In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc

When trying to dump VFs VSI RX/TX descriptors using debugfs there was a crash due to NULL pointer dereference in i40e_dbg_dump_desc. Added a check to i40e_dbg_dump_desc that checks if VSI type is correct for dumping RX/TX descriptors.

Affected: openEuler:20.03-LTS-SP4: kernel

The Linux Kernel, the operating system core itself. Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: hamradio: fix memory leak in mkiss_close

My local syzbot instance hit memory leak in mkiss_open()[1]. The problem was in missing free_netdev() in mkiss_close().

In mkiss_open() netdevice is allocated and then registered, but in mkiss_close() netdevice was only unregistered, but not freed.

Fail log:

BUG: memory leak unreferenced object 0xffff8880281ba000 (size 4096): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 ax0............. 00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00 .'.*............ backtrace: [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706e7e8>] alloc_netdev_mqs+0x98/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak unreferenced object 0xffff8880141a9a00 (size 96): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): e8 a2 1…

kernel: avoid cyclic entity chains due to malformed USB descriptors kernel: speculation on incompletely validated data on IBM Power9 kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c kernel: use-after-free in nouveau kernel module kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() kernel: possible use-after-free in bluetooth module kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks kernel: DoS in ccp_run_aes_gcm_cmd() function kernel: sctp: Invalid chunks may be used to remotely remove existing associations kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients kernel: stack information leak in infiniband RDMA kernel: possible leak or coruption of data residing on hugetlbfs kernel: security regression for CVE-2018-13405 kernel: fget: check that the fd still exists after getting a ref to it kernel: KVM: SVM: out-of-bounds read/write in sev_es_string_io kernel: Buffer overwrite in decode_nfs_fh function kernel: cgroup: Use open-time creds and namespace for migration perm checks kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses kernel: Lin…

Security update for the Linux Kernel

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 111 more

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc When trying to dump VFs VSI RX/TX descriptors using debugfs there was a crash due to NULL pointer dereference in i40e_dbg_dump_desc. Added a check to i40e_dbg_dump_desc that checks if VSI type is correct for dumping RX/TX descriptors.

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder unspezifische Angriffe durchzuführen.