Summary
Errata Tool Automation could not update the description because it is longer (4803) than ET limit of 4000 characters. (OSCI-6058)
Please update the description manually.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | kernel | 0:5.14.0-427.31.1.el9_4 |
Vulnerabilities 46
-
High 7.8
net: fix __dst_negative_advice() race
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…
KEV Aug 7, 2024 -
Critical 10.0
net: openvswitch: fix overwriting ct original tuple for ICMPv6
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACKET_CMD_EXECUTE has 3 main attributes: - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. - OVS_PACKET_ATTR_PAC…
-
Critical 9.8
igc: avoid returning frame twice in XDP_REDIRECT
In the Linux kernel, the following vulnerability has been resolved: igc: avoid returning frame twice in XDP_REDIRECT When a frame can not be transmitted in XDP_REDIRECT (e.g. due to a full queue), it is necessary to free it by calling xdp_return_frame_rx_napi…
-
Critical 9.4
cifs: fix underflow in parse_server_interfaces()
In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the …
-
Critical 9.1
wifi: iwlwifi: dbg-tlv: ensure NUL termination
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.
-
High 8.8
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item…
-
High 8.8
wifi: iwlwifi: mvm: guard against invalid STA ID on removal
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: guard against invalid STA ID on removal Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would result in out-of-bounds array accesses. This prevents issu…
-
High 8.8
wifi: iwlwifi: read txq->read_ptr under lock
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but…
-
High 8.1
wifi: cfg80211: check A-MSDU format more carefully
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to …
-
High 8.0
wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's …
-
High 7.8
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale re…
-
High 7.8
wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().
-
High 7.8
i40e: fix vf may be used uninitialized in this function warning
In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with re…
-
High 7.8
net: do not leave a dangling sk pointer, when socket creation fails
In the Linux kernel, the following vulnerability has been resolved: net: do not leave a dangling sk pointer, when socket creation fails It is possible to trigger a use-after-free by: * attaching an fentry probe to __sock_release() and the probe calling the bp…
-
High 7.8
netns: Make get_net_ns() handle zero refcount net
In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle zero refcount net Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xd…
-
High 7.5
Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generatio…
-
High 7.5
nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
In the Linux kernel, the following vulnerability has been resolved: nfs: fix panic when nfs4_ff_layout_prepare_ds() fails We've been seeing the following panic in production BUG: kernel NULL pointer dereference, address: 0000000000000065 PGD 2f485f067 P4D 2f4…
-
High 7.5
net: core: reject skb_copy(_expand) for fraglist GSO skbs
In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_…
-
High 7.3
netfilter: nf_tables: flush pending destroy work before exit_net release
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: flush pending destroy work before exit_net release Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy work before netlink notifier") to address a race…
-
High 7.1
wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK The firmware doesn't need the MFP flag for the GTK, it can even make the firmware crash. in case the AP is configured with: group cipher…
-
High 7.1
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte…
-
High 7.0
platform/x86: wmi: Fix opening of char device
In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp…
-
High 7.0
eeprom: at24: fix memory corruption race condition
In the Linux kernel, the following vulnerability has been resolved: eeprom: at24: fix memory corruption race condition If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver…
-
Medium 5.5
wifi: nl80211: don't free NULL coalescing rule
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here.
-
Medium 5.3
vt: fix unicode buffer corruption when deleting characters
In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting char…
-
Unscored —
net: netlink: af_netlink: Prevent empty skb by adding a check on len.
In the Linux kernel, the following vulnerability has been resolved: net: netlink: af_netlink: Prevent empty skb by adding a check on len. Adding a check on len parameter to avoid empty skb. This prevents a division error in netem_enqueue function which is cau…
-
Unscored —CVE-2023-52651 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can h…
-
Unscored —
wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data structures have been fully initialised by …
-
Unscored —
wifi: mt76: mt7925e: fix use-after-free in free_irq()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-free in free_irq() From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test to make sure the shared irq handler should be able to handle the …
-
Unscored —
netfilter: nf_tables: do not compare internal table flags on updates
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not compare internal table flags on updates Restore skipping transaction if table update does not modify flags.
-
Unscored —
ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_geta…
-
Unscored —
ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xm…
-
Unscored —
efi: fix panic in kdump kernel
In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel Check if get_next_variable() is actually valid pointer before calling it. In kdump kernel this method is set to NULL that causes panic during the kexec-ed kerne…
-
Unscored —
mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as suppose…
-
Unscored —
ice: fix memory corruption bug with suspend and rebuild
In the Linux kernel, the following vulnerability has been resolved: ice: fix memory corruption bug with suspend and rebuild The ice driver would previously panic after suspend. This is caused from the driver *only* calling the ice_vsi_free_q_vectors() functio…
-
Unscored —
netfilter: nf_tables: honor table dormant flag from netdev release event path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook…
-
Unscored —
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute nee…
-
Unscored —
tls: fix missing memory barrier in tls_init
In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 -…
-
Unscored —
ipv6: Fix potential uninit-value access in __ip6_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in __ip6_make_skb() As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on f…
-
Unscored —CVE-2024-37353 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). In dctcp_update_alpha(), we use a module parameter dctcp_shift_g as follows: alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g); ... de…
-
Unscored —CVE-2024-38391 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
wifi: brcmfmac: pcie: handle randbuf allocation failure
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: pcie: handle randbuf allocation failure The kzalloc() in brcmf_pcie_download_fw_nvram() will return null if the physical memory has run out. As a result, if we use get_random_…
-
Unscored —
net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() Clang static checker (scan-build) warning: net/ethtool/ioctl.c:line 2233, column 2 Called function pointer is null (nu…
-
Unscored —
ipv6: prevent possible NULL deref in fib6_nh_init()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL deref in fib6_nh_init() syzbot reminds us that in6_dev_get() can return NULL. fib6_nh_init() ip6_validate_gw( &idev ) ip6_route_check_nh( idev ) *idev = in6_dev_ge…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265838
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2273405
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275600
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275655
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275715
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275748
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278380
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278417
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278429
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278519
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278989
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281057
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281097
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281133
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281190
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281237
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281257
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281265
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281272
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281639
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281667
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281821
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281900
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281949
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282719
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284400
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284417
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284474
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284496
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284511
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284513
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284543
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2292331
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293208
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293418
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293441
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293657
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293658
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293686