Skip to content
OpenAdvisories

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 52

  • Critical 9.8

    nfsd: fix race between laundromat and free_stateid

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix race between laundromat and free_stateid There is a race between laundromat handling of revoked delegations and a client sending free_stateid operation. Laundromat thread finds that…

  • High 8.8

    firewire: core: fix invalid port index for parent device

    In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix invalid port index for parent device In a commit 24b7f8e5cd65 ("firewire: core: use helper functions for self ID sequence"), the enumeration over self ID sequence was refa…

  • High 8.4

    KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory

    In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Ignore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus V…

  • High 8.0

    Bluetooth: ISO: Fix UAF on iso_sock_timeout

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix UAF on iso_sock_timeout conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock so this checks if the conn->sk is still valid by checking if it part of iso…

  • High 8.0

    Bluetooth: SCO: Fix UAF on sco_sock_timeout

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_sock_timeout conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sco…

  • High 7.8

    bpf: support non-r10 register spill/fill to/from stack in precision tracking

    In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless…

  • High 7.8

    drm/xe/oa: Fix overflow in oa batch buffer

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix overflow in oa batch buffer By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch buffer, this is not a problem if batch buffer is only used once but oa reuses t…

  • High 7.8

    dm vdo: don't refer to dedupe_context after releasing it

    In the Linux kernel, the following vulnerability has been resolved: dm vdo: don't refer to dedupe_context after releasing it Clear the dedupe_context pointer in a data_vio whenever ownership of the context is lost, so that vdo can't examine it accidentally.

  • High 7.8

    iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices Previously, the domain_context_clear() function incorrectly called pci_for_each_dma_alias() to set up context entries fo…

  • High 7.8

    x86/lam: Disable ADDRESS_MASKING in most cases

    In the Linux kernel, the following vulnerability has been resolved: x86/lam: Disable ADDRESS_MASKING in most cases Linear Address Masking (LAM) has a weakness related to transient execution as described in the SLAM paper[1]. Unless Linear Address Space Separa…

  • High 7.8

    KVM: arm64: Unregister redistributor for failed vCPU creation

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unregister redistributor for failed vCPU creation Alex reports that syzkaller has managed to trigger a use-after-free when tearing down a VM: BUG: KASAN: slab-use-after-free in kv…

  • High 7.8

    nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net

    In the Linux kernel, the following vulnerability has been resolved: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net In the normal case, when we excute `echo 0 > /proc/fs/nfsd/threads`, the function `nfs4_state_destroy_net` in `nfs4_…

  • High 7.8

    net: sched: use RCU read-side critical section in taprio_dump()

    In the Linux kernel, the following vulnerability has been resolved: net: sched: use RCU read-side critical section in taprio_dump() Fix possible use-after-free in 'taprio_dump()' by adding RCU read-side critical section there. Never seen on x86 but found on a…

  • High 7.8

    net: sched: fix use-after-free in taprio_change()

    In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in taprio_change() In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section pro…

  • High 7.8

    net: wwan: fix global oob in wwan_rtnl_policy

    In the Linux kernel, the following vulnerability has been resolved: net: wwan: fix global oob in wwan_rtnl_policy The variable wwan_rtnl_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. Exactly…

  • High 7.8

    net: pse-pd: Fix out of bound for loop

    In the Linux kernel, the following vulnerability has been resolved: net: pse-pd: Fix out of bound for loop Adjust the loop limit to prevent out-of-bounds access when iterating over PI structures. The loop should not reach the index pcdev->nr_lines since we al…

  • High 7.8

    netfilter: bpf: must hold reference on net namespace

    In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpf_nf_l…

  • High 7.8

    tracing/probes: Fix MAX_TRACE_ARGS limit handling

    In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix MAX_TRACE_ARGS limit handling When creating a trace_probe we would set nr_args prior to truncating the arguments to MAX_TRACE_ARGS. However, we would only initialize argum…

  • High 7.5

    sfc: Don't invoke xdp_do_flush() from netpoll.

    In the Linux kernel, the following vulnerability has been resolved: sfc: Don't invoke xdp_do_flush() from netpoll. Yury reported a crash in the sfc driver originated from netpoll_send_udp(). The netconsole sends a message and then netpoll invokes the driver's…

  • High 7.5

    RDMA/mad: Improve handling of timed out WRs of mad agent

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Improve handling of timed out WRs of mad agent Current timeout handler of mad agent acquires/releases mad_agent_priv lock for every timed out WRs. This causes heavy locking contenti…

  • High 7.3

    nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error

    In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error The `nouveau_dmem_copy_one` function ensures that the copy push command is sent to the device firmware but does not track whe…

  • High 7.3

    arm64: probes: Remove broken LDR (literal) uprobe support

    In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR (literal) uprobe support The simulate_ldr_literal() and simulate_ldrsw_literal() functions are unsafe to use for uprobes. Both functions were originally writt…

  • High 7.3

    drm/amd: Guard against bad data for ATIF ACPI method

    In the Linux kernel, the following vulnerability has been resolved: drm/amd: Guard against bad data for ATIF ACPI method If a BIOS provides bad data in response to an ATIF method call this causes a NULL pointer dereference in the caller. ``` ? show_regs (arch…

  • High 7.3

    tracing: Consider the NULL character when validating the event length

    In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the b…

  • High 7.1

    bpf: Add the missing BPF_LINK_TYPE invocation for sockmap

    In the Linux kernel, the following vulnerability has been resolved: bpf: Add the missing BPF_LINK_TYPE invocation for sockmap There is an out-of-bounds read in bpf_link_show_fdinfo() for the sockmap link fd. Fix it by adding the missing BPF_LINK_TYPE invocati…

  • High 7.0

    cifs: fix warning when destroy 'cifs_io_request_pool'

    In the Linux kernel, the following vulnerability has been resolved: cifs: fix warning when destroy 'cifs_io_request_pool' There's a issue as follows: WARNING: CPU: 1 PID: 27826 at mm/slub.c:4698 free_large_kmalloc+0xac/0xe0 RIP: 0010:free_large_kmalloc+0xac/0…

  • Medium 5.5

    thermal: intel: int340x: processor: Fix warning during module unload

    In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int340x: processor: Fix warning during module unload The processor_thermal driver uses pcim_device_enable() to enable a PCI device, which means the device will be automaticall…

  • Medium 5.5

    net: fec: don't save PTP state if PTP is unsupported

    In the Linux kernel, the following vulnerability has been resolved: net: fec: don't save PTP state if PTP is unsupported Some platforms (such as i.MX25 and i.MX27) do not support PTP, so on these platforms fec_ptp_init() is not called and the related members …

  • Medium 5.5

    scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down

    In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down There is a history of deadlock if reboot is performed at the beginning of booting. SDEV_QUIESCE was set for all LU's scsi_devices by UF…

  • Medium 5.5

    USB: gadget: dummy-hcd: Fix "task hung" problem

    In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix "task hung" problem The syzbot fuzzer has been encountering "task hung" problems ever since the dummy-hcd driver was changed to use hrtimers instead of regular tim…

  • Medium 5.5

    x86: fix user address masking non-canonical speculation issue

    In the Linux kernel, the following vulnerability has been resolved: x86: fix user address masking non-canonical speculation issue It turns out that AMD has a "Meltdown Lite(tm)" issue with non-canonical accesses in kernel space. And so using just the high bit…

  • Medium 5.5

    ASoC: qcom: sdm845: add missing soundwire runtime stream alloc

    In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: sdm845: add missing soundwire runtime stream alloc During the migration of Soundwire runtime stream allocation from the Qualcomm Soundwire controller to SoC's soundcard drivers th…

  • Medium 5.5

    ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc

    In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc Commit 15c7fab0e047 ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards") moved the allocation of Soundwire stream r…

  • Medium 5.5

    platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses

    In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses Commit 50c6dbdfd16e ("x86/ioremap: Improve iounmap() address range checks") introduces a WARN when adrress ran…

  • Medium 5.5

    drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too Stuart Hayhurst has found that both at bootup and fullscreen VA-API video is leading to black screens for around 1 second and kernel W…

  • Medium 5.5

    md/raid10: fix null ptr dereference in raid10_size()

    In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null ptr dereference in raid10_size() In raid10_run() if raid10_set_queue_limits() succeed, the return value is set to zero, and if following procedures failed raid10_run() wil…

  • Medium 5.5

    xfrm: fix one more kernel-infoleak in algo dumping

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _copy_to_iter+0x598/0x2a3…

  • Medium 5.5

    LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context Unaligned access exception can be triggered in irq-enabled context such as user mode, in this case do_ale() may call get_use…

  • Medium 5.5

    nilfs2: fix kernel bug due to missing clearing of buffer delay flag

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of buffer delay flag Syzbot reported that after nilfs2 reads a corrupted file system image and degrades to read-only, the BUG_ON check for the b…

  • Medium 5.5

    btrfs: reject ro->rw reconfiguration if there are hard ro requirements

    In the Linux kernel, the following vulnerability has been resolved: btrfs: reject ro->rw reconfiguration if there are hard ro requirements [BUG] Syzbot reports the following crash: BTRFS info (device loop0 state MCS): disabling free space tree BTRFS info (dev…

  • Medium 5.5

    PCI: Hold rescan lock while adding devices during host probe

    In the Linux kernel, the following vulnerability has been resolved: PCI: Hold rescan lock while adding devices during host probe Since adding the PCI power control code, we may end up with a race between the pwrctl platform device rescanning the bus and host …

  • Medium 5.5

    LoongArch: Don't crash in stack_top() for tasks without vDSO

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: Don't crash in stack_top() for tasks without vDSO Not all tasks have a vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefenc…

  • Medium 5.5

    net/mlx5: Unregister notifier on eswitch init failure

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remains registered and a subsequent attempt at eswitch enabling might trigger warnings of the sort: [ 682.589148] ----------…

  • Medium 4.7

    nvme-pci: fix race condition between reset and nvme_dev_disable()

    In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix race condition between reset and nvme_dev_disable() nvme_dev_disable() modifies the dev->online_queues field, therefore nvme_pci_update_nr_queues() should avoid racing against i…

  • Low 3.3

    net: netconsole: fix wrong warning

    In the Linux kernel, the following vulnerability has been resolved: net: netconsole: fix wrong warning A warning is triggered when there is insufficient space in the buffer for userdata. However, this is not an issue since userdata will be sent in the next it…

  • Unscored —

    When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using on…

  • Unscored —
    CVE-2024-50089 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() A devm_kzalloc() in asoc_qcom_lpass_cpu_platform_probe() could possibly return NULL pointer. NULL Pointer Dereference …

  • Unscored —

    smb: client: Handle kstrdup failures for passwords

    In the Linux kernel, the following vulnerability has been resolved: smb: client: Handle kstrdup failures for passwords In smb3_reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to check for allocation failures. If ses->…

  • Unscored —

    drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA

    In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a "memcpy: detected f…

  • Unscored —

    reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC

    In the Linux kernel, the following vulnerability has been resolved: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC data->asserted will be NULL on JH7110 SoC since commit 82327b127d41 ("reset: starfive: Add StarFive JH7110 reset driver")…

  • Unscored —

    bpf: Use raw_spinlock_t in ringbuf

    In the Linux kernel, the following vulnerability has been resolved: bpf: Use raw_spinlock_t in ringbuf The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic"…

Revision history

  1. #102

    Neue Updates von Ubuntu aufgenommen

  2. #101

    Neue Updates von Red Hat aufgenommen

  3. #100

    Neue Updates von SUSE aufgenommen

  4. #99

    Neue Updates von SUSE aufgenommen

  5. #98

    Neue Updates von Ubuntu aufgenommen

  6. #97

    Neue Updates von Ubuntu aufgenommen

  7. #96

    Neue Updates von Ubuntu aufgenommen

  8. #95

    Neue Updates von Ubuntu aufgenommen

  9. #94

    Neue Updates von Ubuntu aufgenommen

  10. #93

    Neue Updates von Ubuntu aufgenommen

  11. #92

    Neue Updates von Ubuntu aufgenommen

  12. #91

    Neue Updates von Ubuntu aufgenommen

  13. #90

    Neue Updates von Ubuntu aufgenommen

  14. #89

    Neue Updates von SUSE aufgenommen

  15. #88

    Neue Updates von Dell aufgenommen

  16. #87

    Neue Updates von Dell aufgenommen

  17. #86

    Neue Updates von Red Hat aufgenommen

  18. #85

    Neue Updates von Red Hat aufgenommen

  19. #84

    Neue Updates von Ubuntu aufgenommen

  20. #83

    Neue Updates von Ubuntu aufgenommen

  21. #82

    Neue Updates von SUSE aufgenommen

  22. #81

    Neue Updates von Ubuntu aufgenommen

  23. #80

    Referenz(en) aufgenommen:

  24. #79

    Neue Updates von Ubuntu aufgenommen

  25. #78

    Neue Updates von SUSE aufgenommen

References