Skip to content
OpenAdvisories

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 51

  • High 8.1

    nvmet-auth: assign dh_key to NULL after kfree_sensitive

    In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: assign dh_key to NULL after kfree_sensitive ctrl->dh_key might be used across multiple calls to nvmet_setup_dhgroup() for the same controller. So it's better to nullify it after r…

  • High 7.8

    btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing or…

  • High 7.8

    drm/amd/pm: Vangogh: Fix kernel memory out of bounds write

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Vangogh: Fix kernel memory out of bounds write KASAN reports that the GPU metrics table allocated in vangogh_tables_init() is not large enough for the memset done in smu_cmn_init_…

  • High 7.8

    btrfs: fix error propagation of split bios

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix error propagation of split bios The purpose of btrfs_bbio_propagate_error() shall be propagating an error of split bio to its original btrfs_bio, and tell the error to the upper la…

  • High 7.8

    cxl/port: Fix use-after-free, permit out-of-order decoder shutdown

    In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown In support of investigating an initialization failure report [1], cxl_test was updated to register mock memory-devices after…

  • High 7.8

    nilfs2: fix kernel bug due to missing clearing of checked flag

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write…

  • High 7.8

    wifi: cfg80211: clear wdev->cqm_config pointer on free

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: clear wdev->cqm_config pointer on free When we free wdev->cqm_config when unregistering, we also need to clear out the pointer since the same wdev/netdev may get re-registered…

  • High 7.8

    wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Avoid potentially crashing in the driver because of uninitialized private data

  • High 7.8

    fs/ntfs3: Add rough attr alloc_size check

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add rough attr alloc_size check

  • High 7.8

    fsdax: dax_unshare_iter needs to copy entire blocks

    In the Linux kernel, the following vulnerability has been resolved: fsdax: dax_unshare_iter needs to copy entire blocks The code that copies data from srcmap to iomap in dax_unshare_iter is very very broken, which bfoster's recent fsx changes have exposed. If…

  • High 7.8

    bpf: Check the validity of nr_words in bpf_iter_bits_new()

    In the Linux kernel, the following vulnerability has been resolved: bpf: Check the validity of nr_words in bpf_iter_bits_new() Check the validity of nr_words in bpf_iter_bits_new(). Without this check, when multiplication overflow occurs for nr_bits (e.g., wh…

  • High 7.8

    macsec: Fix use-after-free while sending the offloading packet

    In the Linux kernel, the following vulnerability has been resolved: macsec: Fix use-after-free while sending the offloading packet KASAN reports the following UAF. The metadata_dst, which is used to store the SCI value for macsec offload, is already freed by …

  • High 7.8

    bpf: Fix out-of-bounds write in trie_get_next_key()

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when…

  • High 7.5

    NFSD: Initialize struct nfsd4_copy earlier

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Initialize struct nfsd4_copy earlier Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy…

  • High 7.5

    netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() I got a syzbot report without a repro [1] crashing in nf_send_reset6() I think the issue is that dev->hard_header_len is zer…

  • High 7.3

    fs/ntfs3: Check if more than chunk-size bytes are written

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check if more than chunk-size bytes are written A incorrectly formatted chunk may decompress into more than LZNT_CHUNK_SIZE bytes and a index out of bounds will occur in s_max_off.

  • High 7.1

    thunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan()

    In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan() KASAN reported following issue: BUG: KASAN: stack-out-of-bounds in tb_retimer_scan+0xffe/0x1550 [thunderbolt] Rea…

  • High 7.1

    ntfs3: Add bounds checking to mi_enum_attr()

    In the Linux kernel, the following vulnerability has been resolved: ntfs3: Add bounds checking to mi_enum_attr() Added bounds checking to make sure that every attr don't stray beyond valid memory region.

  • High 7.0

    iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP

    In the Linux kernel, the following vulnerability has been resolved: iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP generic/077 on x86_32 CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP=y with highmem, on huge=always tmpfs, issues a warning and then hang…

  • High 7.0

    wifi: iwlegacy: Clear stale interrupts before resuming device

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a stale interrupt which isn't being cleared out b…

  • High 7.0

    netfilter: Fix use-after-free in get_info()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: Fix use-after-free in get_info() ip6table_nat module unload has refcnt warning for UAF. call trace is: WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80 Mod…

  • Medium 5.5

    drm/tests: hdmi: Fix memory leaks in drm_display_mode_from_cea_vic()

    In the Linux kernel, the following vulnerability has been resolved: drm/tests: hdmi: Fix memory leaks in drm_display_mode_from_cea_vic() modprobe drm_hdmi_state_helper_test and then rmmod it, the following memory leak occurs. The `mode` allocated in drm_mode_…

  • Medium 5.5

    drm/connector: hdmi: Fix memory leak in drm_display_mode_from_cea_vic()

    In the Linux kernel, the following vulnerability has been resolved: drm/connector: hdmi: Fix memory leak in drm_display_mode_from_cea_vic() modprobe drm_connector_test and then rmmod drm_connector_test, the following memory leak occurs. The `mode` allocated i…

  • Medium 5.5

    sched/numa: Fix the potential null pointer dereference in task_numa_work()

    In the Linux kernel, the following vulnerability has been resolved: sched/numa: Fix the potential null pointer dereference in task_numa_work() When running stress-ng-vm-segv test, we found a null pointer dereference error in task_numa_work(). Here is the back…

  • Medium 5.5

    spi: spi-fsl-dspi: Fix crash when not using GPIO chip select

    In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-dspi: Fix crash when not using GPIO chip select Add check for the return value of spi_get_csgpiod() to avoid passing a NULL pointer to gpiod_direction_output(), preventing a cras…

  • Medium 5.5

    nilfs2: fix potential deadlock with newly created symlinks

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential deadlock with newly created symlinks Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which ca…

  • Medium 5.5

    iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()

    In the Linux kernel, the following vulnerability has been resolved: iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table() modprobe iio-test-gts and rmmod it, then the following memory leak occurs: unreferenced object 0xffffff80c810be00 (size …

  • Medium 5.5

    iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr() In the ad7124_write_raw() function, parameter val can potentially be zero. This may lead to a division by zero when DIV_ROUN…

  • Medium 5.5

    staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()

    In the Linux kernel, the following vulnerability has been resolved: staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero whe…

  • Medium 5.5

    wifi: ath10k: Fix memory leak in management tx

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Fix memory leak in management tx In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during man…

  • Medium 5.5

    phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend

    In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation") removed most users of the platform device driver data from the …

  • Medium 5.5

    phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend

    In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation") removed most users of the platform device driver data fro…

  • Medium 5.5

    phy: qcom: qmp-usb: fix NULL-deref on runtime suspend

    In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: fix NULL-deref on runtime suspend Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation") removed most users of the platform device driver data, but mista…

  • Medium 5.5

    fs/ntfs3: Additional check in ni_clear()

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in ni_clear() Checking of NTFS_FLAGS_LOG_REPLAYING added to prevent access to uninitialized bitmap during replay process.

  • Medium 5.5

    fs/ntfs3: Fix possible deadlock in mi_read

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix possible deadlock in mi_read Mutex lock with another subclass used in ni_lock_dir().

  • Medium 5.5

    ACPI: CPPC: Make rmw_lock a raw_spin_lock

    In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Make rmw_lock a raw_spin_lock The following BUG was triggered: ============================= [ BUG: Invalid wait context ] 6.12.0-rc2-XXX #406 Not tainted ------------------------…

  • Medium 5.5

    mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address

    In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address The device stores IPv6 addresses that are used for encapsulation in linear memory that is managed by the driver. Changi…

  • Medium 5.5

    bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()

    In the Linux kernel, the following vulnerability has been resolved: bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() bpf_iter_bits_destroy() uses "kit->nr_bits <= 64" to check whether the bits are dynamically allocated. However, the check is in…

  • Medium 5.5

    Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. __hci_cmd_sync_sk() returns NULL if a command returns a status …

  • Medium 5.5

    netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write()

    In the Linux kernel, the following vulnerability has been resolved: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() This was found by a static analyzer. We should not forget the trailing zero after copy_from_user()…

  • Medium 4.7

    sock_map: fix a NULL pointer dereference in sock_map_link_update_prog()

    In the Linux kernel, the following vulnerability has been resolved: sock_map: fix a NULL pointer dereference in sock_map_link_update_prog() The following race condition could trigger a NULL pointer dereference: sock_map_link_detach(): sock_map_link_update_pro…

  • Unscored —

    lib: alloc_tag_module_unload must wait for pending kfree_rcu calls

    In the Linux kernel, the following vulnerability has been resolved: lib: alloc_tag_module_unload must wait for pending kfree_rcu calls Ben Greear reports following splat: ------------[ cut here ]------------ net/netfilter/nf_nat_core.c:1114 module nf_nat func…

  • Unscored —

    xfs: fix finding a last resort AG in xfs_filestream_pick_ag

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix finding a last resort AG in xfs_filestream_pick_ag When the main loop in xfs_filestream_pick_ag fails to find a suitable AG it tries to just pick the online AG. But the loop for that…

  • Unscored —

    ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow Syzbot reported a kernel BUG in ocfs2_truncate_inline. There are two reasons for this: first, the parameter value passed is greater tha…

  • Unscored —
    CVE-2024-50219 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    fork: do not invoke uffd on fork if error occurs

    In the Linux kernel, the following vulnerability has been resolved: fork: do not invoke uffd on fork if error occurs Patch series "fork: do not expose incomplete mm on fork". During fork we may place the virtual memory address space into an inconsistent state…

  • Unscored —
    CVE-2024-50228 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    fs/ntfs3: Additional check in ntfs_file_release

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in ntfs_file_release

  • Unscored —

    fs/ntfs3: Fix general protection fault in run_is_mapped_full

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix general protection fault in run_is_mapped_full Fixed deleating of a non-resident attribute in ntfs_create_inode() rollback.

  • Unscored —
    CVE-2024-50251 Public exploit

    netfilter: nft_payload: sanitize offset and length before calling skb_checksum()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_chec…

  • Unscored —

    net: fix crash when config small gso_max_size/gso_ipv4_max_size

    In the Linux kernel, the following vulnerability has been resolved: net: fix crash when config small gso_max_size/gso_ipv4_max_size Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in sk_dst_gso_max_size(), which may trigger a BUG_ON cr…

Revision history

  1. #88

    Neue Updates von SUSE aufgenommen

  2. #87

    Neue Updates von SUSE aufgenommen

  3. #86

    Neue Updates von SUSE aufgenommen

  4. #85

    Neue Updates von Ubuntu aufgenommen

  5. #84

    Neue Updates von SUSE aufgenommen

  6. #83

    Neue Updates von SUSE aufgenommen

  7. #82

    Neue Updates von Dell aufgenommen

  8. #81

    Neue Updates von Dell aufgenommen

  9. #80

    Neue Updates von Ubuntu aufgenommen

  10. #79

    Neue Updates von Ubuntu aufgenommen

  11. #78

    Neue Updates von SUSE und Ubuntu aufgenommen

  12. #77

    Neue Updates von SUSE aufgenommen

  13. #76

    Neue Updates von Ubuntu aufgenommen

  14. #75

    Neue Updates von SUSE aufgenommen

  15. #74

    Neue Updates von SUSE aufgenommen

  16. #73

    Neue Updates von Ubuntu aufgenommen

  17. #72

    Neue Updates von Oracle Linux aufgenommen

  18. #71

    Neue Updates von SUSE aufgenommen

  19. #70

    Neue Updates von SUSE aufgenommen

  20. #69

    Neue Updates von SUSE aufgenommen

  21. #68

    Neue Updates von SUSE aufgenommen

  22. #67

    Neue Updates von SUSE aufgenommen

  23. #66

    Neue Updates von SUSE aufgenommen

  24. #65

    Neue Updates von SUSE aufgenommen

  25. #64

    Neue Updates von SUSE aufgenommen

References