Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Zustand herbeizuführen oderum einen nicht näher spezifizierten Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 40

  • Medium 5.5
    CVE-2024-50302 Exploited

    HID: core: zero-initialize the report buffer

    In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …

    KEV Mar 4, 2025
  • Critical 9.8

    net: vertexcom: mse102x: Fix possible double free of TX skb

    In the Linux kernel, the following vulnerability has been resolved: net: vertexcom: mse102x: Fix possible double free of TX skb The scope of the TX skb is wider than just mse102x_tx_frame_spi(), so in case the TX skb room needs to be expanded, we should free …

  • Critical 9.8

    ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp ksmbd_user_session_put should be called under smb3_preauth_hash_rsp(). It will avoid freeing session before calling smb3_preauth_hash_r…

  • Critical 9.8

    ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition between ksmbd_smb2_session_create and ksmbd_expire_session. This patch add missing sessions_table_lock wh…

  • High 8.2

    sctp: properly validate chunk size in sctp_sf_ootb()

    In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctp_sf…

  • High 7.8

    drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data. Suggested by Ye Zhang (@VAR10CK…

  • High 7.8

    vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

    In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After…

  • High 7.8

    USB: serial: io_edgeport: fix use after free in debug printk

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) is a use after free of the "urb" pointer. Store the "dev" …

  • High 7.8

    usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The "*cmd" variable can be controlled by the user via debugfs. That means "new_cam" can be as high as 255 while th…

  • High 7.8

    usb: musb: sunxi: Fix accessing an released usb phy

    In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix accessing an released usb phy Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after release…

  • High 7.8

    btrfs: reinitialize delayed ref list after deleting it from the list

    In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref fr…

  • High 7.8

    idpf: avoid vport access in idpf_get_link_ksettings

    In the Linux kernel, the following vulnerability has been resolved: idpf: avoid vport access in idpf_get_link_ksettings When the device control plane is removed or the platform running device control plane is rebooted, a reset is detected on the driver. On dr…

  • High 7.8

    dm cache: fix flushing uninitialized delayed_work on cache_ctr error

    In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayed_work on cache_ctr error An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delaye…

  • High 7.8

    KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation

    In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealing a key blob we currently do not wait for the AEAD cipher operation to finish and simply return after…

  • High 7.8

    drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a possible buffer overflow if size is larger than 4K. (cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf00…

  • High 7.8

    media: vivid: fix buffer overwrite when using > 32 buffers

    In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix buffer overwrite when using > 32 buffers The maximum number of buffers that can be requested was increased to 64 for the video capture queue. But video capture used a must_b…

  • High 7.8

    media: dvb-core: add missing buffer index check

    In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: add missing buffer index check dvb_vb2_expbuf() didn't check if the given buffer index was for a valid buffer. Add this check.

  • High 7.8

    net/smc: do not leave a dangling sk pointer in __smc_create()

    In the Linux kernel, the following vulnerability has been resolved: net/smc: do not leave a dangling sk pointer in __smc_create() Thanks to commit 4bbd360a5084 ("socket: Print pf->create() when it does not clear sock->sk on failure."), syzbot found an issue w…

  • High 7.8

    rxrpc: Fix missing locking causing hanging calls

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing locking causing hanging calls If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abo…

  • High 7.8

    regulator: rtq2208: Fix uninitialized use of regulator_config

    In the Linux kernel, the following vulnerability has been resolved: regulator: rtq2208: Fix uninitialized use of regulator_config Fix rtq2208 driver uninitialized use to cause kernel error.

  • High 7.8

    security/keys: fix slab-out-of-bounds in key_task_permission

    In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 BUG: KASAN: slab-out-o…

  • High 7.5

    ksmbd: Fix the missing xa_store error check

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix the missing xa_store error check xa_store() can fail, it return xa_err(-EINVAL) if the entry cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation failed, so check…

  • High 7.5

    ksmbd: check outstanding simultaneous SMB operations

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: check outstanding simultaneous SMB operations If Client send simultaneous SMB operations to ksmbd, It exhausts too much memory through the "ksmbd_work_cache”. It will cause OOM issue. …

  • High 7.5

    net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts

    In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Enqueue packets in dql after dma engine starts causes race condition. Tx transfer starts once dma engine is started and…

  • High 7.3

    arm64/sve: Discard stale CPU state when handling SVE traps

    In the Linux kernel, the following vulnerability has been resolved: arm64/sve: Discard stale CPU state when handling SVE traps The logic for handling SVE traps manipulates saved FPSIMD/SVE state incorrectly, and a race with preemption can result in a task hav…

  • High 7.1

    dm cache: fix potential out-of-bounds access on the first resume

    In the Linux kernel, the following vulnerability has been resolved: dm cache: fix potential out-of-bounds access on the first resume Out-of-bounds access occurs if the fast device is expanded unexpectedly before the first-time resume of the cache table. This …

  • High 7.1

    dm cache: fix out-of-bounds access to the dirty bitset when resizing

    In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitse…

  • Medium 5.5

    ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remo…

  • Medium 5.5

    clk: qcom: videocc-sm8350: use HW_CTRL_TRIGGER for vcodec GDSCs

    In the Linux kernel, the following vulnerability has been resolved: clk: qcom: videocc-sm8350: use HW_CTRL_TRIGGER for vcodec GDSCs A recent change in the venus driver results in a stuck clock on the Lenovo ThinkPad X13s, for example, when streaming video in …

  • Medium 5.5

    mm/damon/core: avoid overflow in damon_feed_loop_next_input()

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damon_feed_loop_next_input() damon_feed_loop_next_input() is inefficient and fragile to overflows. Specifically, 'score_goal_diff_bp' calculation can overflow…

  • Medium 5.5

    signal: restore the override_rlimit logic

    In the Linux kernel, the following vulnerability has been resolved: signal: restore the override_rlimit logic Prior to commit d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") UCOUNT_RLIMIT_SIGPENDING rlimit was not enforced for a class of sign…

  • Medium 5.5

    media: v4l2-tpg: prevent the risk of a division by zero

    In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If t…

  • Medium 5.5

    media: cx24116: prevent overflows on SNR calculus

    In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if reading SNR registers fail, a negative number will be returned, causing an underflow when reading SNR registers. …

  • Medium 5.5

    ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove

    In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not null. So the release of the dma channel leads to…

  • Medium 5.5

    net: hns3: fix kernel crash when uninstalling driver

    In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and the VF is disabled concurrently, a kernel crash occurs. The reason is that the two actions call functio…

  • Medium 5.5

    net: enetc: allocate vf_state during PF probes

    In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vf_state during PF probes In the previous implementation, vf_state is allocated memory only when VF is enabled. However, net_device_ops::ndo_set_vf_mac() may be called be…

  • Medium 4.7

    dm: fix a crash if blk_alloc_disk fails

    In the Linux kernel, the following vulnerability has been resolved: dm: fix a crash if blk_alloc_disk fails If blk_alloc_disk fails, the variable md->disk is set to an error value. cleanup_mapped_device will see that md->disk is non-NULL and it will attempt t…

  • Unscored —

    filemap: Fix bounds checking in filemap_read()

    In the Linux kernel, the following vulnerability has been resolved: filemap: Fix bounds checking in filemap_read() If the caller supplies an iocb->ki_pos value that is close to the filesystem upper limit, and an iterator with a count that causes us to overflo…

  • Unscored —

    media: av7110: fix a spectre vulnerability

    In the Linux kernel, the following vulnerability has been resolved: media: av7110: fix a spectre vulnerability As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) The…

  • Unscored —

    net: arc: fix the device for dma_map_single/dma_unmap_single

    In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dma_map_single/dma_unmap_single The ndev->dev and pdev->dev aren't the same device, use ndev->dev.parent which has dma_mask, ndev->dev.parent is just pdev->dev. O…

Revision history

  1. #126

    Neue Updates von Siemens aufgenommen

  2. #125

    Neue Updates von IBM aufgenommen

  3. #124

    Neue Updates von Debian aufgenommen

  4. #123

    Neue Updates von Ubuntu aufgenommen

  5. #122

    Neue Updates von SUSE aufgenommen

  6. #121

    Neue Updates von SUSE aufgenommen

  7. #120

    Neue Updates von Oracle Linux aufgenommen

  8. #119

    Neue Updates von Oracle Linux aufgenommen

  9. #118

    Neue Updates von Oracle Linux aufgenommen

  10. #117

    Neue Updates von Ubuntu aufgenommen

  11. #116

    Neue Updates von Oracle Linux aufgenommen

  12. #115

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  13. #114

    Neue Updates von Ubuntu aufgenommen

  14. #113

    Neue Updates von Ubuntu aufgenommen

  15. #112

    Neue Updates von Red Hat aufgenommen

  16. #111

    Neue Updates von Ubuntu aufgenommen

  17. #110

    Neue Updates von Ubuntu aufgenommen

  18. #109

    Neue Updates von IBM aufgenommen

  19. #108

    Neue Updates von IBM aufgenommen

  20. #107

    Neue Updates von Oracle Linux aufgenommen

  21. #106

    Neue Updates von Red Hat aufgenommen

  22. #105

    Neue Updates von Ubuntu aufgenommen

  23. #104

    Neue Updates von Ubuntu aufgenommen

  24. #103

    Neue Updates von Ubuntu aufgenommen

  25. #102

    Neue Updates von IBM aufgenommen

References