Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder andere nicht spezifizierte Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 52

  • Critical 9.8

    drbd: add missing kref_get in handle_write_conflicts

    In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same s…

  • Critical 9.8

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SE…

  • Critical 9.1

    smb3: fix for slab out of bounds on mount to ksmbd

    In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see …

  • High 8.8

    iommufd: Prevent ALIGN() overflow

    In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a co…

  • High 7.8

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit

    In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideall…

  • High 7.8

    jfs: upper bound check of tree index in dbAllocAG

    In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a…

  • High 7.8

    drm/xe: Make dma-fences compliant with the safe access rules

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace cl…

  • High 7.8

    gfs2: Validate i_depth for exhash directories

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - di…

  • High 7.8

    hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()

    In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ==========================================================…

  • High 7.8

    hfs: fix slab-out-of-bounds in hfs_bnode_read()

    In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_le…

  • High 7.8

    net: kcm: Fix race condition in kcm_unattach()

    In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time. kcm_unattach() is missing a check of …

  • High 7.8

    sctp: linearize cloned gso packets in sctp_rcv

    In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported …

  • High 7.8

    habanalabs: fix UAF in export_dmabuf()

    In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is return…

  • High 7.8

    io_uring/net: commit partial buffers on retry

    In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and in…

  • High 7.3

    media: venus: Fix OOB read due to missing payload bound check

    In the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properti…

  • High 7.3

    comedi: fix race between polling and detaching

    In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll re…

  • High 7.1

    fs/ntfs3: Add sanity check for file name

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.

  • High 7.1

    hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()

    In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================…

  • Unscored —

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), …

  • Unscored —

    mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()

    In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurren…

  • Unscored —

    i2c: core: Fix double-free of fwnode in i2c_unregister_device()

    In the Linux kernel, the following vulnerability has been resolved: i2c: core: Fix double-free of fwnode in i2c_unregister_device() Before commit df6d7277e552 ("i2c: core: Do not dereference fwnode in struct device"), i2c_unregister_device() only called fwnod…

  • Unscored —

    hv_netvsc: Fix panic during namespace deletion with VF

    In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, def…

  • Unscored —

    net/sched: ets: use old 'nbands' while purging unused classes

    In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in …

  • Unscored —

    userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry

    In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the en…

  • Unscored —

    x86/fpu: Fix NULL dereference in avx512_status()

    In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix NULL dereference in avx512_status() Problem ------- With CONFIG_X86_DEBUG_FPU enabled, reading /proc/[kthread]/arch_status causes a warning and a NULL pointer dereference. This i…

  • Unscored —

    drm/xe/migrate: prevent infinite recursion

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent infinite recursion If the buf + offset is not aligned to XE_CAHELINE_BYTES we fallback to using a bounce buffer. However the bounce buffer here is allocated on the sta…

  • Unscored —

    pNFS: Fix uninited ptr deref in block/scsi layout

    In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encodin…

  • Unscored —

    exfat: add cluster chain loop check for dir

    In the Linux kernel, the following vulnerability has been resolved: exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. (1) Condition for exfat_count_dir_entries() to loop inf…

  • Unscored —

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar

    In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and…

  • Unscored —

    media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()

    In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on m…

  • Unscored —

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_del…

  • Unscored —

    MIPS: Don't crash in stack_top() for tasks without ABI or vDSO

    In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_to…

  • Unscored —

    jfs: Regular file corruption check

    In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.

  • Unscored —

    scsi: bfa: Double-free fix

    In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during dri…

  • Unscored —

    scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_d…

  • Unscored —

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr

    In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missin…

  • Unscored —

    fbdev: fix potential buffer overflow in do_register_framebuffer()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All ar…

  • Unscored —

    rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access

    In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, t…

  • Unscored —

    drm/amd/pm: fix null pointer access

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix null pointer access Writing a string without delimiters (' ', '\n', '\0') to the under gpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile will result in a n…

  • Unscored —

    ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduc…

  • Unscored —

    loop: Avoid updating block size under exclusive owner

    In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch betwee…

  • Unscored —

    smb/server: avoid deadlock when linking with ReplaceIfExists

    In the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_…

  • Unscored —

    hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()

    In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() a…

  • Unscored —

    hfs: fix general protection fault in hfs_find_init()

    In the Linux kernel, the following vulnerability has been resolved: hfs: fix general protection fault in hfs_find_init() The hfs_find_init() method can trigger the crash if tree pointer is NULL: [ 45.746290][ T9787] Oops: general protection fault, probably fo…

  • Unscored —

    net: hibmcge: fix the division by zero issue

    In the Linux kernel, the following vulnerability has been resolved: net: hibmcge: fix the division by zero issue When the network port is down, the queue is released, and ring->len is 0. In debugfs, hbg_get_queue_used_num() will be called, which may lead to a…

  • Unscored —

    net: hibmcge: fix rtnl deadlock issue

    In the Linux kernel, the following vulnerability has been resolved: net: hibmcge: fix rtnl deadlock issue Currently, the hibmcge netdev acquires the rtnl_lock in pci_error_handlers.reset_prepare() and releases it in pci_error_handlers.reset_done(). However, i…

  • Unscored —

    netfilter: ctnetlink: fix refcount leak on table dump

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsig…

  • Unscored —

    LoongArch: BPF: Fix jump offset calculation in tailcall

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset …

  • Unscored —

    net: usb: asix_devices: add phy_mask for ax88772 mdio bus

    In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00…

  • Unscored —

    net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect

    In the Linux kernel, the following vulnerability has been resolved: net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect After the call to phy_disconnect() netdev->phydev is reset to NULL. So fixed_phy_unregister() would be called wit…

  • Unscored —

    netlink: avoid infinite retry looping in netlink_unicast()

    In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to …

  • Unscored —

    ALSA: usb-audio: Validate UAC3 power domain descriptors, too

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious …

Revision history

  1. #119

    Neue Updates von SUSE aufgenommen

  2. #118

    Neue Updates von SUSE aufgenommen

  3. #117

    Neue Updates von SUSE aufgenommen

  4. #116

    Neue Updates von Ubuntu aufgenommen

  5. #115

    Neue Updates von SUSE aufgenommen

  6. #114

    Neue Updates von SUSE und Ubuntu aufgenommen

  7. #113

    Neue Updates von Ubuntu aufgenommen

  8. #112

    Neue Updates von Ubuntu aufgenommen

  9. #111

    Neue Updates von Ubuntu aufgenommen

  10. #110

    Neue Updates von Ubuntu aufgenommen

  11. #109

    Neue Updates von Ubuntu aufgenommen

  12. #108

    Neue Updates von Ubuntu aufgenommen

  13. #107

    Neue Updates von Ubuntu aufgenommen

  14. #106

    Neue Updates von Ubuntu aufgenommen

  15. #105

    Neue Updates von Dell aufgenommen

  16. #104

    Neue Updates von Ubuntu aufgenommen

  17. #103

    Neue Updates von Ubuntu aufgenommen

  18. #102

    Neue Updates von Ubuntu aufgenommen

  19. #101

    Neue Updates von Ubuntu aufgenommen

  20. #100

    Neue Updates von Ubuntu aufgenommen

  21. #99

    Neue Updates von Ubuntu aufgenommen

  22. #98

    Neue Updates von Ubuntu aufgenommen

  23. #97

    Neue Updates von IBM aufgenommen

  24. #96

    Neue Updates von Ubuntu aufgenommen

  25. #95

    Neue Updates von Siemens aufgenommen

References