Affected: Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: fix double-free bug

The storage for the TLV PC register data wasn't done like all the other storage in the drv->fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done differently, explicitly NULL'ing it out after the free, since otherwise there's a nasty double-free bug here if a file fails to load after this has been parsed, and we get another free later (e.g. because no other file exists.) Fix that by adding the missing NULL assignment.

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: fix double-free bug

The storage for the TLV PC register data wasn't done like all the other storage in the drv->fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done differently, explicitly NULL'ing it out after the free, since otherwise there's a nasty double-free bug here if a file fails to load after this has been parsed, and we get another free later (e.g. because no other file exists.) Fix that by adding the missing NULL assignment.

kernel: use after free in i2c kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() kernel: i2c: validate user data in compat ioctl kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send kernel: mtd: require write permissions for locking and badblock ioctls kernel: pid: take a reference when initializing `cad_pid` kernel: i2c: i801: Don't generate an interrupt on bus reset kernel: net: usb: fix memory leak in smsc75xx_bind kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc kernel: vt: fix memory overlapping when deleting chars in the buffer kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation kernel: uio: Fix use-after-free in uio_open kernel: pvrusb2: fix use after free on context disconnection kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors kernel: RDMA/siw: Fix connection failure handling kernel: platform/x86: think-lmi: Fix reference leak kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() kernel: net: bridge: data races indata-races in br_handle_frame_finish() kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() kernel: wifi: rt2x00: restart beacon queue when hardware reset kernel: s390/ptrace: handle setting of fpc register correctly kernel: powerpc/lib: Validate size for ve…

kernel: use after free in i2c kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() kernel: i2c: validate user data in compat ioctl kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send kernel: mtd: require write permissions for locking and badblock ioctls kernel: pid: take a reference when initializing `cad_pid` kernel: i2c: i801: Don't generate an interrupt on bus reset kernel: net: usb: fix memory leak in smsc75xx_bind kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc kernel: vt: fix memory overlapping when deleting chars in the buffer kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation kernel: uio: Fix use-after-free in uio_open kernel: pvrusb2: fix use after free on context disconnection kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors kernel: RDMA/siw: Fix connection failure handling kernel: platform/x86: think-lmi: Fix reference leak kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() kernel: net: bridge: data races indata-races in br_handle_frame_finish() kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() kernel: wifi: rt2x00: restart beacon queue when hardware reset kernel: net/sched: act_ct: fix skb leak and crash on ooo frags kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() kernel: Integer Overflow in raid5_cache_co…

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 66 more

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix double-free bug The storage for the TLV PC register data wasn't done like all the other storage in the drv->fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done differently, explicitly NULL'ing it out after the free, since otherwise there's a nasty double-free bug here if a file fails to load after this has been parsed, and we get another free later (e.g. because no other file exists.) Fix that by adding the missing NULL assignment.

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen, seine Privilegien eskalieren oder einen nicht näher spezifizierten Angriff durchzuführen.