Skip to content
OpenAdvisories
Medium WID-SEC-2024-0499 25 CVEs

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Feb 27, 2024 · Updated Oct 12, 2025 · Revision 23 · de-DE

Vendor: Broadcom Vendor: Debian Vendor: Dell Vendor: EMC Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: SUSE Product: Avamar Product: Brocade SANnav Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: NetWorker Product: QRadar SIEM Platform: Linux

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 25

  • Critical 9.8
    CVE-2021-47013

    net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send

    In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be fre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2021-47017

    ath10k: Fix a use after free in ath10k_htc_send_bundle

    In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix a use after free in ath10k_htc_send_bundle In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_sk…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2021-47049

    Drivers: hv: vmbus: Use after free in __vmbus_open()

    In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Use after free in __vmbus_open() The "open_info" variable is added to the &vmbus_connection.chn_msg_list, but the error handling frees "open_info" without removing it from…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2021-47012

    RDMA/siw: Fix a use after free in siw_alloc_mr

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free in siw_alloc_mr Our code analyzer reported a UAF. In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2021-47014

    net/sched: act_ct: fix wild memory access when clearing fragments

    In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix wild memory access when clearing fragments while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: mayb…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2021-47040

    io_uring: fix overflows checks in provide buffers

    In the Linux kernel, the following vulnerability has been resolved: io_uring: fix overflows checks in provide buffers Colin reported before possible overflow and sign extension problems in io_provide_buffers_prep(). As Linus pointed out previous attempt did n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2021-47048

    spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op

    In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op When handling op->addr, it is using the buffer "tmpbuf" which has been freed. This will trigger a use-after-free KASAN warning…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.7
    CVE-2021-47044

    sched/fair: Fix shift-out-of-bounds in load_balance()

    In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix shift-out-of-bounds in load_balance() Syzbot reported a handful of occurrences where an sd->nr_balance_failed can grow to much higher values than one would expect. A successfu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2021-47041

    nvmet-tcp: fix incorrect locking in state_change sk callback

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix incorrect locking in state_change sk callback We are not changing anything in the TCP connection state so we should not take a write_lock but rather a read lock. This caused a …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47009

    KEYS: trusted: Fix memory leak on object td

    In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak on object td Two error return paths are neglecting to free allocated object td, causing a memory leak. Fix this by returning via the error return path that secu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47015

    bnxt_en: Fix RX consumer index logic in the error path.

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RX consumer index logic in the error path. In bnxt_rx_pkt(), the RX buffers are expected to complete in order. If the RX consumer index indicates an out of order buffer completio…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47018

    powerpc/64: Fix the definition of the fixmap area

    In the Linux kernel, the following vulnerability has been resolved: powerpc/64: Fix the definition of the fixmap area At the time being, the fixmap area is defined at the top of the address space or just below KASAN. This definition is not valid for PPC64. Fo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47019

    mt76: mt7921: fix possible invalid register access

    In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix possible invalid register access Disable the interrupt and synchronze for the pending irq handlers to ensure the irq tasklet is not being scheduled after the suspend to avoi…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2021-47037

    ASoC: q6afe-clocks: fix reprobing of the driver

    In the Linux kernel, the following vulnerability has been resolved: ASoC: q6afe-clocks: fix reprobing of the driver Q6afe-clocks driver can get reprobed. For example if the APR services are restarted after the firmware crash. However currently Q6afe-clocks dr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47038

    Bluetooth: avoid deadlock between hci_dev->lock and socket lock

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: avoid deadlock between hci_dev->lock and socket lock Commit eab2404ba798 ("Bluetooth: Add BT_PHY socket option") added a dependency between socket lock and hci_dev->lock that could…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47039

    ataflop: potential out of bounds in do_format()

    In the Linux kernel, the following vulnerability has been resolved: ataflop: potential out of bounds in do_format() The function uses "type" as an array index: q = unit[drive].disk[type]->queue; Unfortunately the bounds check on "type" isn't done until later …

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2021-47042

    drm/amd/display: Free local data after use

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Free local data after use Fixes the following memory leak in dc_link_construct(): unreferenced object 0xffffa03e81471400 (size 1024): comm "amd_module_load", pid 2486, jiffie…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2021-47043

    media: venus: core: Fix some resource leaks in the error path of 'venus_probe()'

    In the Linux kernel, the following vulnerability has been resolved: media: venus: core: Fix some resource leaks in the error path of 'venus_probe()' If an error occurs after a successful 'of_icc_get()' call, it must be undone. Use 'devm_of_icc_get()' instead …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47045

    scsi: lpfc: Fix null pointer dereference in lpfc_prep_els_iocb()

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null pointer dereference in lpfc_prep_els_iocb() It is possible to call lpfc_issue_els_plogi() passing a did for which no matching ndlp is found. A call is then made to lpfc_p…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2021-47046

    drm/amd/display: Fix off by one in hdmi_14_process_transaction()

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offsets[] array did not have an entry for HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it led to an off by one re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47047

    spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails

    In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails The spi controller supports 44-bit address space on AXI in DMA mode, so set dma_addr_t width to 44-bit to avoid using a swiotlb m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47050

    memory: renesas-rpc-if: fix possible NULL pointer dereference of resource

    In the Linux kernel, the following vulnerability has been resolved: memory: renesas-rpc-if: fix possible NULL pointer dereference of resource The platform_get_resource_byname() can return NULL which would be immediately dereferenced by resource_size(). Instea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47051

    spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()

    In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in refer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47052

    crypto: sa2ul - Fix memory leak of rxd

    In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - Fix memory leak of rxd There are two error return paths that are not freeing rxd and causing memory leaks. Fix these. Addresses-Coverity: ("Resource leak")

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47053

    crypto: sun8i-ss - Fix memory leak of pad

    In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Fix memory leak of pad It appears there are several failure return paths that don't seem to be free'ing pad. Fix these. Addresses-Coverity: ("Resource leak")

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #23

    Neue Updates von Debian aufgenommen

  2. #22

    Neue Updates von BROCADE aufgenommen

  3. #21

    Neue Updates von IBM aufgenommen

  4. #20

    Neue Updates von Dell aufgenommen

  5. #19

    Neue Updates von SUSE aufgenommen

  6. #18

    Neue Updates von Oracle Linux aufgenommen

  7. #17

    Neue Updates von Red Hat aufgenommen

  8. #16

    Neue Updates von Dell aufgenommen

  9. #15

    Neue Updates von IBM aufgenommen

  10. #14

    Neue Updates von Dell aufgenommen

  11. #13

    Neue Updates von Red Hat aufgenommen

  12. #12

    Neue Updates von Oracle Linux aufgenommen

  13. #11

    Neue Updates von Red Hat aufgenommen

  14. #10

    Neue Updates von SUSE aufgenommen

  15. #9

    Neue Updates von Red Hat aufgenommen

  16. #8

    Neue Updates von SUSE aufgenommen

  17. #7

    Neue Updates von SUSE aufgenommen

  18. #6

    Neue Updates von SUSE aufgenommen

  19. #5

    Neue Updates von Dell aufgenommen

  20. #4

    Neue Updates von SUSE aufgenommen

  21. #3

    Neue Updates von SUSE aufgenommen

  22. #2

    Neue Updates von SUSE aufgenommen

  23. #1

    Initiale Fassung

References