Skip to content
OpenAdvisories

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder weitere unspezifische Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 63

  • Critical 10.0

    bnxt_en: Fix double DMA unmapping for XDP_REDIRECT

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT Remove the dma_unmap_page_attrs() call in the driver's XDP_REDIRECT code path. This should have been removed when we let the page pool handl…

  • Critical 9.8

    net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possib…

  • Critical 9.8

    ipv6: prevent possible UAF in ip6_xmit()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a…

  • Critical 9.8

    atm: idt77252: prevent use after free in dequeue_rx()

    In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeue_rx() We can't dereference "skb" after calling vcc->push() because the skb is released.

  • High 8.8

    net: dsa: mv88e6xxx: Fix out-of-bound access

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix out-of-bound access If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array).

  • High 8.8

    iommu: Restore lost return in iommu_report_device_fault()

    In the Linux kernel, the following vulnerability has been resolved: iommu: Restore lost return in iommu_report_device_fault() When iommu_report_device_fault gets called with a partial fault it is supposed to collect the fault into the group and then return. I…

  • High 8.1

    mm, slub: do not call do_slab_free for kfence object

    In the Linux kernel, the following vulnerability has been resolved: mm, slub: do not call do_slab_free for kfence object In 782f8906f805 the freeing of kfence objects was moved from deep inside do_slab_free to the wrapper functions outside. This is a nice cha…

  • High 8.1

    ipv6: fix possible UAF in ip6_finish_output2()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to mak…

  • High 7.8
    CVE-2024-44946 Public exploit

    kcm: Serialise kcm_sendmsg() for the same socket.

    In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcm_sendmsg() for the same socket. syzkaller reported UAF in kcm_release(). [0] The scenario is 1. Thread A builds a skb with MSG_MORE and sets kcm->seq_skb. 2. Thread A resume…

  • High 7.8

    parisc: fix a possible DMA corruption

    In the Linux kernel, the following vulnerability has been resolved: parisc: fix a possible DMA corruption ARCH_DMA_MINALIGN was defined as 16 - this is too small - it may be possible that two unrelated 16-byte allocations share a cache line. If one of these a…

  • High 7.8

    serial: sc16is7xx: fix TX fifo corruption

    In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix TX fifo corruption Sometimes, when a packet is received on channel A at almost the same time as a packet is about to be transmitted on channel B, we observe with a logi…

  • High 7.8

    ALSA: line6: Fix racy access to midibuf

    In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warn…

  • High 7.8

    tracefs: Use generic inode RCU for synchronizing freeing

    In the Linux kernel, the following vulnerability has been resolved: tracefs: Use generic inode RCU for synchronizing freeing With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-onc…

  • High 7.8

    binfmt_flat: Fix corruption when not offsetting data start

    In the Linux kernel, the following vulnerability has been resolved: binfmt_flat: Fix corruption when not offsetting data start Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") introduced a RISC-V specific variant of the FLAT format which d…

  • High 7.8

    drm/mgag200: Bind I2C lifetime to DRM device

    In the Linux kernel, the following vulnerability has been resolved: drm/mgag200: Bind I2C lifetime to DRM device Managed cleanup with devm_add_action_or_reset() will release the I2C adapter when the underlying Linux device goes away. But the connector still r…

  • High 7.8

    mptcp: pm: avoid possible UaF when selecting endp

    In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a …

  • High 7.8

    drm/xe: Free job before xe_exec_queue_put

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Free job before xe_exec_queue_put Free job depends on job->vm being valid, the last xe_exec_queue_put can destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put. (cherry …

  • High 7.8

    ipv6: prevent UAF in ip6_send_skb()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A …

  • High 7.8

    net: hns3: fix a deadlock problem when config TC during resetting

    In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix a deadlock problem when config TC during resetting When config TC during the reset process, may cause a deadlock, the flow is as below: pf reset start │ ▼ ...... setup tc │ │ ▼…

  • High 7.8

    net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()

    In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kern…

  • High 7.8

    fs/netfs/fscache_cookie: add missing "n_accesses" check

    In the Linux kernel, the following vulnerability has been resolved: fs/netfs/fscache_cookie: add missing "n_accesses" check This fixes a NULL pointer dereference bug due to a data race which looks like this: BUG: kernel NULL pointer dereference, address: 0000…

  • High 7.5

    smb/client: avoid possible NULL dereference in cifs_free_subrequest()

    In the Linux kernel, the following vulnerability has been resolved: smb/client: avoid possible NULL dereference in cifs_free_subrequest() Clang static checker (scan-build) warning: cifsglob.h:line 890, column 3 Access to field 'ops' results in a dereference o…

  • High 7.5

    net: mana: Fix RX buf alloc_size alignment and atomic op panic

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix RX buf alloc_size alignment and atomic op panic The MANA driver's RX buffer alloc_size is passed into napi_build_skb() to create SKB. skb_shinfo(skb) is located at the end of s…

  • High 7.1

    serial: sc16is7xx: fix invalid FIFO access with special register set

    In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix invalid FIFO access with special register set When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ h…

  • Unscored —
    CVE-2024-44947 Public exploit

    fuse: Initialize beyond-EOF page contents before setting uptodate

    In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page c…

  • Unscored —

    x86/mtrr: Check if fixed MTRRs exist before saving them

    In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed varian…

  • Unscored —
    CVE-2024-44952 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    scsi: ufs: core: Fix deadlock during RTC update

    In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix deadlock during RTC update There is a deadlock when runtime suspend waits for the flush of RTC work, and the RTC work calls ufshcd_rpm_get_sync() to wait for runtime resu…

  • Unscored —
    CVE-2024-44955 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    drm/xe/preempt_fence: enlarge the fence critical section

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/preempt_fence: enlarge the fence critical section It is really easy to introduce subtle deadlocks in preempt_fence_work_func() since we operate on single global ordered-wq for signalli…

  • Unscored —

    xen: privcmd: Switch from mutex to spinlock for irqfds

    In the Linux kernel, the following vulnerability has been resolved: xen: privcmd: Switch from mutex to spinlock for irqfds irqfd_wakeup() gets EPOLLHUP, when it is called by eventfd_release() by way of wake_up_poll(&ctx->wqh, EPOLLHUP), which gets called unde…

  • Unscored —

    sched/smt: Fix unbalance sched_smt_present dec/inc

    In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fix unbalance sched_smt_present dec/inc I got the following warn report while doing stress test: jump label: negative count! WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 stat…

  • Unscored —

    usb: gadget: core: Check for unset descriptor

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget do…

  • Unscored —

    drm/amdgpu: Forward soft recovery errors to userspace

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Forward soft recovery errors to userspace As we discussed before[1], soft recovery should be forwarded to userspace, or we can get into a really bad state where apps will keep sub…

  • Unscored —

    Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at …

  • Unscored —

    btrfs: do not BUG_ON() when freeing tree block after error

    In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() when freeing tree block after error When freeing a tree block, at btrfs_free_tree_block(), if we fail to create a delayed reference we don't deal with the error and jus…

  • Unscored —

    idpf: fix memory leaks and crashes while performing a soft reset

    In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leaks and crashes while performing a soft reset The second tagged commit introduced a UAF, as it removed restoring q_vector->vport pointers after reinitializating the structu…

  • Unscored —

    x86/mm: Fix pti_clone_pgtable() alignment assumption

    In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #…

  • Unscored —

    tick/broadcast: Move per CPU pointer access into the atomic section

    In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for making the take over of the broadcast timer more reliable retrieves a per CPU pointer in preemptible con…

  • Unscored —

    s390/sclp: Prevent release of buffer in I/O

    In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Prevent release of buffer in I/O When a task waiting for completion of a Store Data operation is interrupted, an attempt is made to halt this operation. If this attempt fails due t…

  • Unscored —

    net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devic…

  • Unscored —
    CVE-2024-44972 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    cgroup/cpuset: fix panic caused by partcmd_update

    In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: fix panic caused by partcmd_update We find a bug as below: BUG: unable to handle page fault for address: 00000003 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 358 …

  • Unscored —

    ata: pata_macio: Fix DMA table overflow

    In the Linux kernel, the following vulnerability has been resolved: ata: pata_macio: Fix DMA table overflow Kolbjørn and Jonáš reported that their 32-bit PowerMacs were crashing in pata-macio since commit 09fe2bfa6b83 ("ata: pata_macio: Fix max_segment_size w…

  • Unscored —

    drm/amdgpu: Validate TA binary size

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. (cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442)

  • Unscored —

    drm/xe: Fix missing workqueue destroy in xe_gt_pagefault

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix missing workqueue destroy in xe_gt_pagefault On driver reload we never free up the memory for the pagefault and access counter workqueues. Add those destroy calls here. (cherry pi…

  • Unscored —

    drm/xe: Fix opregion leak

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix opregion leak Being part o the display, ideally the setup and cleanup would be done by display itself. However this is a bigger refactor that needs to be done on both i915 and xe.…

  • Unscored —

    workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask()

    In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() UBSAN reports the following 'subtraction overflow' error when booting in a virtual machine on Android: | Internal error: …

  • Unscored —

    drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails

    In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM o…

  • Unscored —

    netfilter: flowtable: validate vlan header

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header Ensure there is sufficient room to access the protocol field of the VLAN header, validate it once before the flowtable lookup. =====================…

  • Unscored —

    bonding: fix xfrm real_dev null pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null pointer dereference We shouldn't set real_dev to NULL because packets can be in transit and xfrm might call xdo_dev_offload_ok() in parallel. All callbacks ass…

  • Unscored —

    bonding: fix null pointer deref in bond_ipsec_offload_ok

    In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in bond_ipsec_offload_ok We must check if there is an active slave before dereferencing the pointer.

  • Unscored —

    tcp: prevent concurrent execution of tcp_sk_exit_batch

    In the Linux kernel, the following vulnerability has been resolved: tcp: prevent concurrent execution of tcp_sk_exit_batch Its possible that two threads call tcp_sk_exit_batch() concurrently, once from the cleanup_net workqueue, once from a task that failed t…

  • Unscored —

    drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()`

    In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()` When enabling UBSAN on Raspberry Pi 5, we get the following warning: [ 387.894977] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/v…

  • Unscored —

    vsock: fix recursive ->recvmsg calls

    In the Linux kernel, the following vulnerability has been resolved: vsock: fix recursive ->recvmsg calls After a vsock socket has been added to a BPF sockmap, its prot->recvmsg has been replaced with vsock_bpf_recvmsg(). Thus the following recursiion could ha…

  • Unscored —

    gtp: pull network headers in gtp_dev_xmit()

    In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtp_dev_xmit() syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing f…

  • Unscored —

    rtla/osnoise: Prevent NULL dereference in error handling

    In the Linux kernel, the following vulnerability has been resolved: rtla/osnoise: Prevent NULL dereference in error handling If the "tool->data" allocation fails then there is no need to call osnoise_free_top() and, in fact, doing so will lead to a NULL deref…

  • Unscored —

    vfs: Don't evict inode under the inode lru traversing context

    In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at f…

  • Unscored —

    KEYS: trusted: dcp: fix leak of blob encryption key

    In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on load, but keep the sealed payload in the blob field so that every subsequent read (export) will simply …

  • Unscored —

    KVM: s390: fix validity interception issue when gisa is switched off

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix validity interception issue when gisa is switched off We might run into a SIE validity if gisa has been disabled either via using kernel parameter "kvm.use_gisa=0" or by settin…

  • Unscored —

    xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration

    In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-sp…

  • Unscored —

    char: xillybus: Don't destroy workqueue from work item running on it

    In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Don't destroy workqueue from work item running on it Triggered by a kref decrement, destroy_workqueue() may be called from within a work item for destroying its own workqueue.…

  • Unscored —

    Input: MT - limit max slots

    In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible…

Revision history

  1. #98

    Neue Updates von SUSE aufgenommen

  2. #97

    Neue Updates von SUSE aufgenommen

  3. #96

    Neue Updates von SUSE aufgenommen

  4. #95

    Neue Updates von SUSE aufgenommen

  5. #94

    Neue Updates von SUSE aufgenommen

  6. #93

    Neue Updates von SUSE aufgenommen

  7. #92

    Neue Updates von SUSE aufgenommen

  8. #91

    Neue Updates von SUSE aufgenommen

  9. #90

    Neue Updates von SUSE aufgenommen

  10. #89

    Neue Updates von Dell aufgenommen

  11. #88

    Neue Updates von Oracle Linux aufgenommen

  12. #87

    Neue Updates von SUSE aufgenommen

  13. #86

    Neue Updates von SUSE aufgenommen

  14. #85

    Neue Updates von SUSE aufgenommen

  15. #84

    Neue Updates von SUSE aufgenommen

  16. #83

    Neue Updates von SUSE aufgenommen

  17. #82

    Neue Updates von SUSE aufgenommen

  18. #81

    Neue Updates von Oracle Linux aufgenommen

  19. #80

    Neue Updates von Oracle Linux aufgenommen

  20. #79

    Neue Updates von SUSE aufgenommen

  21. #78

    Neue Updates von SUSE aufgenommen

  22. #77

    Neue Updates von Ubuntu aufgenommen

  23. #76

    Neue Updates von Oracle Linux aufgenommen

  24. #75

    Neue Updates von Red Hat und Ubuntu aufgenommen

  25. #74

    Neue Updates von Ubuntu aufgenommen

References