Debian Linux vulnerabilities

CVE-2023-33952 [MEDIUM] CVE-2023-33952: linux - A double-free vulnerability was found in handling vmw_buffer_object objects in t... A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel. Scope:

CVE-2012-3430 [LOW] CVE-2012-3430: linux - The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 doe... The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket. Scope: local bookworm: resolved (fixed in 3.2.29-1) bullseye: resolved (fixed in 3.2.29-1)

CVE-2012-3364 [MEDIUM] CVE-2012-3364: linux - Multiple stack-based buffer overflows in the Near Field Communication Controller... Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields. Scope: local bookworm: resolved (fixed in 3.2.23-1) bullseye: resolved (fixed in 3.2.23-1) forky

CVE-2021-3411 [MEDIUM] CVE-2021-3411: linux - A flaw was found in the Linux kernel in versions prior to 5.10. A violation of m... A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Scope: local bookworm: resolved (fixed in 5.9.15-1) bullseye: resolved (fixed in 5.9.15-1) fork

CVE-2021-33655 [MEDIUM] CVE-2021-33655: linux - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel wil... When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.10.127-2) forky: resolved (fixed in 5.18.14-1) sid: resolved (fixed in 5.18.14-1) trixie: resolved (fixed in 5.18.14-1)

CVE-2023-2194 [MEDIUM] CVE-2023-2194: linux - An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C... An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. Sco

CVE-2021-0935 [MEDIUM] CVE-2021-0935: linux - In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a us... In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168607263References: Upstream kernel Scope: local bookworm: resolved (fixed in 4.15.

CVE-2023-45863 [MEDIUM] CVE-2023-45863: linux - An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With ... An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.205-2) forky: resolved (fixed in 6.1.20-1) sid: resolved (fixed in 6.1.20-1) trixie: resolved

CVE-2012-4444 [MEDIUM] CVE-2012-4444: linux - The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before ... The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments. Scope: local bookworm: resolved (fixed in 2.6.36-1~experimental.1) bullseye: resolved (fixed in 2.6.36-1~experimental.1) forky: resolved (fixed in 2.6.36-1~experimental.1) sid: resolved (

CVE-2022-1462 [MEDIUM] CVE-2022-1462: linux - An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. T... An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory. Scope: local bookwor

CVE-2024-26864 [MEDIUM] CVE-2024-26864: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: Fix re... In the Linux kernel, the following vulnerability has been resolved: tcp: Fix refcnt handling in __inet_hash_connect(). syzbot reported a warning in sk_nulls_del_node_init_rcu(). The commit 66b60b0c8c4a ("dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().") tried to fix an issue that an unconnected socket occupies an ehash entry when bha

CVE-2023-52776 [MEDIUM] CVE-2023-52776: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12... In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dfs-radar and temperature event locking The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as RCU read-side critical sect

CVE-2014-4611 [MEDIUM] CVE-2014-4611: linux - Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4... Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run th

CVE-2022-3649 [LOW] CVE-2022-3649: linux - A vulnerability was found in Linux Kernel. It has been classified as problematic... A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992. Scop

CVE-2014-2672 [HIGH] CVE-2014-2672: linux - Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath... Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions. Scope: local bookworm: resolved (fixed in 3.13.7-1) bullseye: resolved (fixed in 3.13.7-1) forky: resolv

CVE-2022-3635 [MEDIUM] CVE-2022-3635: linux - A vulnerability, which was classified as critical, has been found in Linux Kerne... A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability. Scope: local bookworm:

CVE-2020-12826 [MEDIUM] CVE-2020-12826: linux - A signal access-control issue was discovered in the Linux kernel before 5.6.5, a... A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include

CVE-2017-18079 [HIGH] CVE-2017-18079: linux - drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers t... drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated. Scope: local bookworm: resolved (fixed in 4.12.6-1) bullseye: resolved (fixed in 4.12.6-1) forky: resolved (fix

CVE-2022-21123 [MEDIUM] CVE-2022-21123: intel-microcode - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may... Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Scope: local bookworm: resolved (fixed in 3.20220510.1) bullseye: resolved (fixed in 3.20220510.1~deb11u1) forky: resolved (fixed in 3.20220510.1) sid: resolved (fixed in 3.20220510.1) t

CVE-2023-5197 [HIGH] CVE-2023-5197: linux - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon... A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325. Scope: local bookworm: resolved (fixed in 6.1