Debian Linux vulnerabilities

CVE-2016-10088 [HIGH] CVE-2016-10088: linux - The sg implementation in the Linux kernel through 4.9 does not properly restrict... The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this

CVE-2021-4202 [HIGH] CVE-2021-4202: linux - A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Cont... A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed, leading to a privilege escalation problem. Scope: local bookworm: resolved (fixed in 5.15.5-1) bullseye: resolved (fixed i

CVE-2021-4083 [HIGH] CVE-2021-4083: linux - A read-after-free memory flaw was found in the Linux kernel's garbage collection... A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.

CVE-2023-51779 [HIGH] CVE-2023-51779: linux - bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.... bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_sock_ioctl race condition. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved (fixed in 5.10.209-1) forky: resolved (fixed in 6.6.9-1) sid: resolved (fixed in 6.6.9-1) trixie: resolved (fixed in 6.6.9-1)

CVE-2024-50154 [HIGH] CVE-2024-50154: linux - In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: D... In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper

CVE-2023-6531 [HIGH] CVE-2023-6531: linux - A use-after-free flaw was found in the Linux Kernel due to a race problem in the... A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved (fixed in 5.10.205-2) forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in 6.6.8-1) trixie: re

CVE-2024-26974 [HIGH] CVE-2024-26974: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: qat... In the Linux kernel, the following vulnerability has been resolved: crypto: qat - resolve race condition during AER recovery During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data structure's memory. If the device restart will take more than 10 seconds the function scheduling that restart will e

CVE-2022-49001 [HIGH] CVE-2022-49001: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: fix ... In the Linux kernel, the following vulnerability has been resolved: riscv: fix race when vmap stack overflow Currently, when detecting vmap stack overflow, riscv firstly switches to the so called shadow stack, then use this shadow stack to call the get_overflow_stack() to get the overflow stack. However, there's a race here if two or more harts use the same shadow sta

CVE-2021-28972 [MEDIUM] CVE-2021-28972: linux - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the ... In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka

CVE-2024-27028 [MEDIUM] CVE-2024-27028: linux - In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt... In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler The TX buffer in spi_transfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause crashes. Add a check to trans->tx_buf before using it. Scope: local bookworm: resolved (fixed in 6.1.85-1) bu

CVE-2022-2991 [MEDIUM] CVE-2022-2991: linux - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem.... A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must fi

CVE-2024-26690 [MEDIUM] CVE-2024-26690: linux - In the Linux kernel, the following vulnerability has been resolved: net: stmmac... In the Linux kernel, the following vulnerability has been resolved: net: stmmac: protect updates of 64-bit statistics counters As explained by a comment in , write side of struct u64_stats_sync must ensure mutual exclusion, or one seqcount update could be lost on 32-bit platforms, thus blocking readers forever. Such lockups have been observed in real world after stm

CVE-2024-50076 [MEDIUM] CVE-2024-50076: linux - In the Linux kernel, the following vulnerability has been resolved: vt: prevent... In the Linux kernel, the following vulnerability has been resolved: vt: prevent kernel-infoleak in con_font_get() font.data may not initialize all memory spaces depending on the implementation of vc->vc_sw->con_font_get. This may cause info-leak, so to prevent this, it is safest to modify it to initialize the allocated memory space to 0, and it generally does not af

CVE-2019-19075 [HIGH] CVE-2019-19075: linux - A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c ... A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed in 5.3.9-1) forky: resolved (fixed in 5.

CVE-2019-18813 [HIGH] CVE-2019-18813: linux - A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in... A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8. Scope: local bookworm: resolved (fixed in 5.3.15-1) bullseye: resolved (fixed in 5.3.15-1) forky: resolved (fixe

CVE-2019-19060 [HIGH] CVE-2019-19060: linux - A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_bu... A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed in 5.3.9-1) forky: resolved (fixed in 5.3.9-1) sid: resolved (fixed in 5.3.9-1) tri

CVE-2019-19048 [HIGH] CVE-2019-19048: linux - A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vbox... A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering copy_form_user() failures, aka CID-e0b0cb938864. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed in 5.3.9-1) forky: resolved (fixed i

CVE-2019-18810 [HIGH] CVE-2019-18810: linux - A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/d... A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed

CVE-2020-25672 [HIGH] CVE-2020-25672: linux - A memory leak vulnerability was found in Linux kernel in llcp_sock_connect A memory leak vulnerability was found in Linux kernel in llcp_sock_connect Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolved (fixed in 5.10.38-1) sid: resolved (fixed in 5.10.38-1) trixie: resolved (fixed in 5.10.38-1)

CVE-2024-2201 [MEDIUM] CVE-2024-2201: linux - A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deploy... A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: open forky: resolved (fixed in 6.8.9-1) sid: resolved (fixed in 6.8.9-1) trixie: resolved (fixed in 6.8.9-1)