Debian Linux vulnerabilities

CVE-2024-47692 [MEDIUM] CVE-2024-47692: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: retur... In the Linux kernel, the following vulnerability has been resolved: nfsd: return -EINVAL when namelen is 0 When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdup_user() to return ZERO_SIZE_PTR. When we access the name.data that has been assigned the value of ZERO_SIZE_PTR in nfs4_client_to_reclaim(),

CVE-2023-1192 [MEDIUM] CVE-2023-1192: linux - A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Li... A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service. Scope: local bookworm: resolved (fix

CVE-2023-1193 [MEDIUM] CVE-2023-1193: linux - A use-after-free flaw was found in setup_async_work in the KSMBD implementation ... A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: res

CVE-2014-7145 [HIGH] CVE-2014-7145: linux - The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 al... The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals. Scope: local bookworm: resolved (fixed in 3.16.3-1) bullseye: resolved (fixed in 3

CVE-2024-47726 [MEDIUM] CVE-2024-47726: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait dio completion It should wait all existing dio write IOs before block removal, otherwise, previous direct write IO may overwrite data in the block which may be reused by other inode. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved (fixed in 5.10.237-1) forky

CVE-2024-35853 [MEDIUM] CVE-2024-35853: linux - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spec... In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash The rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters. If the migration fails, the

CVE-2021-47189 [MEDIUM] CVE-2021-47189: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory ordering between normal and ordered work functions Ordered work functions aren't guaranteed to be handled by the same thread which executed the normal work functions. The only way execution between normal/ordered functions is synchronized is via the WORK_DONE_BIT, unfortunately the

CVE-2019-15916 [HIGH] CVE-2019-15916: linux - An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak... An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service. Scope: local bookworm: resolved (fixed in 4.19.28-1) bullseye: resolved (fixed in 4.19.28-1) forky: resolved (fixed in 4.19.28-1) sid: resolved (fixed in 4.19.28-1) trixie: resolved (fixed in 4.19.28

CVE-2017-10810 [HIGH] CVE-2017-10810: linux - Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/v... Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service (memory consumption) by triggering object-initialization failures. Scope: local bookworm: resolved (fixed in 4.11.11-1) bullseye: resolved (fixed in 4.11.11-1) forky: resolved (fixed in 4.11.11

CVE-2019-19049 [HIGH] CVE-2019-19049: linux - A memory leak in the unittest_data_add() function in drivers/of/unittest.c in th... A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this because unittest.c can only be reached during boot Scope: local bookworm:

CVE-2024-35970 [MEDIUM] CVE-2024-35970: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Cl... In the Linux kernel, the following vulnerability has been resolved: af_unix: Clear stale u->oob_skb. syzkaller started to report deadlock of unix_gc_lock after commit 4090fa373f0e ("af_unix: Replace garbage collection algorithm."), but it just uncovers the bug that has been there since commit 314001f0bf92 ("af_unix: Add OOB support"). The repro basically does the fo

CVE-2019-19053 [HIGH] CVE-2019-19053: linux - A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_c... A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy_from_iter_full() failures, aka CID-bbe692e349e2. Scope: local bookworm: resolved (fixed in 5.4.13-1) bullseye: resolved (fixed in 5.4.13-1) forky: resolved (fixed

CVE-2016-9313 [HIGH] CVE-2016-9313: linux - security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful... security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction with successful key-type registration, which allows local users to cause a denial of service (NULL pointer dereference and panic) or possibly have unspecified other impact via a crafted application that uses the big_key data type. Scope: local bookworm: re

CVE-2018-12232 [MEDIUM] CVE-2018-12232: linux - In net/socket.c in the Linux kernel through 4.17.1, there is a race condition be... In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading

CVE-2016-5696 [MEDIUM] CVE-2016-5696: linux - net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine ... net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack. Scope: local bookworm: resolved (fixed in 4.7.2-1) bullseye: resolved (fixed in 4.7.2-1) forky: resolved (fixed in 4.7.2-1) sid: resolved (fixed in 4.7.2-1) t

CVE-2017-8890 [HIGH] CVE-2017-8890: linux - The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux... The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. Scope: local bookworm: resolved (fixed in 4.9.30-1) bullseye: resolved (fixed in 4.9.30-1) forky: resolved (fixed in 4.9.

CVE-2020-13143 [MEDIUM] CVE-2020-13143: linux - gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3... gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4. Scope: local bookworm: resolved (fixed in 5.6.14-1) bullseye: resolved (fixed in 5.6.14-1) forky: resolved (f

CVE-2017-9725 [HIGH] CVE-2017-9725: linux - In all Qualcomm products with Android releases from CAF using the Linux kernel, ... In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail. Scope: local bookworm: resolved (fixed in 4.3.1-1) bullseye: resolved (fixed in 4.3.1-1) forky: resolved (fixed in 4.3.1-1) sid: resolved (fixed in 4.3.1-

CVE-2017-9077 [HIGH] CVE-2017-9077: linux - The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel thr... The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Scope: local bookworm: resolved (fixed in 4.9.30-1) bullseye: resolved (fixed in 4.9.30-1) forky: re

CVE-2023-20588 [MEDIUM] CVE-2023-20588: linux - A division-by-zero error on some AMD processors can potentially return speculati... A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.197-1) forky: resolved (fixed in 6.4.13-1) sid: resolved (fixed in 6.4.13-1) trixie: resolved (fixed in 6.4.13-1)