Most recent entries from all

ALSA-2021:1093 — Important: kernel security, bug fix, and enhancement update

Affected: AlmaLinux:8: kernel-abi-whitelists, AlmaLinux:8: kernel-tools-libs-devel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: use after free in eventpoll.c may lead to escalation of privilege (CVE-2020-0466)

* kernel: SCSI target (LIO) write to any block on ILO backstore (CVE-2020-28374)

* kernel: Use after free via PI futex state (CVE-2021-3347)

* kernel: race conditions caused by wrong locking in net/vmw_vsock/af_vsock.c (CVE-2021-26708)

* kernel: out-of-bounds read in libiscsi module (CVE-2021-27364)

* kernel: heap buffer overflow in the iSCSI subsystem (CVE-2021-27365)

* Kernel: KVM: host stack overflow due to lazy update IOAPIC (CVE-2020-27152)

* kernel: iscsi: unrestricted access to sessions and handles (CVE-2021-27363)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* race condition when creating child sockets from syncookies (BZ#1915529)

* On System Z, a hash needs state randomized for entropy extraction (BZ#1915816)

* scsi: target: core_tmr_abort_task() reporting multiple aborts for the same se_cmd->tag (BZ#1918354)

* [mlx5] VF interface stats are not reflected in "ip -s link show" / "ifconfig <vf>" commands (BZ#1921060)

* Win10 guest automatic reboot after migration in Win10 and WSL2 on Intel hosts (BZ#1923281)

* [AlmaLinux 8.3] Repeated messages - Unable to burst-read optrom segment (BZ#1924222)

* Backport…

bdu:2021-02593

Withdrawn: BELL-CVE-2021-3347 — CVE-2021-3347 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-077 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Certaines d'entre elles permettent à un…

certfr-2021-avi-077

cnvd-2021-14804

EUVD-2026-270644

fkie_cve-2021-3347

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.

GHSA-8r42-h5pm-2vw2

gsd-2021-3347

msrc_CVE-2021-3347 — An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault…

msrc_CVE-2021-3347

OESA-2021-1086 — kernel security update

Affected: openEuler:20.03-LTS: kernel

The Linux Kernel, the operating system core itself. Security Fix(es): In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.(CVE-2020-28374) An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.(CVE-2020-29568) In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-119770583(CVE-2020-27068) A flaw was found in the Linux kernels implementation of MIDI, where an attacker with a local account and the permissions to issue an ioctl commands to midi devices, could trigger a use-afte…

openSUSE-SU-2021:0241-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

RHSA-2021:1081 — Red Hat Security Advisory: kernel-rt security and bug fix update

kernel: use after free in eventpoll.c may lead to escalation of privilege Kernel: KVM: host stack overflow due to lazy update IOAPIC kernel: SCSI target (LIO) write to any block on ILO backstore kernel: Use after free via PI futex state kernel: race conditions caused by wrong locking in net/vmw_vsock/af_vsock.c kernel: iscsi: unrestricted access to sessions and handles kernel: out-of-bounds read in libiscsi module kernel: heap buffer overflow in the iSCSI subsystem

SUSE-SU-2021:0347-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2021-3347

Affected: Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:14.04:LTS: linux, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-aws-hwe, Ubuntu:16.04:LTS: linux-azure, Ubuntu:16.04:LTS: linux-gcp, Ubuntu:16.04:LTS: linux-hwe and 67 more

WID-SEC-W-2023-0063 — Juniper Junos Space: Mehrere Schwachstellen

Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Juniper Junos Space ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, beliebigen Code auszuführen und seine Privilegien zu erweitern.