Summary
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuführen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 100
-
Critical 9.8
tcp: do not accept ACK of bytes we never sent
In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 g…
-
Critical 9.8
keys: Fix overwrite of key expiration on instantiation
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for…
-
Critical 9.8CVE-2024-36886 Public exploit
tipc: fix UAF in error path
In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list…
-
Critical 9.8
hv_netvsc: Don't free decrypted memory
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and t…
-
Critical 9.8
NFSD: Fix nfsd4_encode_fattr4() crasher
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().
-
Critical 9.6
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an erro…
-
Critical 9.3
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail s…
-
Critical 9.3
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an…
-
Critical 9.1
USB: core: Fix access violation during port device removal
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that t…
-
High 8.8
wifi: iwlwifi: mvm: guard against invalid STA ID on removal
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: guard against invalid STA ID on removal Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would result in out-of-bounds array accesses. This prevents issu…
-
High 8.8
wifi: iwlwifi: read txq->read_ptr under lock
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but…
-
High 8.4
uio_hv_generic: Don't free decrypted memory
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned …
-
High 8.1
Bluetooth: qca: fix info leak when fetching fw build id
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case t…
-
High 7.8
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with…
-
High 7.8
nouveau/uvmm: fix addr/range calcs for remap operations
In the Linux kernel, the following vulnerability has been resolved: nouveau/uvmm: fix addr/range calcs for remap operations dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 was causing a remap operation like the below. op_remap: prev: 0000003fffe…
-
High 7.8
regmap: maple: Fix cache corruption in regcache_maple_drop()
In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the b…
-
High 7.8
i40e: fix vf may be used uninitialized in this function warning
In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with re…
-
High 7.8
Bluetooth: qca: add missing firmware sanity checks
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: add missing firmware sanity checks Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vm…
-
High 7.8
net: fix out-of-bounds access in ops_init
In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is …
-
High 7.8
iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault() This was missed because of the function pointer indirection. nvidia_smmu_context_fault() is also installed as a irq functio…
-
High 7.8
mm/slab: make __free(kfree) accept error pointers
In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(…
-
High 7.8
usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests submitted to the UDC. Th…
-
High 7.8
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid…
-
High 7.8
drm/amd/display: Skip on writeback when it's not applicable
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip on writeback when it's not applicable [WHY] dynamic memory safety error detector (KASAN) catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as writeba…
-
High 7.8
bpf: Check bloom filter map value size
In the Linux kernel, the following vulnerability has been resolved: bpf: Check bloom filter map value size This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map…
-
High 7.8
s390/qeth: Fix kernel panic after setting hsuid
In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Fix kernel panic after setting hsuid Symptom: When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, th…
-
High 7.8
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
In the Linux kernel, the following vulnerability has been resolved: nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO_NET_HDR_GSO_UDP layer…
-
High 7.8
pinctrl: core: delete incorrect free in pinctrl_enable()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_…
-
High 7.7
ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() The documentation for device_get_named_child_node() mentions this important point: " The caller is responsible for callin…
-
High 7.5
net: core: reject skb_copy(_expand) for fraglist GSO skbs
In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_…
-
High 7.5
net/smc: fix neighbour and rtable leak in smc_ib_find_route()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix neighbour and rtable leak in smc_ib_find_route() In smc_ib_find_route(), the neighbour found by neigh_lookup() and rtable resolved by ip_route_output_flow() are not released or p…
-
High 7.3
fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan make_uffd_wp_pte() was previously doing: pte = ptep_get(ptep); ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_…
-
High 7.1
btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer Btrfs clears the content of an extent buffer marked as EXTENT_BUFFER_ZONED_ZEROOUT before the bio submission. This mechanism is in…
-
High 7.1
octeontx2-af: fix the double free in rvu_npc_freemem()
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix the double free in rvu_npc_freemem() Clang static checker(scan-build) warning： drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column 2 Attempt to free releas…
-
High 7.1
gpiolib: cdev: fix uninitialised kfifo
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix uninitialised kfifo If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection the…
-
High 7.1
blk-iocost: do not WARN if iocg was already offlined
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: do not WARN if iocg was already offlined In iocg_pay_debt(), warn is triggered if 'active_list' is empty, which is intended to confirm iocg is active when it has debt. However, wa…
-
High 7.1
nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies syzbot reported unsafe calls to copy_from_sockptr() [1] Use copy_safe_from_sockptr() instead. [1] BUG: KASAN: slab-out-of-bounds in copy_fro…
-
Medium 6.5
blk-iocost: avoid out of bounds shift
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: avoid out of bounds shift UBSAN catches undefined behavior in blk-iocost, where sometimes iocg->delay is shifted right by a number that is too large, resulting in undefined behavi…
-
Medium 6.2
workqueue: Fix selection of wake_cpu in kick_pool()
In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix selection of wake_cpu in kick_pool() With cpu_possible_mask=0-63 and cpu_online_mask=0-7 the following kernel oops was observed: smp: Bringing up secondary CPUs ... smp: Brough…
-
Medium 6.2
powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE At the time of LPAR boot up, partition firmware provides Open Firmware property ibm,dma-window for the PE. This property is …
-
Medium 5.5
mm/userfaultfd: reset ptes when close() for wr-protected ones
In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close() for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an …
-
Medium 5.5
drm/amd/display: Atom Integrated System Info v2_2 for DCN35
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atom Integrated System Info v2_2 for DCN35 New request from KMD/VBIOS in order to support new UMA carveout model. This fixes a null dereference from accessing Ctx->dc_bios->i…
-
Medium 5.5
wifi: nl80211: don't free NULL coalescing rule
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here.
-
Medium 5.5
Reapply "drm/qxl: simplify qxl_fence_wait"
In the Linux kernel, the following vulnerability has been resolved: Reapply "drm/qxl: simplify qxl_fence_wait" This reverts commit 07ed11afb68d94eadd4ffc082b97c2331307c5ea. Stephen Rostedt reports: "I went to run my tests on my VMs and the tests hung on boot …
-
Medium 5.3
qibfs: fix dentry leak
In the Linux kernel, the following vulnerability has been resolved: qibfs: fix dentry leak simple_recursive_removal() drops the pinning references to all positives in subtree. For the cases when its argument has been kept alive by the pinning alone that's exa…
-
Medium 4.4
firewire: ohci: mask bus reset interrupts between ISR and bottom half
In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_…
-
Medium 4.4
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not b…
-
Unscored —
clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. …
-
Unscored —
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute nee…
-
Unscored —
net: hns3: fix kernel crash when devlink reload during pf initialization
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during pf initialization The devlink reload process will access the hardware resources, but the register operation is done before the hardware …
-
Unscored —CVE-2024-36022 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
Julia Lawall reported this null pointer dereference, this should fix it.
In the Linux kernel, the following vulnerability has been resolved: Julia Lawall reported this null pointer dereference, this should fix it.
-
Unscored —
drm/amd/display: Disable idle reallow as part of command/gpint execution
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Disable idle reallow as part of command/gpint execution [Why] Workaroud for a race condition where DMCUB is in the process of committing to IPS1 during the handshake causing …
-
Unscored —
scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is allocated earlier in this function and it has app_req.num_ports elements. Thus this > comparison needs …
-
Unscored —
drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 While doing multiple S4 stress tests, GC/RLC/PMFW get into an invalid state resulting into hard hangs. Adding a GFX reset as workaroun…
-
Unscored —
mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() When I did memory failure tests recently, below warning occurs: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 8 PID: 1011 at k…
-
Unscored —
mmc: sdhci-msm: pervent access to suspended controller
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci code registers LED device and uses host->runtime_suspended flag to protect access to it. The sdhci-msm driver doesn't set …
-
Unscored —
Bluetooth: qca: fix info leak when fetching board id
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching board id Add the missing sanity check when fetching the board id to avoid leaking slab data when later requesting the firmware.
-
Unscored —
mm: use memalloc_nofs_save() in page_cache_ra_order()
In the Linux kernel, the following vulnerability has been resolved: mm: use memalloc_nofs_save() in page_cache_ra_order() See commit f2c817bed58d ("mm: use memalloc_nofs_save in readahead path"), ensure that page_cache_ra_order() do not attempt to reclaim fil…
-
Unscored —CVE-2024-36885 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
e1000e: change usleep_range to udelay in PHY mdic access
In the Linux kernel, the following vulnerability has been resolved: e1000e: change usleep_range to udelay in PHY mdic access This is a partial revert of commit 6dbdd4de0362 ("e1000e: Workaround for sporadic MDI error on Meteor Lake systems"). The referenced c…
-
Unscored —
mptcp: ensure snd_nxt is properly initialized on connect
In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_nxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snd_una: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b…
-
Unscored —
maple_tree: fix mas_empty_area_rev() null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix mas_empty_area_rev() null pointer dereference Currently the code calls mas_start() followed by mas_data_end() if the maple state is MA_START, but mas_start() may return with t…
-
Unscored —
mm/slub: avoid zeroing outside-object freepointer for single free
In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid zeroing outside-object freepointer for single free Commit 284f17ac13fe ("mm/slub: handle bulk and single object freeing separately") splits single and bulk object freeing in tw…
-
Unscored —
usb: typec: tcpm: Check for port partner validity before consuming it
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Check for port partner validity before consuming it typec_register_partner() does not guarantee partner registration to always succeed. In the event of failure, port->partne…
-
Unscored —
usb: gadget: uvc: use correct buffer size when parsing configfs lists
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: use correct buffer size when parsing configfs lists This commit fixes uvc gadget support on 32-bit platforms. Commit 0df28607c5cb ("usb: gadget: uvc: Generalise helper funct…
-
Unscored —
gpiolib: cdev: Fix use after free in lineinfo_changed_notify
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watc…
-
Unscored —
net: hns3: fix kernel crash when devlink reload during initialization
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during initialization The devlink reload process will access the hardware resources, but the register operation is done before the hardware is …
-
Unscored —
ipv6: prevent NULL dereference in ip6_output()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent NULL dereference in ip6_output() According to syzbot, there is a chance that ip6_dst_idev() returns NULL in ip6_output(). Most places in IPv6 stack deal with a NULL idev just fi…
-
Unscored —
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() syzbot is able to trigger the following crash [1], caused by unsafe ip6_dst_idev() use. Indeed ip6_dst_idev() can retur…
-
Unscored —
ipv6: Fix potential uninit-value access in __ip6_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in __ip6_make_skb() As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on f…
-
Unscored —
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1],…
-
Unscored —
ARM: 9381/1: kasan: clear stale stack poison
In the Linux kernel, the following vulnerability has been resolved: ARM: 9381/1: kasan: clear stale stack poison We found below OOB crash: [ 33.452494] ================================================================== [ 33.453513] BUG: KASAN: stack-out-of-bo…
-
Unscored —CVE-2024-36907 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
block: fix overflow in blk_ioctl_discard()
In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in blk_ioctl_discard() There is no check for overflow of 'start + len' in blk_ioctl_discard(). Hung task occurs if submit an discard ioctl with the following param: start …
-
Unscored —
scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources ar…
-
Unscored —
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING When the "storcli2 show" command is executed for eHBA-9600, mpi3mr driver prints this WARNING message: memcpy: detected field-spanning …
-
Unscored —CVE-2024-36923 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be c…
-
Unscored —
swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
In the Linux kernel, the following vulnerability has been resolved: swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y Using restricted DMA pools (CONFIG_DMA_RESTRICTED_POOL=y) in conjunction with dynamic SWIOTLB (CONFIG_SWIOTLB_DYNAMIC=y) l…
-
Unscored —
ipv4: Fix uninit-value access in __ip_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in __ip_make_skb() KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can …
-
Unscored —
spi: fix null pointer dereference within spi_sync
In the Linux kernel, the following vulnerability has been resolved: spi: fix null pointer dereference within spi_sync If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set w…
-
Unscored —
s390/cio: Ensure the copied buf is NUL terminated
In the Linux kernel, the following vulnerability has been resolved: s390/cio: Ensure the copied buf is NUL terminated Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don'…
-
Unscored —
thermal/debugfs: Prevent use-after-free from occurring after cdev removal
In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Prevent use-after-free from occurring after cdev removal Since thermal_debug_cdev_remove() does not run under cdev->lock, it can run in parallel with thermal_debug_cdev_state…
-
Unscored —
bna: ensure the copied buf is NUL terminated
In the Linux kernel, the following vulnerability has been resolved: bna: ensure the copied buf is NUL terminated Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don'…
-
Unscored —
ice: ensure the copied buf is NUL terminated
In the Linux kernel, the following vulnerability has been resolved: ice: ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count bytes from userspace to that buffer. Later, we use sscanf on this buffer but we …
-
Unscored —
efi/unaccepted: touch soft lockup during memory accept
In the Linux kernel, the following vulnerability has been resolved: efi/unaccepted: touch soft lockup during memory accept Commit 50e782a86c98 ("efi/unaccepted: Fix soft lockups caused by parallel memory acceptance") has released the spinlock so other CPUs ca…
-
Unscored —
xdp: use flags field to disambiguate broadcast redirect
In the Linux kernel, the following vulnerability has been resolved: xdp: use flags field to disambiguate broadcast redirect When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redir…
-
Unscored —
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in …
-
Unscored —
nfs: Handle error of rpc_proc_register() in nfs_net_init().
In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_register() in nfs_net_init(). syzkaller reported a warning [0] triggered while destroying immature netns. rpc_proc_register() was called in init_nfs_fs(), but it…
-
Unscored —CVE-2024-36942 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
phonet: fix rtm_phonet_notify() skb allocation
In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() skb allocation fill_route() stores three components in the skb: - struct rtmsg - RTA_DST (u8) - RTA_OIF (u32) Therefore, rtm_phonet_notify() should use NLMSG_A…
-
Unscored —
drm/xe/xe_migrate: Cast to output precision before multiplying operands
In the Linux kernel, the following vulnerability has been resolved: drm/xe/xe_migrate: Cast to output precision before multiplying operands Addressing potential overflow in result of multiplication of two lower precision (u32) operands before widening it to h…
-
Unscored —
amd/amdkfd: sync all devices to wait all processes being evicted
In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: sync all devices to wait all processes being evicted If there are more than one device doing reset in parallel, the first device will call kfd_suspend_all_processes() to evict all…
-
Unscored —
drm/amdkfd: range check cp bad op exception interrupts
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: range check cp bad op exception interrupts Due to a CP interrupt bug, bad packet garbage exception codes are raised. Do a range check so that the debugger and runtime do not recei…
-
Unscored —
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This…
-
Unscored —
tipc: fix a possible memleak in tipc_buf_append
In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err pa…
-
Unscored —
thermal/debugfs: Free all thermal zone debug memory on zone removal
In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Free all thermal zone debug memory on zone removal Because thermal_debug_tz_remove() does not free all memory allocated for thermal zone diagnostics, some of that memory beco…
-
Unscored —
octeontx2-af: avoid off-by-one read from userspace
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count byt…
-
Unscored —
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() incl…
Revision history
-
#202
Neue Updates von BROCADE aufgenommen
-
#201
Neue Updates von Ubuntu aufgenommen
-
#200
Neue Updates von Dell aufgenommen
-
#199
Neue Updates von Ubuntu aufgenommen
-
#198
Neue Updates von Ubuntu aufgenommen
-
#197
Neue Updates von Ubuntu aufgenommen
-
#196
Neue Updates von Ubuntu aufgenommen
-
#195
Neue Updates von Ubuntu aufgenommen
-
#194
Neue Updates von Ubuntu aufgenommen
-
#193
Neue Updates von Ubuntu aufgenommen
-
#192
Neue Updates von Ubuntu aufgenommen
-
#191
Neue Updates von Siemens aufgenommen
-
#190
Neue Updates von Debian aufgenommen
-
#189
Neue Updates von Oracle Linux aufgenommen
-
#188
Neue Updates von Ubuntu aufgenommen
-
#187
Neue Updates von Ubuntu aufgenommen
-
#186
Neue Updates von Ubuntu aufgenommen
-
#185
Neue Updates von Ubuntu aufgenommen
-
#184
Neue Updates von Oracle Linux aufgenommen
-
#183
Neue Updates von Ubuntu aufgenommen
-
#182
Neue Updates von Ubuntu aufgenommen
-
#181
Neue Updates von Ubuntu aufgenommen
-
#180
Neue Updates von Oracle Linux aufgenommen
-
#179
Neue Updates von SUSE aufgenommen
-
#178
Neue Updates von SUSE aufgenommen
References
-
SUSE Security Update SUSE-SU-2024:4227-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/R6NJTIPCJBC7ULVGL3ST3ZEMPJQ6UE7K/
-
SUSE Security Update SUSE-SU-2024:4235-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LIMMCWFWYJUMJTABZZ7ZEYXOOVE5BZY7/
-
SUSE Security Update SUSE-SU-2024:4242-1 vom 2024-12-06
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019958.html
-
SUSE Security Update SUSE-SU-2024:4236-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ODASOBSBN3UUGHNO44MK2K4MC35CPLXJ/
-
SUSE Security Update SUSE-SU-2024:4243-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GDL3TRRFKGYVQIW7MMTUJS76GCW7B3JZ/
-
SUSE Security Update SUSE-SU-2024:4234-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/B6RMLGICBLD3BNXSBS7J23W3GCEJMFJA/
-
SUSE Security Update SUSE-SU-2024:4230-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DMN7SCFOSTXIR74OFGMHOJLOSHZOF3RH/
-
SUSE Security Update SUSE-SU-2024:4241-1 vom 2024-12-06
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019959.html
-
SUSE Security Update SUSE-SU-2024:4228-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SUCQUP757AUWMZNCNQ2DGQICEYBRZUIC/
-
SUSE Security Update SUSE-SU-2024:4231-1 vom 2024-12-06
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019946.html
-
SUSE Security Update SUSE-SU-2024:4256-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/34BVCDIDBQSXQ6Y3TVDGD4FSZ7N3D3LI/
-
SUSE Security Update SUSE-SU-2024:4246-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3LFFLGXO55CBY4WD74GYLL6CL2HWJM2Q/
-
SUSE Security Update SUSE-SU-2024:4250-1 vom 2024-12-06
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019952.html
-
Ubuntu Security Notice USN-7159-1 vom 2024-12-12
https://ubuntu.com/security/notices/USN-7159-1
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-17
https://ubuntu.com/security/notices/USN-7159-2
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7166-2
-
SUSE Security Update SUSE-SU-2024:4367-1 vom 2024-12-17
https://lists.suse.com/pipermail/sle-security-updates/2024-December/020025.html
-
SUSE Security Update SUSE-SU-2024:4364-1 vom 2024-12-17
https://lists.suse.com/pipermail/sle-security-updates/2024-December/020019.html
-
Ubuntu Security Notice USN-7166-1 vom 2024-12-17
https://ubuntu.com/security/notices/USN-7166-1
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7159-3
-
Ubuntu Security Notice USN-7173-1 vom 2024-12-17
https://ubuntu.com/security/notices/USN-7173-1
-
Debian Security Advisory DLA-4008 vom 2025-01-03
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
-
IBM Security Bulletin 7180361 vom 2025-01-07
https://www.ibm.com/support/pages/node/7180361
-
SUSE Security Update SUSE-SU-2024:4266-1 vom 2024-12-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RRJRAM3LFR4MNOHCFB2XIOS6OJUDNUPE/
-
SUSE Security Update SUSE-SU-2024:4265-1 vom 2024-12-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LFH2MVQS6KSRYDULB5KJQ5L72KPQCO6L/
-
SUSE Security Update SUSE-SU-2024:4263-1 vom 2024-12-09
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019971.html
-
SUSE Security Update SUSE-SU-2024:4264-1 vom 2024-12-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SZPUHL7SUZ57L3OJFO25IHYVDJ76ONGC/
-
SUSE Security Update SUSE-SU-2024:4314-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SARXL66CQHD5VSFG5PUBNBVBPVFUN4KT/
-
SUSE Security Update SUSE-SU-2024:4316-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/S4I5Z6ALCJLHTP25U3HMJHEXN4DR2USM/
-
SUSE Security Update SUSE-SU-2024:4318-1 vom 2024-12-13
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019999.html
-
SUSE Security Update SUSE-SU-2024:4315-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LQPWDP54GSTHYCV4CTCOE67D2ANVPPUW/
-
Ubuntu Security Notice USN-7186-2 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7186-2
-
Ubuntu Security Notice USN-7194-1 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7194-1
-
Ubuntu Security Notice USN-7185-2 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7185-2
-
Ubuntu Security Notice USN-7195-1 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7195-1
-
Ubuntu Security Notice USN-7159-4 vom 2024-12-20
https://ubuntu.com/security/notices/USN-7159-4
-
Ubuntu Security Notice USN-7173-2 vom 2024-12-20
https://ubuntu.com/security/notices/USN-7173-2
-
Ubuntu Security Notice USN-7166-3 vom 2024-12-20
https://ubuntu.com/security/notices/USN-7166-3
-
Oracle Linux Security Advisory ELSA-2024-12887 vom 2024-12-18
https://linux.oracle.com/errata/ELSA-2024-12887.html
-
SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WFOJHFFEHK42VPQ6XLZWB77H5OEJ3FF4/
-
SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18
https://lists.suse.com/pipermail/sle-security-updates/2024-December/020028.html
-
SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WFOJHFFEHK42VPQ6XLZWB77H5OEJ3FF4/
-
Ubuntu Security Notice USN-7159-5 vom 2025-01-06
https://ubuntu.com/security/notices/USN-7159-5
-
Ubuntu Security Notice USN-7183-1 vom 2025-01-06
https://ubuntu.com/security/notices/USN-7183-1
-
Ubuntu Security Notice USN-7186-1 vom 2025-01-06
https://ubuntu.com/security/notices/USN-7186-1
-
Ubuntu Security Notice USN-7184-1 vom 2025-01-06
https://ubuntu.com/security/notices/USN-7184-1
-
Juniper Security Advisory JSA92874 vom 2024-01-09
https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-24-1R2-release
-
SUSE Security Update SUSE-SU-2025:0035-1 vom 2025-01-08
https://lists.suse.com/pipermail/sle-security-updates/2025-January/020070.html
-
SUSE Security Update SUSE-SU-2025:0034-1 vom 2025-01-08
https://lists.suse.com/pipermail/sle-security-updates/2025-January/020071.html
-
SUSE Security Update SUSE-SU-2024:4276-1 vom 2024-12-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OANRUYCXIPE5N4KSSYCB3BUCEHKCKHCH/
-
SUSE Security Update SUSE-SU-2024:4275-1 vom 2024-12-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YTZ2WGLML4Q6E3IG32UCJ6NFIDUTWN22/
-
SUSE Security Update SUSE-SU-2024:4275-1 vom 2024-12-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YTZ2WGLML4Q6E3IG32UCJ6NFIDUTWN22/
-
https://lore.kernel.org/linux-cve-announce/ vom 2024-05-30
https://lore.kernel.org/
-
Debian Security Advisory DSA-5703 vom 2024-06-02
https://lists.debian.org/debian-security-announce/2024/msg00113.html
-
SUSE Security Update SUSE-SU-2024:1979-1 vom 2024-06-11
https://lists.suse.com/pipermail/sle-security-updates/2024-June/018685.html
-
SUSE Security Update SUSE-SU-2024:1983-1 vom 2024-06-11
https://lists.suse.com/pipermail/sle-security-updates/2024-June/018700.html
-
Amazon Linux Security Advisory ALASKERNEL-5.15-2024-044 vom 2024-06-12
https://alas.aws.amazon.com/AL2/ALASKERNEL-5.15-2024-044.html
-
SUSE Security Update SUSE-SU-2024:2011-1 vom 2024-06-12
https://lists.suse.com/pipermail/sle-security-updates/2024-June/018710.html
-
SUSE Security Update SUSE-SU-2024:2008-1 vom 2024-06-12
https://lists.suse.com/pipermail/sle-security-updates/2024-June/018706.html
-
SUSE Security Update SUSE-SU-2024:2135-1 vom 2024-06-21
https://lists.suse.com/pipermail/sle-security-updates/2024-June/018783.html
-
Amazon Linux Security Advisory ALASKERNEL-5.10-2024-060 vom 2024-06-25
https://alas.aws.amazon.com/AL2/ALASKERNEL-5.10-2024-060.html
-
SUSE Security Update SUSE-SU-2024:2184-1 vom 2024-06-24
https://lists.suse.com/pipermail/sle-security-updates/2024-June/018807.html
-
SUSE Security Update SUSE-SU-2024:2189-1 vom 2024-06-25
https://lists.suse.com/pipermail/sle-security-updates/2024-June/018811.html
-
Debian Security Advisory DLA-3842 vom 2024-06-25
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
-
Red Hat Security Advisory RHSA-2024:4108 vom 2024-06-26
https://access.redhat.com/errata/RHSA-2024:4108
-
SUSE Security Update SUSE-SU-2024:2190-1 vom 2024-06-25
https://lists.suse.com/pipermail/sle-security-updates/2024-June/018819.html
-
Red Hat Security Advisory RHSA-2024:4106 vom 2024-06-26
https://access.redhat.com/errata/RHSA-2024:4106
-
Debian Security Advisory DLA-3843 vom 2024-06-27
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html
-
Debian Security Advisory DLA-3840 vom 2024-06-27
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
-
Amazon Linux Security Advisory ALAS-2024-643 vom 2024-07-02
https://alas.aws.amazon.com/AL2023/ALAS-2024-643.html
-
Red Hat Security Advisory RHSA-2024:4211 vom 2024-07-02
https://access.redhat.com/errata/RHSA-2024:4211
-
Red Hat Security Advisory RHSA-2024:4151 vom 2024-07-03
https://access.redhat.com/errata/RHSA-2024:4151
-
SUSE Security Update SUSE-SU-2024:2365-1 vom 2024-07-09
https://lists.suse.com/pipermail/sle-security-updates/2024-July/018897.html
-
SUSE Security Update SUSE-SU-2024:2360-1 vom 2024-07-09
https://lists.suse.com/pipermail/sle-security-updates/2024-July/018907.html
-
SUSE Security Update SUSE-SU-2024:2372-1 vom 2024-07-09
https://lists.suse.com/pipermail/sle-security-updates/2024-July/018901.html
-
SUSE Security Update SUSE-SU-2024:2362-1 vom 2024-07-09
https://lists.suse.com/pipermail/sle-security-updates/2024-July/018905.html
-
Red Hat Security Advisory RHSA-2024:4447 vom 2024-07-10
https://access.redhat.com/errata/RHSA-2024:4447
-
SUSE Security Update SUSE-SU-2024:2381-1 vom 2024-07-10
https://lists.suse.com/pipermail/sle-security-updates/2024-July/018916.html
-
SUSE Security Update SUSE-SU-2024:2394-1 vom 2024-07-10
https://lists.suse.com/pipermail/sle-security-updates/2024-July/018922.html
-
SUSE Security Update SUSE-SU-2024:2385-1 vom 2024-07-10
https://lists.suse.com/pipermail/sle-security-updates/2024-July/018920.html