-2024-26976: In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed CVE-2024-26973: In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles CVE-2024-26964: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhci_map_urb_for_dma CVE-2024-26960: In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() CVE-2024-26958: In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes CVE-2024-26951: In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list CVE-2024-26950: In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx instead of peer CVE-2024-26946: In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address CVE-2024-26938: In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() CVE-2024-26937: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Reset queue_priority_hint on parking CVE-2024-26935: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression CVE-2024-26934: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() CVE-2024-26933: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute CVE-2024-26906: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() CVE-2024-26901: In the Linux kernel, the following vulnerability has been resolved: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak CVE-2024-26898: In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts CVE-2024-26894: In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() CVE-2024-26891: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected CVE-2024-26883: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches CVE-2024-26882: In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() CVE-2024-26880: In the Linux kernel, the following vulnerabi
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.84-99.169 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.84-99.169.amzn2023 |
Vulnerabilities 64
-
Critical 9.8
net: tls: handle backlogging of crypto requests
In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY inst…
-
Critical 9.8
tls: fix race between tx work scheduling and socket close
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). …
-
Critical 9.8
SUNRPC: fix some memleaks in gssx_dec_option_array
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the cor…
-
Critical 9.8
keys: Fix overwrite of key expiration on instantiation
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for…
-
High 8.8
KVM: x86: Mark target gfn of emulated atomic instruction as dirty
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and does…
-
High 7.8
io_uring: drop any code related to SCM_RIGHTS
In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to SCM_RIGHTS This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it.
-
High 7.8
netfilter: nf_tables: disallow anonymous set with timeout flag
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy …
-
High 7.8
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with…
-
High 7.8
netfilter: nft_set_pipapo: release elements in clone only from destroy path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possib…
-
High 7.8
vfio/pci: Lock external INTx masking ops
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outs…
-
High 7.8
vfio/pci: Create persistent INTx handler
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Create persistent INTx handler A vulnerability exists where the eventfd for INTx signaling can be deconfigured, which unregisters the IRQ handler but still allows eventfds to be sig…
-
High 7.8
net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check taprio_parse_tc_entry() is not correctly checking TCA_TAPRIO_TC_ENTRY_INDEX attribute: int tc; // Signed value tc = nla_get_u32(tb[TC…
-
High 7.8
tcp: Fix refcnt handling in __inet_hash_connect().
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix refcnt handling in __inet_hash_connect(). syzbot reported a warning in sk_nulls_del_node_init_rcu(). The commit 66b60b0c8c4a ("dccp/tcp: Unhash sk from ehash for tb2 alloc failure af…
-
High 7.8
rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). syzkaller reported a warning of netns tracker [0] followed by KASAN splat [1] and another ref tracker warning [1]. syzkaller coul…
-
High 7.8
NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs…
-
High 7.8
dm: call the resume method on internal suspend
In the Linux kernel, the following vulnerability has been resolved: dm: call the resume method on internal suspend There is this reported crash when experimenting with the lvm2 testsuite. The list corruption is caused by the fact that the postsuspend and resu…
-
High 7.8
bpf: Fix stackmap overflow check on 32-bit arches
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the res…
-
High 7.8
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the …
-
High 7.8
wireguard: netlink: access device through ctx instead of peer
In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx instead of peer The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-w…
-
High 7.8
wireguard: netlink: check for dangling peer via is_dead instead of empty list
In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a…
-
High 7.8
nfs: fix UAF in direct writes
In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1…
-
High 7.8
KVM: Always flush async #PF workqueue when vCPU is being destroyed
In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs…
-
High 7.8
pstore: inode: Only d_invalidate() is needed
In the Linux kernel, the following vulnerability has been resolved: pstore: inode: Only d_invalidate() is needed Unloading a modular pstore backend with records in pstorefs would trigger the dput() double-drop warning: WARNING: CPU: 0 PID: 2569 at fs/dcache.c…
-
High 7.8
KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-fre…
-
High 7.8
x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a p…
-
High 7.8
io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is type size_t (unsigned long). Casting it to int could lead to an integer underflow. The check_add_overf…
-
High 7.5
nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
In the Linux kernel, the following vulnerability has been resolved: nfs: fix panic when nfs4_ff_layout_prepare_ds() fails We've been seeing the following panic in production BUG: kernel NULL pointer dereference, address: 0000000000000065 PGD 2f485f067 P4D 2f4…
-
High 7.5
nvme: fix reconnection fail due to reserved tag allocation
In the Linux kernel, the following vulnerability has been resolved: nvme: fix reconnection fail due to reserved tag allocation We found a issue on production environment while using NVMe over RDMA, admin_q reconnect failed forever while remote target and netw…
-
High 7.3
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() Apply the same fix than ones found in : 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba…
-
High 7.0
mm: swap: fix race between free_swap_and_cache() and swapoff()
In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_an…
-
Medium 6.5
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and …
-
Medium 6.0
ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() After unregistering the CPU idle device, the memory associated with it is not freed, leading to a memory leak: unreference…
-
Medium 5.5
pci_iounmap(): Fix MMIO mapping leak
In the Linux kernel, the following vulnerability has been resolved: pci_iounmap(): Fix MMIO mapping leak The #ifdef ARCH_HAS_GENERIC_IOPORT_MAP accidentally also guards iounmap(), which means MMIO mappings are leaked. Move the guard so we call iounmap() for M…
-
Medium 5.5
PCI/PM: Drain runtime-idle callbacks before driver removal
In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash …
-
Medium 5.3
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
In the Linux kernel, the following vulnerability has been resolved: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak syzbot identified a kernel information leak vulnerability in do_sys_name_to_handle() and issued the following report [1]. [1] "BU…
-
Medium 5.3
vt: fix unicode buffer corruption when deleting characters
In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting char…
-
Medium 4.4
Integer overflow in raid5_cache_count in Linux kernel
Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.
-
Unscored —
md/raid10: prevent soft lockup while flush writes
In the Linux kernel, the following vulnerability has been resolved: md/raid10: prevent soft lockup while flush writes Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't, and too many…
-
Unscored —
x86, relocs: Ignore relocations in .notes section
In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the "startup_xen" entry point. Thi…
-
Unscored —
dm-integrity: fix a memory leak when rechecking the data
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a memory leak when rechecking the data Memory for the "checksums" pointer will leak if the data is rechecked after checksum failure (because the associated kfree won't happe…
-
Unscored —
wireguard: receive: annotate data-race around receiving_counter.counter
In the Linux kernel, the following vulnerability has been resolved: wireguard: receive: annotate data-race around receiving_counter.counter Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() an…
-
Unscored —
packet: annotate data-races around ignore_outgoing
In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignore_outgoing ignore_outgoing is read locklessly from dev_queue_xmit_nit() and packet_getsockopt() Add appropriate READ_ONCE()/WRITE_ONCE() annotations. s…
-
Unscored —
hsr: Fix uninit-value access in hsr_get_node()
In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in hsr_get_node() KMSAN reported the following uninit-value access issue [1]: ===================================================== BUG: KMSAN: uninit-value in hs…
-
Unscored —
quota: Fix potential NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i…
-
Unscored —
iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the dev…
-
Unscored —
x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: …
-
Unscored —
USB: core: Fix deadlock in port "disable" sysfs attribute
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent h…
-
Unscored —
USB: core: Fix deadlock in usb_deauthorize_interface()
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which …
-
Unscored —
scsi: core: Fix unremoved procfs host directory regression
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unlo…
-
Unscored —
drm/i915/gt: Reset queue_priority_hint on parking
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Reset queue_priority_hint on parking Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of …
-
Unscored —
drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()
In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() If we have no VBT, or the VBT didn't declare the encoder in question, we won't have the 'devdata' for the e…
-
Unscored —
kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used …
-
Unscored —
usb: xhci: Add error handling in xhci_map_urb_for_dma
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhci_map_urb_for_dma Currently xhci_map_urb_for_dma() creates a temporary buffer and copies the SG list to the new linear buffer. But if the kzalloc_node() fa…
-
Unscored —
fat: fix uninitialized field in nostale filehandles
In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of t…
-
Unscored —
nbd: null check for nla_nest_start
In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_start nla_nest_start() may fail and return NULL. Insert a check and set errno based on other call sites within the same source code.
-
Unscored —
clk: Fix clk_core_get NULL dereference
In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dereference It is possible for clk_core_get to dereference a NULL in the following sequence: clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provid…
-
Unscored —
net: phy: fix phy_get_internal_delay accessing an empty array
In the Linux kernel, the following vulnerability has been resolved: net: phy: fix phy_get_internal_delay accessing an empty array The phy_get_internal_delay function could try to access to an empty array in the case that the driver is calling phy_get_internal…
-
Unscored —
netfilter: nf_tables: do not compare internal table flags on updates
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not compare internal table flags on updates Restore skipping transaction if table update does not modify flags.
-
Unscored —
ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()")) I th…
-
Unscored —
vfio/pci: Disable auto-enable of exclusive INTx IRQ
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable of exclusive INTx IRQ Currently for devices requiring masking at the irqchip for INTx, ie. devices without DisINTx support, the IRQ is enabled in request_irq() a…
-
Unscored —
efi: fix panic in kdump kernel
In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel Check if get_next_variable() is actually valid pointer before calling it. In kdump kernel this method is set to NULL that causes panic during the kexec-ed kerne…
-
Unscored —
dm snapshot: fix lockup in dm_exception_table_exit
In the Linux kernel, the following vulnerability has been resolved: dm snapshot: fix lockup in dm_exception_table_exit There was reported lockup when we exit a snapshot with many exceptions. Fix this by adding "cond_resched" to the loop that frees the excepti…
-
Unscored —
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion The first kiocb_set_cancel_fn() argument may point at a struct kiocb that is not embedded inside struct aio_kiocb. With the cu…
-
Unscored —
block: Fix page refcounts for unaligned buffers in __bio_release_pages()
In the Linux kernel, the following vulnerability has been resolved: block: Fix page refcounts for unaligned buffers in __bio_release_pages() Fix an incorrect number of pages being released for buffers that do not start at the beginning of a page.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52656.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53151.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-23307.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-25742.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26584.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26585.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26642.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26643.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26809.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26810.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26812.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26815.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26816.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26860.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26861.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26862.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26863.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26864.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26865.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26868.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26870.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26878.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26880.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26882.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26883.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26891.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26894.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26898.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26901.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26906.html