Skip to content
OpenAdvisories

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen oder einen nicht spezifizierten Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 55

  • High 8.8

    net: fix possible store tearing in neigh_periodic_work()

    In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an …

  • High 8.2

    mm: huge_memory: don't force huge page alignment on 32 bit

    In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: don't force huge page alignment on 32 bit commit efa7df3e3bb5 ("mm: align larger anonymous mappings on THP boundaries") caused two issues [1] [2] reported on 32 bit system or…

  • High 7.8

    ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry

    In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry do_mq_timedreceive calls wq_sleep with a stack local address. The sender (do_mq_timedsend) uses this address to later …

  • High 7.8

    RDMA/rxe: Clear all QP fields if creation failed

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Clear all QP fields if creation failed rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly created ones, but in case rxe_qp_from_init() failed it was filled wi…

  • High 7.8

    habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memory

    In the Linux kernel, the following vulnerability has been resolved: habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memory Our code analyzer reported a uaf. In gaudi_memset_device_memory, cb is get via hl_cb_kernel_create() with 2 refc…

  • High 7.8

    bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets With a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messages sent from one TCP socket (s1) to actually egress from…

  • High 7.8

    cifs: Fix UAF in cifs_demultiplex_thread()

    In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultiplex_thread() There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 …

  • High 7.8

    team: fix null-ptr-deref when team device type is changed

    In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 001…

  • High 7.1

    media: uvcvideo: Fix OOB read

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix OOB read If the index provided by the user is bigger than the mask size, we might do an out of bound read.

  • High 7.1

    power: supply: rk817: Fix node refcount leak

    In the Linux kernel, the following vulnerability has been resolved: power: supply: rk817: Fix node refcount leak Dan Carpenter reports that the Smatch static checker warning has found that there is another refcount leak in the probe function. While of_node_pu…

  • Medium 6.3

    netfilter: nf_tables: fix memleak when more than 255 elements expired

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type…

  • Medium 6.0

    HID: sony: Fix a potential memory leak in sony_probe()

    In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occurs after a successful usb_alloc_urb() call, usb_free_urb() should be called.

  • Medium 5.5

    uio_hv_generic: Fix another memory leak in error handling paths

    In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix another memory leak in error handling paths Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe function is never freed in the error handling path. Add …

  • Medium 5.5

    vt: fix memory overlapping when deleting chars in the buffer

    In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpy…

  • Medium 5.5

    Bluetooth: hci_codec: Fix leaking content of local_codecs

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: Fix leaking content of local_codecs The following memory leak can be observed when the controller supports codecs which are stored in local_codecs list but the elements …

  • Medium 5.5

    arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved

    In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved Adding a reserved memory region for the framebuffer memory (the splash memory region set up by the bootloader). It …

  • Medium 5.5

    nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat…

  • Medium 5.5

    x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()

    In the Linux kernel, the following vulnerability has been resolved: x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer() The code calling ima_free_kexec_buffer() runs long after the memblock allocator has already been torn down, potential…

  • Medium 5.3

    nvmet: fix memory leak in nvmet_alloc_ctrl()

    In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak in nvmet_alloc_ctrl() When creating ctrl in nvmet_alloc_ctrl(), if the cntlid_min is larger than cntlid_max of the subsystem, and jumps to the "out_free_changed_ns_list…

  • Unscored —

    uio_hv_generic: Fix a memory leak in error handling paths

    In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix a memory leak in error handling paths If 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be updated and 'hv_uio_cleanup()' in the error handling path will …

  • Unscored —

    btrfs: fix removed dentries still existing after log is synced

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix removed dentries still existing after log is synced When we move one inode from one directory to another and both the inode and its previous parent directory were logged before, we…

  • Unscored —

    platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios

    In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios init_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on systems where the Dell WMI interface is supported. While exit_…

  • Unscored —

    nvme-loop: fix memory leak in nvme_loop_create_ctrl()

    In the Linux kernel, the following vulnerability has been resolved: nvme-loop: fix memory leak in nvme_loop_create_ctrl() When creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl() fails, the loop ctrl should be freed before jumping to the "out" …

  • Unscored —

    RDMA/rxe: Return CQE error if invalid lkey was supplied

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Return CQE error if invalid lkey was supplied RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation…

  • Unscored —

    scsi: qedf: Add pointer checks in qedf_update_link_speed()

    In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Add pointer checks in qedf_update_link_speed() The following trace was observed: [ 14.042059] Call Trace: [ 14.042061] <IRQ> [ 14.042068] qedf_link_update+0x144/0x1f0 [qedf] [ 14.…

  • Unscored —

    platform/x86: ideapad-laptop: fix a NULL pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: platform/x86: ideapad-laptop: fix a NULL pointer dereference The third parameter of dytc_cql_command should not be NULL since it will be dereferenced immediately.

  • Unscored —

    RDMA/core: Prevent divide-by-zero error triggered by the user

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prevent divide-by-zero error triggered by the user The user_entry_size is supplied by the user and later used as a denominator to calculate number of entries. The zero supplied by …

  • Unscored —

    ceph: drop messages from MDS when unmounting

    In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting When unmounting all the dirty buffers will be flushed and after the last osd request is finished the last reference of the i_count will be release…

  • Unscored —

    phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers

    In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD (implemented by the driver), as well as others…

  • Unscored —

    HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit

    In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit The EHL (Elkhart Lake) based platforms provide a OOB (Out of band) service, which allows to wakup device when the system is in S5 (S…

  • Unscored —

    platform/x86: think-lmi: Fix reference leak

    In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix reference leak If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned which needs to be disposed accordingly using kob…

  • Unscored —
    CVE-2023-52521 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    net: nfc: llcp: Add lock when modifying device list

    In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered.

  • Unscored —

    wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet

    In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process …

  • Unscored —

    erofs: fix memory leak of LZMA global compressed deduplication

    In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled (`-Ededupe`), I found some sh…

  • Unscored —

    ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()

    In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happ…

  • Unscored —

    net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg

    In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: u…

  • Unscored —

    wifi: iwlwifi: mvm: Fix a memory corruption issue

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) …

  • Unscored —

    net: mana: Fix TX CQE error handling

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type (probably from a newer hardware), still free the SKB, update the queue tail, etc., otherwise the accounting will be wrong…

  • Unscored —

    iommu/vt-d: Avoid memory allocation in iommu_suspend()

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid memory allocation in iommu_suspend() The iommu_suspend() syscore suspend callback is invoked with IRQ disabled. Allocating memory with the GFP_KERNEL flag may re-enable IRQs…

  • Unscored —

    mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the …

  • Unscored —

    mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()

    In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() After the commit in Fixes:, if a module that created a slab cache does not release all of its allocated objects befo…

  • Unscored —

    drm/meson: fix memory leak on ->hpd_notify callback

    In the Linux kernel, the following vulnerability has been resolved: drm/meson: fix memory leak on ->hpd_notify callback The EDID returned by drm_bridge_get_edid() needs to be freed.

  • Unscored —

    Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"

    In the Linux kernel, the following vulnerability has been resolved: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. The commit above is reverted as it did not solve the original issue. gsm_cleanup_…

  • Unscored —

    serial: 8250_port: Check IRQ data before use

    In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: Check IRQ data before use In case the leaf driver wants to use IRQ polling (irq = 0) and IIR register shows that an interrupt happened in the 8250 hardware the IRQ data can…

  • Unscored —

    x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race

    In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an enclave and set secs.epc_page to NULL. The SECS page is used for…

  • Unscored —

    btrfs: remove BUG() after failure to insert delayed dir index item

    In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release a…

  • Unscored —

    vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent()

    In the Linux kernel, the following vulnerability has been resolved: vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent() Inject fault while probing mdpy.ko, if kstrdup() of create_dir() fails in kobject_add_internal() in kobject_init_and_add() in …

  • Unscored —

    net: rds: Fix possible NULL-pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: net: rds: Fix possible NULL-pointer dereference In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument Found by Linux Ver…

  • Unscored —
    CVE-2023-52575 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    dccp: fix dccp_v4_err()/dccp_v6_err() again

    In the Linux kernel, the following vulnerability has been resolved: dccp: fix dccp_v4_err()/dccp_v6_err() again dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the ICMP messages are big en…

  • Unscored —

    net: bridge: use DEV_STATS_INC()

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_I…

  • Unscored —
    CVE-2023-52579 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    net/core: Fix ETH_P_1588 flow dissector

    In the Linux kernel, the following vulnerability has been resolved: net/core: Fix ETH_P_1588 flow dissector When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is w…

  • Unscored —

    netfs: Only call folio_start_fscache() one time for each folio

    In the Linux kernel, the following vulnerability has been resolved: netfs: Only call folio_start_fscache() one time for each folio If a network filesystem using netfs implements a clamp_length() function, it can set subrequest lengths smaller than a page size…

Revision history

  1. #126

    Neue Updates von Dell aufgenommen

  2. #125

    Neue Updates von SUSE aufgenommen

  3. #124

    Neue Updates von SUSE aufgenommen

  4. #123

    Neue Updates von SUSE aufgenommen

  5. #122

    Neue Updates von Ubuntu aufgenommen

  6. #121

    Neue Updates von Ubuntu aufgenommen

  7. #120

    Neue Updates von NetApp aufgenommen

  8. #119

    Neue Updates von Ubuntu aufgenommen

  9. #118

    Neue Updates von Ubuntu aufgenommen

  10. #117

    Neue Updates von Amazon aufgenommen

  11. #116

    Neue Updates von Debian aufgenommen

  12. #115

    Neue Updates von IBM aufgenommen

  13. #114

    Neue Updates von Dell aufgenommen

  14. #113

    Neue Updates von Amazon aufgenommen

  15. #112

    Neue Updates von Oracle Linux aufgenommen

  16. #111

    Neue Updates von Ubuntu aufgenommen

  17. #110

    Neue Updates von Ubuntu aufgenommen

  18. #109

    Neue Updates von Ubuntu aufgenommen

  19. #108

    Neue Updates von Ubuntu aufgenommen

  20. #107

    Neue Updates von Oracle Linux aufgenommen

  21. #106

    Neue Updates von Red Hat aufgenommen

  22. #105

    Neue Updates von Oracle Linux aufgenommen

  23. #104

    Neue Updates von Amazon aufgenommen

  24. #103

    Neue Updates von SUSE aufgenommen

  25. #102

    Neue Updates von Amazon aufgenommen

References