Affected: AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240) * kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340) * kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744) * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593) * kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445) * kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603) * kernel: use after free in i2c (CVE-2019-25162) * kernel: i2c: validate user data in compat ioctl (CVE-2021-46934) * kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777) * kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477) * kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055) * kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615) * kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627) * kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307) * kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565) * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578) * kernel: net: usb: smsc75xx: Fix uninit-value access i…

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

In the Linux kernel, the following vulnerability has been resolved:

fat: fix uninitialized field in nostale filehandles

When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of the file handle must be a multiple of 4 so the file handle is actually 12 bytes long and the last two bytes remain uninitialized. This is not great at we potentially leak uninitialized information with the handle to userspace. Properly initialize the full handle length.

In the Linux kernel, the following vulnerability has been resolved:

fat: fix uninitialized field in nostale filehandles

When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of the file handle must be a multiple of 4 so the file handle is actually 12 bytes long and the last two bytes remain uninitialized. This is not great at we potentially leak uninitialized information with the handle to userspace. Properly initialize the full handle length.

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…

kernel: use after free in i2c kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() kernel: i2c: validate user data in compat ioctl kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send kernel: mtd: require write permissions for locking and badblock ioctls kernel: pid: take a reference when initializing `cad_pid` kernel: i2c: i801: Don't generate an interrupt on bus reset kernel: net: usb: fix memory leak in smsc75xx_bind kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc kernel: vt: fix memory overlapping when deleting chars in the buffer kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation kernel: uio: Fix use-after-free in uio_open kernel: pvrusb2: fix use after free on context disconnection kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors kernel: RDMA/siw: Fix connection failure handling kernel: platform/x86: think-lmi: Fix reference leak kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() kernel: net: bridge: data races indata-races in br_handle_frame_finish() kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() kernel: wifi: rt2x00: restart beacon queue when hardware reset kernel: s390/ptrace: handle setting of fpc register correctly kernel: powerpc/lib: Validate size for ve…

kernel: use after free in i2c kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() kernel: i2c: validate user data in compat ioctl kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send kernel: mtd: require write permissions for locking and badblock ioctls kernel: pid: take a reference when initializing `cad_pid` kernel: i2c: i801: Don't generate an interrupt on bus reset kernel: net: usb: fix memory leak in smsc75xx_bind kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc kernel: vt: fix memory overlapping when deleting chars in the buffer kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation kernel: uio: Fix use-after-free in uio_open kernel: pvrusb2: fix use after free on context disconnection kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors kernel: RDMA/siw: Fix connection failure handling kernel: platform/x86: think-lmi: Fix reference leak kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() kernel: net: bridge: data races indata-races in br_handle_frame_finish() kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() kernel: wifi: rt2x00: restart beacon queue when hardware reset kernel: net/sched: act_ct: fix skb leak and crash on ooo frags kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() kernel: Integer Overflow in raid5_cache_co…

An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…

Security update for the Linux Kernel

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 171 more

In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of the file handle must be a multiple of 4 so the file handle is actually 12 bytes long and the last two bytes remain uninitialized. This is not great at we potentially leak uninitialized information with the handle to userspace. Properly initialize the full handle length.

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder sonstige Auswirkungen zu verursachen.