Debian Linux vulnerabilities

CVE-2024-49876 [HIGH] CVE-2024-49876: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix... In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix UAF around queue destruction We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more work workqueue still being alive leading to various UAF splats. Add a fini s

CVE-2024-49880 [HIGH] CVE-2024-49880: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix o... In the Linux kernel, the following vulnerability has been resolved: ext4: fix off by one issue in alloc_flex_gd() Wesley reported an issue: ================================================================== EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks ------------[ cut here ]------------ kernel BUG at fs/ext4/resize.c:324! CPU: 9 UID: 0 PID: 3576 Com

CVE-2022-48943 [HIGH] CVE-2022-48943: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mm... In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be rese

CVE-2022-49694 [HIGH] CVE-2022-49694: linux - In the Linux kernel, the following vulnerability has been resolved: block: disa... In the Linux kernel, the following vulnerability has been resolved: block: disable the elevator int del_gendisk The elevator is only used for file system requests, which are stopped in del_gendisk. Move disabling the elevator and freeing the scheduler tags to the end of del_gendisk instead of doing that work in disk_release and blk_cleanup_queue to avoid a use after f

CVE-2022-49127 [HIGH] CVE-2022-49127: linux - In the Linux kernel, the following vulnerability has been resolved: ref_tracker... In the Linux kernel, the following vulnerability has been resolved: ref_tracker: implement use-after-free detection Whenever ref_tracker_dir_init() is called, mark the struct ref_tracker_dir as dead. Test the dead status from ref_tracker_alloc() and ref_tracker_free() This should detect buggy dev_put()/dev_hold() happening too late in netdevice dismantle process. Scop

CVE-2022-49669 [HIGH] CVE-2022-49669: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix ... In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race on unaccepted mptcp sockets When the listener socket owning the relevant request is closed, it frees the unaccepted subflows and that causes later deletion of the paired MPTCP sockets. The mptcp socket's worker can run in the time interval between such delete operations. When that happ

CVE-2024-56693 [HIGH] CVE-2024-56693: linux - In the Linux kernel, the following vulnerability has been resolved: brd: defer ... In the Linux kernel, the following vulnerability has been resolved: brd: defer automatic disk creation until module initialization succeeds My colleague Wupeng found the following problems during fault injection: BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP

CVE-2024-56600 [HIGH] CVE-2024-56600: linux - In the Linux kernel, the following vulnerability has been resolved: net: inet6:... In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear th

CVE-2024-56601 [HIGH] CVE-2024-56601: linux - In the Linux kernel, the following vulnerability has been resolved: net: inet: ... In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk poin

CVE-2021-47254 [HIGH] CVE-2021-47254: linux - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix u... In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in gfs2_glock_shrink_scan The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to remove the glock from the lru list in __gfs2_glock_put(). On the shrink scan path, the same flag is cleared under lru_lock but because of cond_resched_lock(&lru_lock) in gfs

CVE-2024-50222 [HIGH] CVE-2024-50222: linux - In the Linux kernel, the following vulnerability has been resolved: iov_iter: f... In the Linux kernel, the following vulnerability has been resolved: iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP generic/077 on x86_32 CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP=y with highmem, on huge=always tmpfs, issues a warning and then hangs (interruptibly): WARNING: CPU: 5 PID: 3517 at mm/highmem.c:622 kunmap_local_indexed+0x62/0xc9 CPU: 5 UID: 0 P

CVE-2023-52509 [HIGH] CVE-2023-52509: linux - In the Linux kernel, the following vulnerability has been resolved: ravb: Fix u... In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // fre

CVE-2023-52840 [HIGH] CVE-2023-52840: linux - In the Linux kernel, the following vulnerability has been resolved: Input: syna... In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Scope: local bookworm: resolved (fixed in 6.1.

CVE-2021-47520 [HIGH] CVE-2021-47520: linux - In the Linux kernel, the following vulnerability has been resolved: can: pch_ca... In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_skb(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is dereferenced just after the call netif_receive_skb(skb). Reordering the lines solves the issue. Scope: local bookworm: resolve

CVE-2024-56605 [HIGH] CVE-2024-56605: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-a

CVE-2024-26723 [HIGH] CVE-2024-26723: linux - In the Linux kernel, the following vulnerability has been resolved: lan966x: Fi... In the Linux kernel, the following vulnerability has been resolved: lan966x: Fix crash when adding interface under a lag There is a crash when adding one of the lan966x interfaces under a lag interface. The issue can be reproduced like this: ip link add name bond0 type bond miimon 100 mode balance-xor ip link set dev eth0 master bond0 The reason is because when adding

CVE-2024-49984 [HIGH] CVE-2024-49984: linux - In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Pr... In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into. Scope: local bookworm: resolved bullseye: resolved forky: res

CVE-2023-52987 [HIGH] CVE-2023-52987: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write() The "id" comes from the user. Change the type to unsigned to prevent an array underflow. Scope: local bookworm: resolved (fixed in 6.1.11-1) bullseye: resolved forky: resolved (fixed in 6.1.11-1) sid: resolved (fixed in 6.

CVE-2023-52795 [HIGH] CVE-2023-52795: linux - In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa:... In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free. Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: resolved forky: r

CVE-2022-48695 [HIGH] CVE-2022-48695: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3s... In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0 Scope: local bookworm: resolved (fixed in 5.19.11-1) bul