Debian Linux vulnerabilities

CVE-2024-49855 [HIGH] CVE-2024-49855: linux - In the Linux kernel, the following vulnerability has been resolved: nbd: fix ra... In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime m

CVE-2021-39713 [HIGH] CVE-2021-39713: linux - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstr... Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: resolved (fixed in 5.2.6-1)

CVE-2024-42162 [HIGH] CVE-2024-42162: linux - In the Linux kernel, the following vulnerability has been resolved: gve: Accoun... In the Linux kernel, the following vulnerability has been resolved: gve: Account for stopped queues when reading NIC stats We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array. Scope: local bookworm: open bullseye: open forky:

CVE-2023-52847 [HIGH] CVE-2023-52847: linux - In the Linux kernel, the following vulnerability has been resolved: media: bttv... In the Linux kernel, the following vulnerability has been resolved: media: bttv: fix use after free error due to btv->timeout timer There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked,

CVE-2022-48759 [HIGH] CVE-2022-48759: linux - In the Linux kernel, the following vulnerability has been resolved: rpmsg: char... In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be

CVE-2023-53358 [HIGH] CVE-2023-53358: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue under cocurrent smb2 tree disconnect There is UAF issue under cocurrent smb2 tree disconnect. This patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent access. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1)

CVE-2023-53622 [HIGH] CVE-2023-53622: linux - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix p... In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix possible data races in gfs2_show_options() Some fields such as gt_logd_secs of the struct gfs2_tune are accessed without holding the lock gt_spin in gfs2_show_options(): val = sdp->sd_tune.gt_logd_secs; if (val != 30) seq_printf(s, ",commit=%d", val); And thus can cause data races when gfs2_

CVE-2022-50339 [HIGH] CVE-2022-50339: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev() syzbot is again reporting attempt to cancel uninitialized work at mgmt_index_removed() [1], for setting of HCI_MGMT flag from mgmt_init_hdev() from hci_mgmt_cmd() from hci_sock_sendmsg() can race with testing of HCI_MGMT flag from mgmt_i

CVE-2023-28772 [MEDIUM] CVE-2023-28772: linux - An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a s... An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.70-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: resolved (fixed in 5.14.6-1)

CVE-2020-12659 [MEDIUM] CVE-2020-12659: linux - An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xd... An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation. Scope: local bookworm: resolved (fixed in 5.6.7-1) bullseye: resolved (fixed in 5.6.7-1) forky: resolved (fixed in 5.6.7-1) sid: resolved (fixed in 5.6.7-1) tri

CVE-2023-1079 [MEDIUM] CVE-2023-1079: linux - A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_... A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a us

CVE-2022-20409 [MEDIUM] CVE-2022-20409: linux - In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due ... In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238177383References: Upstream kernel Scope: local bookworm: resolved (fixed

CVE-2020-27777 [MEDIUM] CVE-2020-27777: linux - A flaw was found in the way RTAS handled memory accesses in userspace to kernel ... A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel. Scope: local bookworm: resolved (fixed in

CVE-2022-20572 [MEDIUM] CVE-2022-20572: linux - In verity_target of dm-verity-target.c, there is a possible way to modify read-o... In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel Scope: local b

CVE-2022-43750 [MEDIUM] CVE-2022-43750: linux - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x b... drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.148-1) forky: resolved (fixed in 6.0.2-1) sid: resolved (fixed in 6.0.2-1) trixie: resolved (fixed in 6.0.2-1)

CVE-2020-14331 [MEDIUM] CVE-2020-14331: linux - A flaw was found in the Linux kernel’s implementation of the invert video code o... A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The high

CVE-2023-32269 [MEDIUM] CVE-2023-32269: linux - An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netr... An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability. Scope: local bookworm: r

CVE-2023-3159 [MEDIUM] CVE-2023-3159: linux - A use after free issue was discovered in driver/firewire in outbound_phy_packet_... A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails. Scope: local bookworm: resolved (fixed in 5.17.11-1) bullseye: resolved (fixed in 5.10.120-1) forky: resolved (fixed in 5.17.11-1) sid: resolved (

CVE-2022-21505 [MEDIUM] CVE-2022-21505: linux - In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot p... In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7

CVE-2019-19319 [MEDIUM] CVE-2019-19319: linux - In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted... In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-