Debian Linux vulnerabilities

CVE-2023-52805 [HIGH] CVE-2023-52805: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: fix ar... In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diAlloc Currently there is not check against the agno of the iag while allocating new inodes to avoid fragmentation problem. Added the check which is required. Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: resolved (fixed in 5.10.205-1) forky: reso

CVE-2023-52836 [HIGH] CVE-2023-52836: linux - In the Linux kernel, the following vulnerability has been resolved: locking/ww_... In the Linux kernel, the following vulnerability has been resolved: locking/ww_mutex/test: Fix potential workqueue corruption In some cases running with the test-ww_mutex code, I was seeing odd behavior where sometimes it seemed flush_workqueue was returning before all the work threads were finished. Often this would cause strange crashes as the mutexes would be freed

CVE-2021-47063 [HIGH] CVE-2021-47063: linux - In the Linux kernel, the following vulnerability has been resolved: drm: bridge... In the Linux kernel, the following vulnerability has been resolved: drm: bridge/panel: Cleanup connector on bridge detach If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects in the call to drm_mode_config_cleanup(). However, since our drm_connector is devm-allocated, by the time drm_mo

CVE-2024-50055 [HIGH] CVE-2024-50055: linux - In the Linux kernel, the following vulnerability has been resolved: driver core... In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API bus_register() For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv with NULL after the first free. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: resolved (fixed

CVE-2024-36015 [HIGH] CVE-2024-36015: linux - In the Linux kernel, the following vulnerability has been resolved: ppdev: Add ... In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in register_device In register_device, the return value of ida_simple_get is unchecked, in witch ida_simple_get will use an invalid index value. To address this issue, index should be checked after ida_simple_get. When the index value is abnormal, a warning message should be

CVE-2021-47656 [HIGH] CVE-2021-47656: linux - In the Linux kernel, the following vulnerability has been resolved: jffs2: fix ... In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result, an error is returned in jffs2_scan_eraseblock(). jffs2_clear_xattr_s

CVE-2024-53166 [HIGH] CVE-2024-53166: linux - In the Linux kernel, the following vulnerability has been resolved: block, bfq:... In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfq_limit_depth() Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq from bic without the lock, this can lead to UAF if the io_context is shared by multiple tasks. For example, test bfq

CVE-2022-48950 [HIGH] CVE-2022-48950: linux - In the Linux kernel, the following vulnerability has been resolved: perf: Fix p... In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pending_task() UaF Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases: - the task_work was already queued before destroying the event; - destroying the event itself queues the task_work. The first cannot be solv

CVE-2021-47310 [HIGH] CVE-2021-47310: linux - In the Linux kernel, the following vulnerability has been resolved: net: ti: fi... In the Linux kernel, the following vulnerability has been resolved: net: ti: fix UAF in tlan_remove_one priv is netdev private data and it cannot be used after free_netdev() call. Using priv after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in

CVE-2024-53165 [HIGH] CVE-2024-53165: linux - In the Linux kernel, the following vulnerability has been resolved: sh: intc: F... In the Linux kernel, the following vulnerability has been resolved: sh: intc: Fix use-after-free bug in register_intc_controller() In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free. To fix this, let's only add it to the list after everything has succeeded. Scope: local bookworm: resolved (f

CVE-2024-57792 [HIGH] CVE-2024-57792: linux - In the Linux kernel, the following vulnerability has been resolved: power: supp... In the Linux kernel, the following vulnerability has been resolved: power: supply: gpio-charger: Fix set charge current limits Fix set charge current limits for devices which allow to set the lowest charge current limit to be greater zero. If requested charge current limit is below lowest limit, the index equals current_limit_map_size which leads to accessing memory b

CVE-2024-26694 [HIGH] CVE-2024-26694: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi... In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix double-free bug The storage for the TLV PC register data wasn't done like all the other storage in the drv->fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done differently, explicitly NULL'ing it out after the free, since otherwise there's

CVE-2022-49015 [HIGH] CVE-2022-49015: linux - In the Linux kernel, the following vulnerability has been resolved: net: hsr: F... In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved (fixed in 5.10.158-1) forky: resolved (fixed in 6.0.12-1) sid: resolved

CVE-2021-47311 [HIGH] CVE-2021-47311: linux - In the Linux kernel, the following vulnerability has been resolved: net: qcom/e... In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emac_remove adpt is netdev private data and it cannot be used after free_netdev() call. Using adpt after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed

CVE-2024-50007 [HIGH] CVE-2024-50007: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: asihp... In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. We shouldn't trust it blindly. This patch adds a sanity check of the array index to fit in the array size. Scope: local bookworm: re

CVE-2024-26599 [HIGH] CVE-2024-26599: linux - In the Linux kernel, the following vulnerability has been resolved: pwm: Fix ou... In the Linux kernel, the following vulnerability has been resolved: pwm: Fix out-of-bounds access in of_pwm_single_xlate() With args->args_count == 2 args->args[2] is not defined. Actually the flags are contained in args->args[1]. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved forky: resolved (fixed in 6.6.15-1) sid: resolved (fixed in 6.6.15-1

CVE-2023-52837 [HIGH] CVE-2023-52837: linux - In the Linux kernel, the following vulnerability has been resolved: nbd: fix ua... In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_open Commit 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set disk->private_data as NULL as before. UAF may be triggered in nbd_open() if someone tries to open nbd device right after nbd_put() since nbd has been f

CVE-2023-52601 [HIGH] CVE-2023-52601: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: fix ar... In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbAdjTree Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-ment

CVE-2023-52602 [HIGH] CVE-2023-52602: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: fix sl... In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds Read in dtSearch Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error. Dave: Set return code to -EIO Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixe

CVE-2024-49986 [HIGH] CVE-2024-49986: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8... In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors x86_android_tablet_remove() frees the pdevs[] array, so it should not be used after calling x86_android_tablet_remove(). When platform_device_register() fails, store the pdevs[x] PTR_ERR() value into the local r