Most recent entries from all

ALSA-2024:0897 — Important: kernel security update

Affected: AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 14 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: net/sched: sch_hfsc UAF (CVE-2023-4623) * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921) * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817) * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871) * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646) * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545) * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858) * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073) * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838) * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166) * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176) * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list (CVE-2023-5717) * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356) * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535) * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536) * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606) * kernel: OOB Access in smb2_dump_detail (CVE-2023-661…

bdu:2024-00674

BELL-CVE-2024-0646

Affected: Alpaquita:23: linux-lts, Alpaquita:stream: linux-lts

certfr-2024-avi-0115 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de RedHat. Certaines d'…

certfr-2024-avi-0115

EUVD-2026-349177

fkie_cve-2024-0646

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

GHSA-qmff-49xc-7rf6

gsd-2024-0646

ICSA-25-226-15 — Siemens SINEC OS

In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Harden accesses to the reset domains

Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave.

Add an internal consistency check before any such domains descriptors accesses. In the Linux kernel, the following vulnerability has been resolved:

media: lgdt3306a: Add a check against null-pointer-def

The driver should check whether the client provides the platform_data.

The following log reveals it:

[ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90 In the Linux kernel, the following vulnerability has been resolved: netfilter:…

msrc_CVE-2024-0646 — Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

msrc_CVE-2024-0646

RHSA-2024:0723 — Red Hat Security Advisory: kernel security update

kernel: sctp: fail if no bound addresses can be used for a given scope kernel: NULL pointer dereference in nvmet_tcp_build_iovec kernel: NULL pointer dereference in nvmet_tcp_execute_request kernel: NULL pointer dereference in __nvmet_req_complete kernel: Out-Of-Bounds Read vulnerability in smbCalcSize kernel: OOB Access in smb2_dump_detail kernel: use-after-free in IPv4 IGMP kernel: refcount leak in ctnetlink_create_conntrack() kernel: drivers/usb/storage/ene_ub6250.c kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

RHSA-2024:0897 — Red Hat Security Advisory: kernel security update

kernel: nfp: use-after-free in area_cache_get() kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip kernel: HID: check empty report_list in hid_validate_values() kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() kernel: NULL pointer dereference in can_rcv_filter kernel: Slab-out-of-bound read in compare_netdev_and_ip kernel: net/sched: sch_hfsc UAF kernel: use-after-free in sch_qfq network scheduler kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list kernel: NULL pointer dereference in nvmet_tcp_build_iovec kernel: NULL pointer dereference in nvmet_tcp_execute_request kernel: NULL pointer dereference in __nvmet_req_complete kernel: Out-Of-Bounds Read vulnerability in smbCalcSize kernel: OOB Access in smb2_dump_detail kernel: inactive elements in nft_pipapo_walk kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c kernel: IGB driver inadequate buffer size for frames larger than MTU kernel: SEV-ES local priv escalation kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

SSA-613116 — SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1

firmware: arm_scmi: Harden accesses to the reset domains

Add an internal consistency check before any such domains descriptors accesses. In the Linux kernel, the following vulnerability has been resolved:

media: lgdt3306a: Add a check against null-pointer-def

The driver should check whether the client provides the platform_data.

The following log reveals it:

UBUNTU-CVE-2024-0646

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 129 more

WID-SEC-W-2024-0136 — Linux Kernel: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder seine Privilegien zu erweitern.