Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 49

  • Critical 9.8

    nfs: Fix KMSAN warning in decode_getfattr_attrs()

    In the Linux kernel, the following vulnerability has been resolved: nfs: Fix KMSAN warning in decode_getfattr_attrs() Fix the following KMSAN warning: CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + I…

  • Critical 9.4

    net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data

    In the Linux kernel, the following vulnerability has been resolved: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data In case the non-paged data of a SKB carries protocol header and protocol payload to be transmitted on a certain platform …

  • High 8.4

    virtio_net: Add hash_key_length check

    In the Linux kernel, the following vulnerability has been resolved: virtio_net: Add hash_key_length check Add hash_key_length check in virtnet_probe() to avoid possible out of bound errors when setting/reading the hash key.

  • High 7.8

    net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() This command: $ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact Error: block dev insert failed: -EBUSY. f…

  • High 7.8

    net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

    In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it…

  • High 7.8

    media: dvbdev: prevent the risk of out of memory access

    In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: prevent the risk of out of memory access The dvbdev contains a static variable used to store dvb minors. The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. …

  • High 7.8

    firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()

    In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() The scmi_dev->name is released prematurely in __scmi_device_destroy(), which causes slab-use-after-free when accessing scmi_…

  • High 7.8

    iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()

    In the Linux kernel, the following vulnerability has been resolved: iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table() If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loop of iio_gts_build_avail_scale…

  • High 7.8

    mm/thp: fix deferred split unqueue naming and locking

    In the Linux kernel, the following vulnerability has been resolved: mm/thp: fix deferred split unqueue naming and locking Recent changes are putting more pressure on THP deferred split queues: under load revealing long-standing races, causing list_del corrupt…

  • High 7.8

    drm/panthor: Lock XArray when getting entries for the VM

    In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Lock XArray when getting entries for the VM Similar to commit cac075706f29 ("drm/panthor: Fix race when converting group handle to group object") we need to use the XArray's inte…

  • High 7.8

    i40e: fix race condition by adding filter's intermediate sync state

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix race condition by adding filter's intermediate sync state Fix a race condition in the i40e driver that leads to MAC/VLAN filters becoming corrupted and leaking. Address the issue th…

  • High 7.5

    NFSD: Never decrement pending_async_copies on error

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Never decrement pending_async_copies on error The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies.

  • High 7.3

    media: s5p-jpeg: prevent buffer overflows

    In the Linux kernel, the following vulnerability has been resolved: media: s5p-jpeg: prevent buffer overflows The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent …

  • High 7.1

    wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() 1. The size of the response packet is not validated. 2. The response buffer is not freed. Resolve these issues by swit…

  • High 7.1

    media: mgb4: protect driver against spectre

    In the Linux kernel, the following vulnerability has been resolved: media: mgb4: protect driver against spectre Frequency range is set from sysfs via frequency_range_store(), being vulnerable to spectre, as reported by smatch: drivers/media/pci/mgb4/mgb4_cmt.…

  • Medium 5.5

    resource,kexec: walk_system_ram_res_rev must retain resource flags

    In the Linux kernel, the following vulnerability has been resolved: resource,kexec: walk_system_ram_res_rev must retain resource flags walk_system_ram_res_rev() erroneously discards resource flags when passing the information to the callback. This causes syst…

  • Medium 5.5

    ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()

    In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() There are code paths from which the function is called without holding the RCU read lock, resulting in a suspicious …

  • Medium 5.5

    mctp i2c: handle NULL header address

    In the Linux kernel, the following vulnerability has been resolved: mctp i2c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but …

  • Medium 5.5

    ASoC: dapm: fix bounds checker error in dapm_widget_list_create

    In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: fix bounds checker error in dapm_widget_list_create The widgets array in the snd_soc_dapm_widget_list has a __counted_by attribute attached to it, which points to the num_widgets …

  • Medium 5.5

    arm64: dts: imx8ulp: correct the flexspi compatible string

    In the Linux kernel, the following vulnerability has been resolved: arm64: dts: imx8ulp: correct the flexspi compatible string The flexspi on imx8ulp only has 16 LUTs, and imx8mm flexspi has 32 LUTs, so correct the compatible string here, otherwise will meet …

  • Medium 5.5

    mptcp: init: protect sched with rcu_read_lock

    In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcu_read_lock Enabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT creates this splat when an MPTCP socket is created: ========================…

  • Medium 5.5

    ice: fix crash on probe for DPLL enabled E810 LOM

    In the Linux kernel, the following vulnerability has been resolved: ice: fix crash on probe for DPLL enabled E810 LOM The E810 Lan On Motherboard (LOM) design is vendor specific. Intel provides the reference design, but it is up to vendor on the final product…

  • Medium 5.5

    slub/kunit: fix a WARNING due to unwrapped __kmalloc_cache_noprof

    In the Linux kernel, the following vulnerability has been resolved: slub/kunit: fix a WARNING due to unwrapped __kmalloc_cache_noprof 'modprobe slub_kunit' will have a warning as shown below. The root cause is that __kmalloc_cache_noprof was directly used, wh…

  • Medium 5.5

    drm/i915/hdcp: Add encoder check in hdcp2_get_capability

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: Add encoder check in hdcp2_get_capability Add encoder check in intel_hdcp2_get_capability to avoid null pointer error.

  • Medium 5.5

    drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability Sometimes during hotplug scenario or suspend/resume scenario encoder is not always initialized when intel_hdcp_get_capability add…

  • Medium 5.5

    wifi: iwlwifi: mvm: fix 6 GHz scan construction

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix 6 GHz scan construction If more than 255 colocated APs exist for the set of all APs found during 2.4/5 GHz scanning, then the 6 GHz scan construction will loop forever…

  • Medium 5.5

    drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()

    In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() In mtk_crtc_create(), if the call to mbox_request_channel() fails then we set the "mtk_crtc->cmdq_client.chan" pointer to NU…

  • Medium 5.5

    drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported acpi_evaluate_object() may return AE_NOT_FOUND (failure), which would result in dereferencing buffer.pointer (obj) while …

  • Medium 5.5

    idpf: fix idpf_vc_core_init error path

    In the Linux kernel, the following vulnerability has been resolved: idpf: fix idpf_vc_core_init error path In an event where the platform running the device control plane is rebooted, reset is detected on the driver. It releases all the resources and waits fo…

  • Medium 5.5

    mm/slab: fix warning caused by duplicate kmem_cache creation in kmem_buckets_create

    In the Linux kernel, the following vulnerability has been resolved: mm/slab: fix warning caused by duplicate kmem_cache creation in kmem_buckets_create Commit b035f5a6d852 ("mm: slab: reduce the kmalloc() minimum alignment if DMA bouncing possible") reduced A…

  • Medium 5.5

    firmware: qcom: scm: fix a NULL-pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: fix a NULL-pointer dereference Some SCM calls can be invoked with __scm being NULL (the driver may not have been and will not be probed as there's no SCM entry in device-…

  • Medium 5.5

    usb: dwc3: fix fault at system suspend if device was already runtime suspended

    In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix fault at system suspend if device was already runtime suspended If the device was already runtime suspended then during system suspend we cannot access the device registers els…

  • Medium 5.5

    drm/panthor: Be stricter about IO mapping flags

    In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Be stricter about IO mapping flags The current panthor_device_mmap_io() implementation has two issues: 1. For mapping DRM_PANTHOR_USER_FLUSH_ID_MMIO_OFFSET, panthor_device_mmap_i…

  • Medium 5.5

    platform/x86/amd/pmc: Detect when STB is not available

    In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Detect when STB is not available Loading the amd_pmc module as: amd_pmc enable_stb=1 ...can result in the following messages in the kernel ring buffer: amd_pmc AMDI0009:…

  • Medium 5.5

    wifi: iwlwifi: mvm: don't leak a link on AP removal

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't leak a link on AP removal Release the link mapping resource in AP removal. This impacted devices that do not support the MLD API (9260 and down). On those devices, w…

  • Medium 5.5

    rpcrdma: Always release the rpcrdma_device's xa_array

    In the Linux kernel, the following vulnerability has been resolved: rpcrdma: Always release the rpcrdma_device's xa_array Dai pointed out that the xa_init_flags() in rpcrdma_add_one() needs to have a matching xa_destroy() in rpcrdma_remove_one() to release un…

  • Medium 5.5

    drm/tegra: Fix NULL vs IS_ERR() check in probe()

    In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix NULL vs IS_ERR() check in probe() The iommu_paging_domain_alloc() function doesn't return NULL pointers, it returns error pointers. Update the check to match.

  • Medium 5.5

    media: ar0521: don't overflow when checking PLL values

    In the Linux kernel, the following vulnerability has been resolved: media: ar0521: don't overflow when checking PLL values The PLL checks are comparing 64 bit integers with 32 bit ones, as reported by Coverity. Depending on the values of the variables, this m…

  • Medium 5.5

    usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and txbuf_len are uninitialized. This commit stops to print uni…

  • Medium 5.5

    drm/imagination: Break an object reference loop

    In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Break an object reference loop When remaining resources are being cleaned up on driver close, outstanding VM mappings may result in resources being leaked, due to an object r…

  • Medium 5.5

    drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL Upon failure all locks need to be dropped before returning to the user. (cherry picked from commit 7d1a4258e602ffdc…

  • Medium 5.5

    drm/xe: Fix possible exec queue leak in exec IOCTL

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix possible exec queue leak in exec IOCTL In a couple of places after an exec queue is looked up the exec IOCTL returns on input errors without dropping the exec queue ref. Fix this …

  • Medium 4.4

    io_uring/rw: fix missing NOWAIT check for O_DIRECT start write

    In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happenin…

  • Unscored —

    ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()

    In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() The per-netns IP tunnel hash table is protected by the RTNL mutex and ip_tunnel_find() is only called from the control pa…

  • Unscored —

    scsi: ufs: core: Fix another deadlock during RTC update

    In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix another deadlock during RTC update If ufshcd_rtc_work calls ufshcd_rpm_put_sync() and the pm's usage_count is 0, we will enter the runtime suspend callback. However, the …

  • Unscored —
    CVE-2024-53054 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    scsi: ufs: core: Start the RTC update work later

    In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Start the RTC update work later The RTC update work involves runtime resuming the UFS controller. Hence, only start the RTC update work after runtime power management in the …

  • Unscored —

    riscv: Prevent a bad reference count on CPU nodes

    In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent a bad reference count on CPU nodes When populating cache leaves we previously fetched the CPU device node at the very beginning. But when ACPI is enabled we go through a specif…

  • Unscored —

    tpm: Lock TPM chip in tpm_pm_suspend() first

    In the Linux kernel, the following vulnerability has been resolved: tpm: Lock TPM chip in tpm_pm_suspend() first Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called whil…

Revision history

  1. #124

    Neue Updates von Ubuntu aufgenommen

  2. #123

    Neue Updates von SUSE aufgenommen

  3. #122

    Neue Updates von Ubuntu aufgenommen

  4. #121

    Neue Updates von Ubuntu aufgenommen

  5. #120

    Neue Updates von SUSE aufgenommen

  6. #119

    Neue Updates von SUSE aufgenommen

  7. #118

    Neue Updates von IBM aufgenommen

  8. #117

    Neue Updates von Ubuntu aufgenommen

  9. #116

    Neue Updates von SUSE aufgenommen

  10. #115

    Neue Updates von SUSE aufgenommen

  11. #114

    Neue Updates von SUSE aufgenommen

  12. #113

    Neue Updates von SUSE aufgenommen

  13. #112

    Neue Updates von SUSE aufgenommen

  14. #111

    Neue Updates von SUSE aufgenommen

  15. #110

    Neue Updates von SUSE aufgenommen

  16. #109

    Neue Updates von SUSE aufgenommen

  17. #108

    Neue Updates von SUSE aufgenommen

  18. #107

    Neue Updates von SUSE aufgenommen

  19. #106

    Neue Updates von Ubuntu aufgenommen

  20. #105

    Neue Updates von Ubuntu aufgenommen

  21. #104

    Neue Updates von Ubuntu aufgenommen

  22. #103

    Neue Updates von Ubuntu aufgenommen

  23. #102

    Neue Updates von Oracle Linux aufgenommen

  24. #101

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  25. #100

    Neue Updates von Red Hat aufgenommen

References