Debian Linux vulnerabilities

CVE-2022-20369 [MEDIUM] CVE-2022-20369: linux - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write ... In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-223375145References: Upstream kernel Scope: local bookworm: re

CVE-2020-27066 [MEDIUM] CVE-2020-27066: linux - In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use aft... In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168043318 Scope: local bookworm: resolved (fixed in 5.5.17-1) b

CVE-2023-21264 [MEDIUM] CVE-2023-21264: linux - In multiple functions of mem_protect.c, there is a possible way to access hyperv... In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access check in the wrong place. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Scope: local bookworm: open bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: r

CVE-2022-20166 [MEDIUM] CVE-2022-20166: linux - In various methods of kernel base drivers, there is a possible out of bounds wri... In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182388481References: Upstream kernel Scope: local bookworm: re

CVE-2023-1073 [MEDIUM] CVE-2023-1073: linux - A memory corruption flaw was found in the Linux kernel’s human interface device ... A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.11-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.11-1) sid:

CVE-2022-20153 [MEDIUM] CVE-2022-20153: linux - In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due... In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222091980References: Upstream kernel Scope: local bookworm:

CVE-2021-47580 [MEDIUM] CVE-2021-47580: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_... In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix type in min_t to avoid stack OOB Change min_t() to use type "u32" instead of type "int" to avoid stack out of bounds. With min_t() type "int" the values get sign extended and the larger value gets used causing stack out of bounds. BUG: KASAN: stack-out-of-bounds in memcpy inclu

CVE-2018-1108 [MEDIUM] CVE-2018-1108: linux - kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux... kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated. Scope: local bookworm: resolved (fixed in 4.16.5-1) bullseye: resolved (fixed in 4.16.5-1) forky: resolved (fixed in 4.16.5-1)

CVE-2024-25742 [MEDIUM] CVE-2024-25742: linux - In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual inter... In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.9.7-1) sid: resolved (fixed in 6.9.7-1) trixie: resolved (fixed in 6.9.7-1)

CVE-2021-3573 [MEDIUM] CVE-2021-3573: linux - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subs... A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use thi

CVE-2015-1593 [MEDIUM] CVE-2015-1593: linux - The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit plat... The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxr

CVE-2021-20261 [MEDIUM] CVE-2021-20261: linux - A race condition was found in the Linux kernels implementation of the floppy dis... A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equiva

CVE-2023-1611 [MEDIUM] CVE-2023-1611: linux - A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrf... A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.25-1) sid: resolved (fixed in 6.1.25-1) trixie: reso

CVE-2023-1855 [MEDIUM] CVE-2023-1855: linux - A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwm... A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem. Scope: local bookworm: resolved (fixed in 6.1.20-2) bullseye: resolv

CVE-2024-26830 [MEDIUM] CVE-2024-26830: linux - In the Linux kernel, the following vulnerability has been resolved: i40e: Do no... In the Linux kernel, the following vulnerability has been resolved: i40e: Do not allow untrusted VF to remove administratively set MAC Currently when PF administratively sets VF's MAC address and the VF is put down (VF tries to delete all MACs) then the MAC is removed from MAC filters and primary VF MAC is zeroed. Do not allow untrusted VF to remove primary MAC when

CVE-2013-2888 [MEDIUM] CVE-2013-2888: linux - Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Dev... Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID. Scope: local bookworm: resolved (fixed in 3.10.11-1) bullseye:

CVE-2024-42111 [MEDIUM] CVE-2024-42111: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: alwa... In the Linux kernel, the following vulnerability has been resolved: btrfs: always do the basic checks for btrfs_qgroup_inherit structure [BUG] Syzbot reports the following regression detected by KASAN: BUG: KASAN: slab-out-of-bounds in btrfs_qgroup_inherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 Read of size 8 at addr ffff88814628ca50 by task syz-executor318/5171 CPU: 0

CVE-2019-18282 [MEDIUM] CVE-2019-18282: linux - The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has... The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferre

CVE-2018-10877 [HIGH] CVE-2018-10877: linux - Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4... Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.3-1) sid: resolved (fixed in 4.17.3-1) trixie: resolved (fixed in 4.17.3-1)

CVE-2022-21125 [MEDIUM] CVE-2022-21125: intel-microcode - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processor... Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Scope: local bookworm: resolved (fixed in 3.20220510.1) bullseye: resolved (fixed in 3.20220510.1~deb11u1) forky: resolved (fixed in 3.20220510.1) sid: resolved (fixed in 3.20220510