Most recent entries from all

ALSA-2024:2394 — Important: kernel security, bug fix, and enhancement update

Affected: AlmaLinux:9: bpftool, AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core and 52 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546) * kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582) * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555) * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480) * kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448) * kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934) * kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040) * kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531) * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931) * kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023) * kernel: irdma: Improper access control (CVE-2023-25775) * Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464) * kernel: Bluetooth: HCI: global o…

bdu:2024-01589

BELL-CVE-2024-26583

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2024-avi-0334 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permet…

certfr-2024-avi-0334

EUVD-2026-345450

fkie_cve-2024-26583

In the Linux kernel, the following vulnerability has been resolved:

tls: fix race between async notify and socket close

The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data.

Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization.

Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.

GHSA-j737-8h5g-42g9

In the Linux kernel, the following vulnerability has been resolved:

tls: fix race between async notify and socket close

The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data.

Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization.

Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.

gsd-2024-26583

msrc_CVE-2024-26583 — tls: fix race between async notify and socket close

msrc_CVE-2024-26583

OESA-2024-1283 — kernel security update

Affected: openEuler:22.03-LTS: kernel

The Linux Kernel, the operating system core itself. Security Fix(es): In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed.(CVE-2023-52436) In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1…

RHSA-2024:2394 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack kernel: ovl: fix warning in ovl_create_real() kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() kernel: Bluetooth: L2CAP: Fix u8 overflow kernel: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() kernel: tracing: Fix sleeping function called from invalid context on RT kernel kernel: net: mdio: unexport __init-annotated mdio_bus_init() kernel: arm64: ftrace: consistently handle PLTs. kernel: mm/uffd: fix pte marker when fork() without fork event kernel: Bluetooth: Fix a buffer overflow in mgmt_mesh_add() kernel: tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() kernel: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead kernel: tee: add overflow check in register_shm_helper() kernel: tty: n_gsm: fix deadlock and link starvation in outgoing data path kernel: PM: hibernate: defer device probing when resuming from hibernation kernel: ext4: don't allow journal inode to have encrypt flag kernel: ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline kernel: erofs: fix order >= MAX_ORDER warning due to crafted negative i_size kernel: perf/x86/intel/uncore: F…

RHSA-2024:4352 — Red Hat Security Advisory: kernel-rt security and bug fix update

kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack kernel: PCI interrupt mapping cause oops kernel: ovl: fix leaked dentry kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios kernel: net: cdc_eem: fix tx fixup skb leak kernel: net: ti: fix UAF in tlan_remove_one kernel: net: qcom/emac: fix UAF in emac_remove kernel: udf: Fix NULL pointer dereference in udf_symlink function kernel: mISDN: fix possible use-after-free in HFC_cleanup() kernel: can: peak_pci: peak_pci_remove(): fix UAF kernel: usbnet: sanity check for maxpacket kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups kernel: tipc: fix kernel warning when sending SYN message kernel: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path kernel: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET kernel: perf/core: Bail out early if the request AUX area is out of bound kernel…

SUSE-SU-2024:2893-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2024-26583

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 131 more

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.

WID-SEC-W-2024-0459 — Linux Kernel: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen nicht spezifizierten Angriff offenzulegen oder durchzuführen.