Most recent entries from all

ALSA-2024:4211 — Important: kernel security and bug fix update

Affected: AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555) * kernel:TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001) * kernel: ovl: fix leaked dentry (CVE-2021-46972) * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073) * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560) * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675) * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759) * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804) * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907) * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906) * kernel: powerpc/powernv: Add a null pointer check in opal_event_init() (CVE-2023-52686) * kernel: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (CVE-2023-52675) * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090) * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464) * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735) * kernel: mptcp: fix data re-injection from stale subflow (CVE-202…

bdu:2025-03927

BELL-CVE-2024-26906

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2024-avi-0381 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permet…

certfr-2024-avi-0381

EUVD-2026-316942

fkie_cve-2024-26906

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()

When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported:

BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:copy_from_kernel_nofault+0x6f/0x110 ...... Call Trace: <TASK> ? copy_from_kernel_nofault+0x6f/0x110 bpf_probe_read_kernel+0x1d/0x50 bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d trace_call_bpf+0xc5/0x1c0 perf_call_bpf_enter.isra.0+0x69/0xb0 perf_syscall_enter+0x13e/0x200 syscall_trace_enter+0x188/0x1c0 do_syscall_64+0xb5/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ...... ---[ end trace 0000000000000000 ]---

The oops is triggered when:

1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall page and invokes copy_from_kernel_nofault() which in turn calls __get_user_asm().

2) Because the vsyscall page address is not readable from kernel space, a page fault exception is triggered accordingly.

3) handle_page_fault() considers the vsyscall page address as a user space address instea…

GHSA-h4jh-5vqp-vw3p

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()

When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported:

The oops is triggered when:

1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall page and invokes copy_from_kernel_nofault() which in turn calls __get_user_asm().

2) Because the vsyscall page address is not readable from kernel space, a page fault exception is triggered accordingly.

3) handle_page_fault() considers the vsyscall page address as a user space address instea…

gsd-2024-26906

ICSA-24-102-01 — Siemens SIMATIC S7-1500 TM MFP

An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…

RHSA-2024:4211 — Red Hat Security Advisory: kernel security and bug fix update

kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack kernel: PCI interrupt mapping cause oops kernel: ovl: fix leaked dentry kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios kernel: net: cdc_eem: fix tx fixup skb leak kernel: net: ti: fix UAF in tlan_remove_one kernel: net: qcom/emac: fix UAF in emac_remove kernel: udf: Fix NULL pointer dereference in udf_symlink function kernel: mISDN: fix possible use-after-free in HFC_cleanup() kernel: can: peak_pci: peak_pci_remove(): fix UAF kernel: usbnet: sanity check for maxpacket kernel: block: null_blk: end timed out poll request kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups kernel: crypto: s390/aes - Fix buffer overread in CTR mode kernel: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() kernel: powerpc/powernv: Add a null pointer check in opal_event_init() kernel: tipc: fix kernel warning when sending SYN message kernel: net/usb: kalmia: Don&…

RHSA-2024:4352 — Red Hat Security Advisory: kernel-rt security and bug fix update

kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack kernel: PCI interrupt mapping cause oops kernel: ovl: fix leaked dentry kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios kernel: net: cdc_eem: fix tx fixup skb leak kernel: net: ti: fix UAF in tlan_remove_one kernel: net: qcom/emac: fix UAF in emac_remove kernel: udf: Fix NULL pointer dereference in udf_symlink function kernel: mISDN: fix possible use-after-free in HFC_cleanup() kernel: can: peak_pci: peak_pci_remove(): fix UAF kernel: usbnet: sanity check for maxpacket kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups kernel: tipc: fix kernel warning when sending SYN message kernel: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path kernel: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET kernel: perf/core: Bail out early if the request AUX area is out of bound kernel…

SSA-265688 — SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1

SUSE-SU-2024:1642-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2024-26906

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15 and 107 more

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:copy_from_kernel_nofault+0x6f/0x110 ...... Call Trace: <TASK> ? copy_from_kernel_nofault+0x6f/0x110 bpf_probe_read_kernel+0x1d/0x50 bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d trace_call_bpf+0xc5/0x1c0 perf_call_bpf_enter.isra.0+0x69/0xb0 perf_syscall_enter+0x13e/0x200 syscall_trace_enter+0x188/0x1c0 do_syscall_64+0xb5/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ...... ---[ end trace 0000000000000000 ]--- The oops is triggered when: 1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall page and invokes copy_from_kernel_nofault() which in turn calls __get_user_asm(). 2) Because the vsyscall page address is not readable from kernel space, a page fault exception is triggered accordingly. 3) handle_page_fault() considers the vsyscall page address as a user space address instead of a…

WID-SEC-W-2024-0920 — Linux Kernel: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen oder einen nicht spezifizierten Angriff durchzuführen.