Debian Linux vulnerabilities

CVE-2022-47943 [HIGH] CVE-2022-47943: linux - An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.... An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trixie: resolved (fixed in 5.

CVE-2023-52735 [CRITICAL] CVE-2023-52735: linux - In the Linux kernel, the following vulnerability has been resolved: bpf, sockma... In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself sock_map proto callbacks should never call themselves by design. Protect against bugs like [1] and break out of the recursive loop to avoid a stack overflow in favor of a resource leak. [1] https://lore.kernel.org/all/000000000000

CVE-2023-38430 [CRITICAL] CVE-2023-38430: linux - An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validat... An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.11-1) sid: resolved (fixed in 6.3.11-1) trixie: resolved (fixed in 6.3.11-1)

CVE-2015-4001 [CRITICAL] CVE-2015-4001: linux - Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/... Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet. Scope: local bookworm: resolved (fixed in 4.1.3-1) bullseye: resolved (fixed in 4.1.3-1) fork

CVE-2021-28660 [HIGH] CVE-2021-28660: linux - rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux k... rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant t

CVE-2014-2851 [MEDIUM] CVE-2014-2851: linux - Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux ... Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. Scope: local bookworm: resolved (fixed in 3.14.4-1) bullseye: resolved (fixe

CVE-2019-9506 [HIGH] CVE-2019-9506: linux - The Bluetooth BR/EDR specification up to and including version 5.1 permits suffi... The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing. Scope: local bookworm: resolved (fixed

CVE-2023-32252 [HIGH] CVE-2023-32252: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Scope: local bookworm: re

CVE-2023-32248 [HIGH] CVE-2023-32248: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

CVE-2025-22040 [HIGH] CVE-2025-22040: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is added to channel list of session. This patch check reference count of session before freeing it. Scope: local bo

CVE-2021-3656 [HIGH] CVE-2021-3656: linux - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization.... A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/V

CVE-2023-32247 [HIGH] CVE-2023-32247: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Scope: local bookworm: resolved (fixed

CVE-2021-3653 [HIGH] CVE-2021-3653: linux - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization.... A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for

CVE-2019-10639 [HIGH] CVE-2019-10639: linux - The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information... The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination I

CVE-2015-8787 [HIGH] CVE-2015-8787: linux - The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linu... The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604. Scope: local bookworm: res

CVE-2021-4157 [HIGH] CVE-2021-4157: linux - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel ... An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (f

CVE-2020-27786 [HIGH] CVE-2020-27786: linux - A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker... A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The hi

CVE-2021-42008 [HIGH] CVE-2021-42008: linux - The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel bef... The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.70-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1)

CVE-2022-3640 [MEDIUM] CVE-2022-3640: linux - A vulnerability, which was classified as critical, was found in Linux Kernel. Af... A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944. Scope: local bookworm: resolved (fixe

CVE-2023-2008 [HIGH] CVE-2023-2008: linux - A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw ... A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.