Summary
It was discovered that the HugeTLB file system component of the Linux
Kernel contained a NULL pointer dereference vulnerability. A privileged
attacker could possibly use this to to cause a denial of service.
(CVE-2024-0841)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- PowerPC architecture;
- x86 architecture;
- DMA engine subsystem;
- EFI core;
- GPU drivers;
- InfiniBand drivers;
- Multiple devices driver;
- Network drivers;
- Power supply drivers;
- TCM subsystem;
- Userspace I/O drivers;
- USB subsystem;
- Framebuffer layer;
- AFS file system;
- File systems infrastructure;
- BTRFS file system;
- Ext4 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- L2TP protocol;
- MAC80211 subsystem;
- Netfilter;
- Netlink;
- Wireless networking;
(CVE-2021-47063, CVE-2024-26751, CVE-2024-26848, CVE-2024-26748,
CVE-2024-26733, CVE-2024-26735, CVE-2024-26805, CVE-2024-26804,
CVE-2024-26793, CVE-2023-52504, CVE-2024-27417, CVE-2024-27405,
CVE-2024-26778, CVE-2024-27414, CVE-2024-26801, CVE-2024-26835,
CVE-2024-27413, CVE-2024-26766, CVE-2024-27410, CVE-2024-27412,
CVE-2024-26773, CVE-2024-26777, CVE-2024-26839, CVE-2024-26764,
CVE-2024-26712, CVE-2024-26788, CVE-2024-26688, CVE-2024-26754,
CVE-2021-47070, CVE-2024-26752, CVE-2024-26845, CVE-2024-26791,
CVE-2024-26763, CVE-2024-27416, CVE-2024-26779, CVE-2024-26749,
CVE-2024-26736, CVE-2024-26840, CVE-2024-26772, CVE-2024-26790)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-bluefield | 5.4.0-1086.93 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-iot | 5.4.0-1038.39 |
Vulnerabilities 41
-
High 8.8
wifi: mac80211: fix race condition on enabling fast-xmit
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded s…
-
High 8.8
Bluetooth: Avoid potential use-after-free in hci_error_reset
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would …
-
High 8.8
Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST If we received HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote does support …
-
High 8.1
afs: Increase buffer size in afs_update_volume_status()
In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in afs_update_volume_status() The max length of volume->vid value is 20 characters. So increase idbuf[] size up to 24 to avoid overflow. Found by Linux Verification …
-
High 7.8
powerpc/kasan: Fix addr error caused by page alignment
In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix addr error caused by page alignment In kasan_init_region, when k_start is not page aligned, at the begin of for loop, k_cur = k_start & PAGE_MASK is less than k_start, and …
-
High 7.8
usb: cdns3: fix memory double free when handle zero packet
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix memory double free when handle zero packet 829 if (request->complete) { 830 spin_unlock(&priv_dev->lock); 831 usb_gadget_giveback_request(&priv_ep->endpoint, 832 request); 833…
-
High 7.8
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easil…
-
High 7.8
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avo…
-
High 7.8
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid alloc…
-
High 7.8
gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_newlink() The gtp_link_ops operations structure for the subsystem must be registered after registering the gtp_net_ops pernet operations stru…
-
High 7.8
net: ip_tunnel: prevent perpetual headroom growth
In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read…
-
High 7.8
wifi: nl80211: reject iftype change with mesh ID change
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change It's currently possible to change the mesh ID when the interface isn't yet in mesh mode, at the same time as changing it into mesh mode…
-
High 7.8
rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back In the commit d73ef2d69c0d ("rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length"), an adjustment was made to the ol…
-
High 7.5
scsi: target: core: Add TMF to tmr_list handling
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list take…
-
High 7.5
usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has…
-
High 7.1
dm-crypt: don't modify the data when using authenticated encryption
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: don't modify the data when using authenticated encryption It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. …
-
Medium 6.6
Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function
A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
-
Medium 5.5
uio_hv_generic: Fix another memory leak in error handling paths
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix another memory leak in error handling paths Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe function is never freed in the error handling path. Add …
-
Medium 5.5
power: supply: bq27xxx-i2c: Do not free non existing IRQ
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client…
-
Unscored —
drm: bridge/panel: Cleanup connector on bridge detach
In the Linux kernel, the following vulnerability has been resolved: drm: bridge/panel: Cleanup connector on bridge detach If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects i…
-
Unscored —
x86/alternatives: Disable KASAN in apply_alternatives()
In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Disable KASAN in apply_alternatives() Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging machine: BUG: KASAN: out-of-bounds in rcu_is_watch…
-
Unscored —
fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super When configuring a hugetlb filesystem via the fsconfig() syscall, there is a possible NULL dereference in hugetlbfs_fill_super(…
-
Unscored —
arp: Prevent overflow in arp_req_get().
In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh-…
-
Unscored —
ipv6: sr: fix possible use-after-free and null-ptr-deref
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref The pernet operations structure for the subsystem must be registered before registering the generic netlink family.
-
Unscored —
usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() ... cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ... 'priv_req' a…
-
Unscored —
ARM: ep93xx: Add terminator to gpiod_lookup_table
In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to gpiod_lookup_table Without the terminator, if a con_id is passed to gpio_find() that does not exist in the lookup table the function will not stop looping corre…
-
Unscored —
l2tp: pass correct message length to ip6_append_data
In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuf…
-
Unscored —
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() The gtp_net_ops pernet operations structure for the subsystem must be registered before registering the generic netlink famil…
-
Unscored —
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the following kernel warning appears: WARNING: CPU: 3 PID…
-
Unscored —
fbdev: sis: Error out if pixclock equals zero
In the Linux kernel, the following vulnerability has been resolved: fbdev: sis: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may ca…
-
Unscored —
fbdev: savage: Error out if pixclock equals zero
In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may…
-
Unscored —
dmaengine: fsl-qdma: init irq after reg initialization
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq after reg initialization Initialize the qDMA irqs after the registers are configured so that interrupts that may have been pending from a primary kernel don't ge…
-
Unscored —
dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read There is chip (ls1028a) errata: The SoC may hang on 16 byte unaligned read transactions by QDMA. Unaligned read transactions in…
-
Unscored —
btrfs: dev-replace: properly validate device names
In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead t…
-
Unscored —
netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` …
-
Unscored —
netfilter: nf_tables: set dormant flag on hook register failure
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure We need to set the dormant flag again if we fail to register the hooks. During memory pressure hook registration can fail and w…
-
Unscored —
IB/hfi1: Fix a memleak in init_credit_return
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix a memleak in init_credit_return When dma_alloc_coherent fails to allocate dd->cr_base[i].va, init_credit_return should deallocate dd->cr_base and dd->cr_base[i] that allocated be…
-
Unscored —
cachefiles: fix memory leak in cachefiles_add_cache()
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache() The following memory leak was reported after unbinding /dev/cachefiles: =================================================================…
-
Unscored —CVE-2024-26848 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
efi/capsule-loader: fix incorrect allocation size
In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/cap…
-
Unscored —
ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_geta…
References
-
report
https://ubuntu.com/security/CVE-2021-47063
-
report
https://ubuntu.com/security/CVE-2021-47070
-
report
https://ubuntu.com/security/CVE-2023-52504
-
report
https://ubuntu.com/security/CVE-2024-0841
-
report
https://ubuntu.com/security/CVE-2024-26688
-
report
https://ubuntu.com/security/CVE-2024-26712
-
report
https://ubuntu.com/security/CVE-2024-26733
-
report
https://ubuntu.com/security/CVE-2024-26735
-
report
https://ubuntu.com/security/CVE-2024-26736
-
report
https://ubuntu.com/security/CVE-2024-26748
-
report
https://ubuntu.com/security/CVE-2024-26749
-
report
https://ubuntu.com/security/CVE-2024-26751
-
report
https://ubuntu.com/security/CVE-2024-26752
-
report
https://ubuntu.com/security/CVE-2024-26754
-
report
https://ubuntu.com/security/CVE-2024-26763
-
report
https://ubuntu.com/security/CVE-2024-26764
-
report
https://ubuntu.com/security/CVE-2024-26766
-
report
https://ubuntu.com/security/CVE-2024-26772
-
report
https://ubuntu.com/security/CVE-2024-26773
-
report
https://ubuntu.com/security/CVE-2024-26777
-
report
https://ubuntu.com/security/CVE-2024-26778
-
report
https://ubuntu.com/security/CVE-2024-26779
-
report
https://ubuntu.com/security/CVE-2024-26788
-
report
https://ubuntu.com/security/CVE-2024-26790
-
report
https://ubuntu.com/security/CVE-2024-26791
-
report
https://ubuntu.com/security/CVE-2024-26793
-
report
https://ubuntu.com/security/CVE-2024-26801
-
report
https://ubuntu.com/security/CVE-2024-26804
-
report
https://ubuntu.com/security/CVE-2024-26805
-
report
https://ubuntu.com/security/CVE-2024-26835
-
report
https://ubuntu.com/security/CVE-2024-26839
-
report
https://ubuntu.com/security/CVE-2024-26840
-
report
https://ubuntu.com/security/CVE-2024-26845
-
report
https://ubuntu.com/security/CVE-2024-26848
-
report
https://ubuntu.com/security/CVE-2024-27405
-
report
https://ubuntu.com/security/CVE-2024-27410
-
report
https://ubuntu.com/security/CVE-2024-27412
-
report
https://ubuntu.com/security/CVE-2024-27413
-
report
https://ubuntu.com/security/CVE-2024-27414