Moderate: kernel security update

Summary

Fixed packages 62

Vulnerabilities 22

• High 7.8
  CVE-2021-47383

  tty: Fix out-of-bound vmalloc access in imageblit

  In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• High 7.8
  CVE-2024-26640

  tcp: add sanity checks to rx zerocopy

  In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2024
• High 7.8
  CVE-2024-26923

  af_unix: Fix garbage collector racing against connect()

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a pe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2024
• High 7.5
  CVE-2024-26826

  mptcp: fix data re-injection from stale subflow

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.3
  CVE-2024-39472

  xfs: fix log recovery buffer allocation for the legacy h_size fixup

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy h_size fixup Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values use…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 5, 2024
• High 7.1
  CVE-2024-41014

  xfs: add bounds checking to xlog_recover_process_data

  In the Linux kernel, the following vulnerability has been resolved: xfs: add bounds checking to xlog_recover_process_data There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data. We can create …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• High 7.0
  CVE-2024-26961

  mac802154: fix llsec key resources release in mac802154_llsec_key_del

  In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Medium 4.7
  CVE-2024-2201

  CVE-2024-2201

  A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.

  Xen Xen linux-raspi2 linux-hwe Virtualization Debian Ubuntu Alpine
  Dec 19, 2024
• Unscored —
  CVE-2024-26935

  scsi: core: Fix unremoved procfs host directory regression

  In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unlo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Unscored —
  CVE-2024-36244

  net/sched: taprio: extend minimum interval restriction to entire cycle too

  In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: extend minimum interval restriction to entire cycle too It is possible for syzbot to side-step the restriction imposed by the blamed commit in the Fixes: tag, because the t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 21, 2024
• Unscored —
  CVE-2024-39504

  netfilter: nft_inner: validate mandatory meta and payload

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: validate mandatory meta and payload Check for mandatory netlink attributes in payload and meta expression when used embedded from the inner expression, otherwise NULL po…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40904

  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages

  In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40931

  mptcp: ensure snd_una is properly initialized on connect

  In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It turns out that syzkal…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40960

  ipv6: prevent possible NULL dereference in rt6_probe()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL dereference in rt6_probe() syzbot caught a NULL dereference in rt6_probe() [1] Bail out if __in6_dev_get() returns NULL. [1] Oops: general protection fault, probab…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40972

  ext4: do not create EA inode under buffer lock

  In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 12, 2024
• Unscored —
  CVE-2024-40977

  wifi: mt76: mt7921s: fix potential hung tasks during chip recovery

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery During chip recovery (e.g. chip reset), there is a possible situation that kernel worker reset_work is holding the lock and …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 12, 2024
• Unscored —
  CVE-2024-40995

  net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to add …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40998

  ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() In the following concurrency we will access the uninitialized rs->lock: ext4_fill_super ext4_register_sysfs // sysf…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 12, 2024
• Unscored —
  CVE-2024-41005

  netpoll: Fix race condition in netpoll_owner_active

  In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix race condition in netpoll_owner_active KCSAN detected a race condition in netpoll: BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb write (marked) to 0xffff8881164168b0 …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-41013

  xfs: don't walk off the end of a directory data block

  In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a directory data block This adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry to make sure don't stray beyond valid memory region. Before patc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• Unscored —
  CVE-2024-43854

  block: initialize integrity buffer to zero before writing it to media

  In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 17, 2024
• Unscored —
  CVE-2024-45018

  netfilter: flowtable: initialise extack before use

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2024

References

• report
  https://access.redhat.com/security/cve/CVE-2021-47383
• report
  https://access.redhat.com/security/cve/CVE-2024-2201
• report
  https://access.redhat.com/security/cve/CVE-2024-26640
• report
  https://access.redhat.com/security/cve/CVE-2024-26826
• report
  https://access.redhat.com/security/cve/CVE-2024-26923
• report
  https://access.redhat.com/security/cve/CVE-2024-26935
• report
  https://access.redhat.com/security/cve/CVE-2024-26961
• report
  https://access.redhat.com/security/cve/CVE-2024-36244
• report
  https://access.redhat.com/security/cve/CVE-2024-39472
• report
  https://access.redhat.com/security/cve/CVE-2024-39504
• report
  https://access.redhat.com/security/cve/CVE-2024-40904
• report
  https://access.redhat.com/security/cve/CVE-2024-40931
• report
  https://access.redhat.com/security/cve/CVE-2024-40960
• report
  https://access.redhat.com/security/cve/CVE-2024-40972
• report
  https://access.redhat.com/security/cve/CVE-2024-40977
• report
  https://access.redhat.com/security/cve/CVE-2024-40995
• report
  https://access.redhat.com/security/cve/CVE-2024-40998
• report
  https://access.redhat.com/security/cve/CVE-2024-41005
• report
  https://access.redhat.com/security/cve/CVE-2024-41013
• report
  https://access.redhat.com/security/cve/CVE-2024-41014
• report
  https://access.redhat.com/security/cve/CVE-2024-43854
• report
  https://access.redhat.com/security/cve/CVE-2024-45018
• report
  https://bugzilla.redhat.com/2268118
• report
  https://bugzilla.redhat.com/2270100
• report
  https://bugzilla.redhat.com/2275604
• report
  https://bugzilla.redhat.com/2277171
• report
  https://bugzilla.redhat.com/2278176
• report
  https://bugzilla.redhat.com/2278235
• report
  https://bugzilla.redhat.com/2282357
• report
  https://bugzilla.redhat.com/2293654
• report
  https://bugzilla.redhat.com/2296067
• report
  https://bugzilla.redhat.com/2297476
• report
  https://bugzilla.redhat.com/2297488
• report
  https://bugzilla.redhat.com/2297515
• report
  https://bugzilla.redhat.com/2297544
• report
  https://bugzilla.redhat.com/2297556
• report
  https://bugzilla.redhat.com/2297561
• report
  https://bugzilla.redhat.com/2297579
• report
  https://bugzilla.redhat.com/2297582