Debian Linux vulnerabilities

CVE-2023-32248 [HIGH] CVE-2023-32248: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

CVE-2021-3656 [HIGH] CVE-2021-3656: linux - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization.... A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/V

CVE-2025-22040 [HIGH] CVE-2025-22040: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is added to channel list of session. This patch check reference count of session before freeing it. Scope: local bo

CVE-2023-32247 [HIGH] CVE-2023-32247: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Scope: local bookworm: resolved (fixed

CVE-2021-3653 [HIGH] CVE-2021-3653: linux - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization.... A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for

CVE-2019-10639 [HIGH] CVE-2019-10639: linux - The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information... The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination I

CVE-2015-8787 [HIGH] CVE-2015-8787: linux - The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linu... The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604. Scope: local bookworm: res

CVE-2021-4157 [HIGH] CVE-2021-4157: linux - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel ... An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (f

CVE-2021-41073 [HIGH] CVE-2021-41073: linux - loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows loc... loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc//maps for exploitation. Scope: local bookworm: resolved (fixed in 5.14.6-2) bullseye: resolved (fixed in 5.10.46-5) forky: resolved (fixed in 5.14.6-2) sid: r

CVE-2020-27786 [HIGH] CVE-2020-27786: linux - A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker... A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The hi

CVE-2022-2196 [MEDIUM] CVE-2022-2196: linux - A regression exists in the Linux Kernel within KVM: nVMX that allowed for specul... A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We re

CVE-2023-2008 [HIGH] CVE-2023-2008: linux - A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw ... A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

CVE-2021-34866 [HIGH] CVE-2021-34866: linux - This vulnerability allows local attackers to escalate privileges on affected ins... This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of

CVE-2016-2384 [MEDIUM] CVE-2016-2384: linux - Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c... Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) for

CVE-2017-2671 [MEDIUM] CVE-2017-2671: linux - The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 i... The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call. Scope: local bookworm: resolved (

CVE-2023-3812 [HIGH] CVE-2023-3812: linux - An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP devi... An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.0.8-1) bullseye: resolved (fixed in 5

CVE-2023-38429 [CRITICAL] CVE-2023-38429: linux - An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c ... An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved

CVE-2020-8835 [HIGH] CVE-2020-8835: linux - In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) di... In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fix

CVE-2016-2117 [HIGH] CVE-2016-2117: linux - The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux... The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. Scope: local bookworm: resolved (fixed in 4.5.2-1) bullseye: resolved (fixed in 4.5.2-1) forky: resolved (fixed in 4.5.2-1) s

CVE-2016-5244 [HIGH] CVE-2016-5244: linux - The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6... The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message. Scope: local bookworm: resolved (fixed in 4.6.2-1) bullseye: resolved (fixed in 4.6.2-1) forky: resolved (fixed in 4.6.2-1) sid