Skip to content
OpenAdvisories

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Zustand zu verursachen und einen nicht näher spezifizierten Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 45

  • High 8.2

    s390/vfio-ap: always filter entire AP matrix

    In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: always filter entire AP matrix The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to upda…

  • High 7.8

    KVM: Stop looking for coalesced MMIO zones if the bus is destroyed

    In the Linux kernel, the following vulnerability has been resolved: KVM: Stop looking for coalesced MMIO zones if the bus is destroyed Abort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev() fails to allocate memory for the new instance of the b…

  • High 7.8

    KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU

    In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU If allocating a new instance of an I/O bus fails when unregistering a device, wait to destroy the device until after a…

  • High 7.8

    net/nfc: fix use-after-free llcp_sock_bind/connect

    In the Linux kernel, the following vulnerability has been resolved: net/nfc: fix use-after-free llcp_sock_bind/connect Commits 8a4cd82d ("nfc: fix refcount leak in llcp_sock_connect()") and c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()") fixed a refc…

  • High 7.8

    media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

    In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. In mtk_jpeg_d…

  • High 7.8

    ksmbd: fix global oob in ksmbd_nl_policy

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix global oob in ksmbd_nl_policy Similar to a reported issue (check the commit b33fb5b801c6 ("net: qualcomm: rmnet: fix global oob in rmnet_policy"), my local fuzzer finds another glo…

  • High 7.8

    wifi: iwlwifi: fix a memory corruption

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix a memory corruption iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in bytes, we…

  • High 7.8

    tcp: make sure init the accept_queue's spinlocks once

    In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value …

  • High 7.8

    fs/proc/task_mmu: move mmu notification mechanism inside mm lock

    In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier …

  • High 7.5

    xsk: fix usage of multi-buffer BPF helpers for ZC XDP

    In the Linux kernel, the following vulnerability has been resolved: xsk: fix usage of multi-buffer BPF helpers for ZC XDP Currently when packet is shrunk via bpf_xdp_adjust_tail() and memory type is set to MEM_TYPE_XSK_BUFF_POOL, null ptr dereference happens:…

  • High 7.1

    mtd: require write permissions for locking and badblock ioctls

    In the Linux kernel, the following vulnerability has been resolved: mtd: require write permissions for locking and badblock ioctls MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require write permission. Depending on the hardware MEMLOCK might ev…

  • High 7.1

    async_xor: increase src_offs when dropping destination page

    In the Linux kernel, the following vulnerability has been resolved: async_xor: increase src_offs when dropping destination page Now we support sharing one page if PAGE_SIZE is not equal stripe size. To support this, it needs to support calculating xor value w…

  • High 7.1

    erofs: fix lz4 inplace decompression

    In the Linux kernel, the following vulnerability has been resolved: erofs: fix lz4 inplace decompression Currently EROFS can map another compressed buffer for inplace decompression, that was used to handle the cases that some pages of compressed data are actu…

  • Medium 5.5

    crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map

    In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map In the case where the dma_iv mapping fails, the return error path leaks the memory allocated to object d. Fix this by a…

  • Medium 5.5

    mm: migrate: fix getting incorrect page mapping during page migration

    In the Linux kernel, the following vulnerability has been resolved: mm: migrate: fix getting incorrect page mapping during page migration When running stress-ng testing, we found below kernel crash after a few hours: Unable to handle kernel NULL pointer deref…

  • Medium 5.5

    netfs, fscache: Prevent Oops in fscache_put_cache()

    In the Linux kernel, the following vulnerability has been resolved: netfs, fscache: Prevent Oops in fscache_put_cache() This function dereferences "cache" and then checks if it's IS_ERR_OR_NULL(). Check first, then dereference.

  • Medium 5.3

    mt76: fix potential DMA mapping leak

    In the Linux kernel, the following vulnerability has been resolved: mt76: fix potential DMA mapping leak With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap could potentially inherit a non-zero value from stack garbage. If this happens, …

  • Medium 4.4

    dmaengine: fix NULL pointer in channel unregistration function

    In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix NULL pointer in channel unregistration function __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local i…

  • Unscored —

    spi: Fix use-after-free with devm_spi_alloc_*

    In the Linux kernel, the following vulnerability has been resolved: spi: Fix use-after-free with devm_spi_alloc_* We can't rely on the contents of the devres list during spi_unregister_controller(), as the list is already torn down at the time we perform devr…

  • Unscored —

    m68k: mvme147,mvme16x: Don't wipe PCC timer config bits

    In the Linux kernel, the following vulnerability has been resolved: m68k: mvme147,mvme16x: Don't wipe PCC timer config bits Don't clear the timer 1 configuration bits when clearing the interrupt flag and counter overflow. As Michael reported, "This results in…

  • Unscored —

    soundwire: stream: fix memory leak in stream config error path

    In the Linux kernel, the following vulnerability has been resolved: soundwire: stream: fix memory leak in stream config error path When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added…

  • Unscored —

    bus: qcom: Put child node before return

    In the Linux kernel, the following vulnerability has been resolved: bus: qcom: Put child node before return Put child node before return to fix potential reference count leak. Generally, the reference count of child is incremented and decremented automaticall…

  • Unscored —

    crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init

    In the Linux kernel, the following vulnerability has been resolved: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() before calling adf_iov_putmsg()->mutex_lock(vf2pf…

  • Unscored —

    regmap: set debugfs_name to NULL after it is freed

    In the Linux kernel, the following vulnerability has been resolved: regmap: set debugfs_name to NULL after it is freed There is a upstream commit cffa4b2122f5("regmap:debugfs: Fix a memory leak when calling regmap_attach_dev") that adds a if condition when cr…

  • Unscored —

    crypto: sun8i-ss - fix result memory leak on error path

    In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - fix result memory leak on error path This patch fixes a memory leak on an error path.

  • Unscored —

    KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs Use the kvm_for_each_vcpu() helper to iterate over vCPUs when encrypting VMSAs for SEV, which effectively switches to use …

  • Unscored —

    drm: bridge/panel: Cleanup connector on bridge detach

    In the Linux kernel, the following vulnerability has been resolved: drm: bridge/panel: Cleanup connector on bridge detach If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects i…

  • Unscored —

    rtw88: Fix array overrun in rtw_get_tx_power_params()

    In the Linux kernel, the following vulnerability has been resolved: rtw88: Fix array overrun in rtw_get_tx_power_params() Using a kernel with the Undefined Behaviour Sanity Checker (UBSAN) enabled, the following array overrun is logged: ======================…

  • Unscored —

    soc/tegra: regulators: Fix locking up when voltage-spread is out of range

    In the Linux kernel, the following vulnerability has been resolved: soc/tegra: regulators: Fix locking up when voltage-spread is out of range Fix voltage coupler lockup which happens when voltage-spread is out of range due to a bug in the code. The max-spread…

  • Unscored —

    drm/amd/display: Wake DMCUB before sending a command

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before sending a command [Why] We can hang in place trying to send commands when the DMCUB isn't powered on. [How] For functions that execute within a DC context o…

  • Unscored —

    net/mlx5e: Fix peer flow lists handling

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix peer flow lists handling The cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP flag when list of peer flows has become empty. However, if any concurrent us…

  • Unscored —

    serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO

    In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO The SC16IS7XX IC supports a burst mode to access the FIFOs where the initial register address is sent ($00), followe…

  • Unscored —

    mm/sparsemem: fix race in accessing memory_section->usage

    In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are su…

  • Unscored —

    bus: mhi: host: Drop chan lock before queuing buffers

    In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Drop chan lock before queuing buffers Ensure read and write locks for the channel are not taken in succession by dropping the read lock from parse_xfer_event() such that a cal…

  • Unscored —

    bus: mhi: host: Add alignment check for event ring read pointer

    In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Add alignment check for event ring read pointer Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is anot…

  • Unscored —

    soc: qcom: pmic_glink_altmode: fix port sanity check

    In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix port sanity check The PMIC GLINK altmode driver currently supports at most two ports. Fix the incomplete port sanity check on notifications to avoid accessi…

  • Unscored —
    CVE-2023-52496 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    PM: sleep: Fix possible deadlocks in core system-wide PM code

    In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes it…

  • Unscored —

    drm/bridge: sii902x: Fix probing race issue

    In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: [ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x] […

  • Unscored —
    CVE-2024-26609 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —
    CVE-2024-26613 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    net/smc: fix illegal rmb_desc access in SMC-D connection dump

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix illegal rmb_desc access in SMC-D connection dump A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx sm…

  • Unscored —

    btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned

    In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned [BUG] There is a bug report that, on a ext4-converted btrfs, scrub leads to various problems, including: - "unable to f…

  • Unscored —

    arm64/sme: Always exit sme_alloc() early with existing storage

    In the Linux kernel, the following vulnerability has been resolved: arm64/sme: Always exit sme_alloc() early with existing storage When sme_alloc() is called with existing storage and we are not flushing we will always allocate new storage, both leaking the e…

  • Unscored —

    riscv: Fix module loading free order

    In the Linux kernel, the following vulnerability has been resolved: riscv: Fix module loading free order Reverse order of kfree calls to resolve use-after-free error.

Revision history

  1. #128

    Neue Updates von Debian aufgenommen

  2. #127

    Neue Updates von SUSE aufgenommen

  3. #126

    Neue Updates von SUSE aufgenommen

  4. #125

    Neue Updates von IBM aufgenommen

  5. #124

    Neue Updates von Debian aufgenommen

  6. #123

    Neue Updates von IBM aufgenommen

  7. #122

    Neue Updates von SUSE aufgenommen

  8. #121

    Neue Updates von SUSE aufgenommen

  9. #120

    Neue Updates von Debian aufgenommen

  10. #119

    Neue Updates von IBM und Red Hat aufgenommen

  11. #118

    Neue Updates von Ubuntu aufgenommen

  12. #117

    Neue Updates von Red Hat aufgenommen

  13. #116

    Neue Updates von IBM aufgenommen

  14. #115

    Neue Updates von Ubuntu aufgenommen

  15. #114

    Neue Updates von Ubuntu aufgenommen

  16. #113

    Neue Updates von Ubuntu aufgenommen

  17. #112

    Neue Updates von Oracle Linux aufgenommen

  18. #111

    Neue Updates von Red Hat aufgenommen

  19. #110

    Neue Updates von SUSE und BROCADE aufgenommen

  20. #109

    Neue Updates von SUSE aufgenommen

  21. #108

    Neue Updates von IBM aufgenommen

  22. #107

    Neue Updates von IBM und SUSE aufgenommen

  23. #106

    Neue Updates von SUSE aufgenommen

  24. #105

    Neue Updates von SUSE aufgenommen

  25. #104

    Neue Updates von SUSE aufgenommen

References