Skip to content
OpenAdvisories

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen und einen Denial-of-Service-Zustand zu erzeugen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 39

  • Critical 9.8

    net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init

    In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init The loop responsible for allocating up to MTK_FQ_DMA_LENGTH buffers must only touch as many descriptors, otherwise it ends…

  • High 8.2

    mptcp: handle consistently DSS corruption

    In the Linux kernel, the following vulnerability has been resolved: mptcp: handle consistently DSS corruption Bugged peer implementation can send corrupted DSS options, consistently hitting a few warning in the data path. Use DEBUG_NET assertions, to avoid th…

  • High 7.8

    drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup()

    In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup() The group variable can't be used to retrieve ptdev in our second loop, because it points to the previously iterated lis…

  • High 7.8

    drm/panthor: Fix race when converting group handle to group object

    In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix race when converting group handle to group object XArray provides it's own internal lock which protects the internal array when entries are being simultaneously added and rem…

  • High 7.8

    media: qcom: camss: Remove use_count guard in stop_streaming

    In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: Remove use_count guard in stop_streaming The use_count check was introduced so that multiple concurrent Raw Data Interfaces RDIs could be driven by different virtual chann…

  • High 7.8

    fbdev: sisfb: Fix strbuf array overflow

    In the Linux kernel, the following vulnerability has been resolved: fbdev: sisfb: Fix strbuf array overflow The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1. The strbuf1 array contains digit characters …

  • High 7.8

    net: explicitly clear the sk pointer, when pf->create fails

    In the Linux kernel, the following vulnerability has been resolved: net: explicitly clear the sk pointer, when pf->create fails We have recently noticed the exact same KASAN splat as in commit 6cd4a78d962b ("net: do not leave a dangling sk pointer, when socke…

  • High 7.8

    drm/vc4: Stop the active perfmon before being destroyed

    In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Stop the active perfmon before being destroyed Upon closing the file descriptor, the active performance monitor is not stopped. Although all perfmons are destroyed in `vc4_perfmon_cl…

  • High 7.8

    net: phy: dp83869: fix memory corruption when enabling fiber

    In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83869: fix memory corruption when enabling fiber When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than…

  • High 7.8

    HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()

    In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() Using the device-managed version allows to simplify clean-up in probe() error path. Additionally, this device-managed ensures prop…

  • High 7.8

    maple_tree: correct tree corruption on spanning store

    In the Linux kernel, the following vulnerability has been resolved: maple_tree: correct tree corruption on spanning store Patch series "maple_tree: correct tree corruption on spanning store", v3. There has been a nasty yet subtle maple tree corruption bug tha…

  • High 7.8

    bpf, arm64: Fix address emission with tag-based KASAN enabled

    In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation…

  • High 7.8

    ring-buffer: Fix reader locking when changing the sub buffer order

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix reader locking when changing the sub buffer order The function ring_buffer_subbuf_order_set() updates each ring_buffer_per_cpu and installs new sub buffers that match the req…

  • High 7.8

    RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages

    In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Avoid memory corruption while setting up Level-2 PBL pages for the non MR resources when num_pages > 256K. There will be a single PD…

  • High 7.8

    RDMA/bnxt_re: Add a check for memory allocation

    In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a check for memory allocation __alloc_pbl() can return error when memory allocation fails. Driver is not checking the status on one of the instances.

  • High 7.8

    udf: refactor inode_bmap() to handle error

    In the Linux kernel, the following vulnerability has been resolved: udf: refactor inode_bmap() to handle error Refactor inode_bmap() to handle error since udf_next_aext() can return error now. On situations like ftruncate, udf_extend_file() can now detect err…

  • High 7.1

    secretmem: disable memfd_secret() if arch cannot set direct map

    In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfd_secret() if arch cannot set direct map Return -ENOSYS from memfd_secret() syscall if !can_set_direct_map(). This is the case for example on some arm64 configurations,…

  • High 7.1

    x86/entry_32: Clear CPU buffers after register restore in NMI return

    In the Linux kernel, the following vulnerability has been resolved: x86/entry_32: Clear CPU buffers after register restore in NMI return CPU buffers are currently cleared after call to exc_nmi, but before register state is restored. This may be okay for MDS m…

  • High 7.1

    posix-clock: Fix missing timespec64 check in pc_clock_settime()

    In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pc_clock_settime() As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct's tv_sec and tv_nsec range before calling…

  • Medium 5.5

    remoteproc: k3-r5: Fix error handling when power-up failed

    In the Linux kernel, the following vulnerability has been resolved: remoteproc: k3-r5: Fix error handling when power-up failed By simply bailing out, the driver was violating its rule and internal assumptions that either both or no rproc should be initialized…

  • Medium 5.5

    drm/amd/display: fix a UBSAN warning in DML2.1

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since cursor_width is explicity set to 0, this causes calculation logic to trigger overflow for an unsigned int t…

  • Medium 5.5

    cpufreq: loongson3: Use raw_smp_processor_id() in do_service_request()

    In the Linux kernel, the following vulnerability has been resolved: cpufreq: loongson3: Use raw_smp_processor_id() in do_service_request() Use raw_smp_processor_id() instead of plain smp_processor_id() in do_service_request(), otherwise we may get some errors…

  • Medium 5.5

    ceph: remove the incorrect Fw reference check when dirtying pages

    In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and ther…

  • Medium 5.5

    virtio_pmem: Check device status before requesting flush

    In the Linux kernel, the following vulnerability has been resolved: virtio_pmem: Check device status before requesting flush If a pmem device is in a bad status, the driver side could wait for host ack forever in virtio_pmem_flush(), causing the system to han…

  • Medium 5.5

    ice: fix memleak in ice_init_tx_topology()

    In the Linux kernel, the following vulnerability has been resolved: ice: fix memleak in ice_init_tx_topology() Fix leak of the FW blob (DDP pkg). Make ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid copying whole FW blob. Copy just the to…

  • Medium 5.5

    ext4: don't set SB_RDONLY after filesystem errors

    In the Linux kernel, the following vulnerability has been resolved: ext4: don't set SB_RDONLY after filesystem errors When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this miss…

  • Medium 5.5

    arm64: probes: Fix uprobes for big-endian kernels

    In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Fix uprobes for big-endian kernels The arm64 uprobes code is broken for big-endian kernels as it doesn't convert the in-memory instruction encoding (which is always little-endi…

  • Medium 5.5

    pinctrl: ocelot: fix system hang on level based interrupts

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: ocelot: fix system hang on level based interrupts The current implementation only calls chained_irq_enter() and chained_irq_exit() if it detects pending interrupts. ``` for (i = 0; i…

  • Medium 5.5

    pinctrl: intel: platform: fix error path in device_for_each_child_node()

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: intel: platform: fix error path in device_for_each_child_node() The device_for_each_child_node() loop requires calls to fwnode_handle_put() upon early returns to decrement the refcou…

  • Medium 5.5

    iio: light: veml6030: fix IIO device retrieval from embedded device

    In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6030: fix IIO device retrieval from embedded device The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device …

  • Medium 5.5

    drm/radeon: Fix encoder->possible_clones

    In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix encoder->possible_clones Include the encoder itself in its possible_clones bitmask. In the past nothing validated that drivers were populating possible_clones correctly, but t…

  • Medium 5.5

    nilfs2: propagate directory read errors from nilfs_find_entry()

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: propagate directory read errors from nilfs_find_entry() Syzbot reported that a task hang occurs in vcs_open() during a fuzzing test for nilfs2. The root cause of this problem is that …

  • Medium 5.5

    fs: don't try and remove empty rbtree node

    In the Linux kernel, the following vulnerability has been resolved: fs: don't try and remove empty rbtree node When copying a namespace we won't have added the new copy into the namespace rbtree until after the copy succeeded. Calling free_mnt_ns() will try t…

  • Medium 5.5

    ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add …

  • Medium 5.5

    posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()

    In the Linux kernel, the following vulnerability has been resolved: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() If get_clock_desc() succeeds, it calls fget() for the clockid's fd, and get the clk->rwsem read lock, so the error path …

  • Medium 4.7

    scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. F…

  • Medium 4.7

    irqchip/gic-v4: Don't allow a VMOVP on a dying VPE

    In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has al…

  • Unscored —
    CVE-2024-50181 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    mm/swapfile: skip HugeTLB pages for unuse_vma

    In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: skip HugeTLB pages for unuse_vma I got a bad pud error and lost a 1GB HugeTLB when calling swapoff. The problem can be reproduced by the following steps: 1. Allocate an anonymous…

Revision history

  1. #84

    Neue Updates von SUSE aufgenommen

  2. #83

    Neue Updates von SUSE aufgenommen

  3. #82

    Neue Updates von Ubuntu aufgenommen

  4. #81

    Neue Updates von Ubuntu aufgenommen

  5. #80

    Neue Updates von Ubuntu aufgenommen

  6. #79

    Neue Updates von Ubuntu aufgenommen

  7. #78

    Neue Updates von Ubuntu aufgenommen

  8. #77

    Neue Updates von Ubuntu aufgenommen

  9. #76

    Neue Updates von Ubuntu aufgenommen

  10. #75

    Neue Updates von Ubuntu aufgenommen

  11. #74

    Neue Updates von Ubuntu aufgenommen

  12. #73

    Neue Updates von Ubuntu aufgenommen

  13. #72

    Neue Updates von Ubuntu aufgenommen

  14. #71

    Neue Updates von Ubuntu aufgenommen

  15. #70

    Neue Updates von Ubuntu aufgenommen

  16. #69

    Neue Updates von Oracle Linux aufgenommen

  17. #68

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  18. #67

    Neue Updates von Ubuntu aufgenommen

  19. #66

    Neue Updates von Red Hat aufgenommen

  20. #65

    Neue Updates von Ubuntu aufgenommen

  21. #64

    Neue Updates von Ubuntu aufgenommen

  22. #63

    Neue Updates von Ubuntu aufgenommen

  23. #62

    Neue Updates von Ubuntu aufgenommen

  24. #61

    Neue Updates von SUSE aufgenommen

  25. #60

    Neue Updates von SUSE aufgenommen

References