Debian Linux vulnerabilities

CVE-2019-3900 [HIGH] CVE-2019-3900: linux - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel ... An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario. Scope: loca

CVE-2018-18559 [HIGH] CVE-2018-18559: linux - In the Linux kernel through 4.19, a use-after-free can occur due to a race condi... In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by

CVE-2021-4440 [HIGH] CVE-2021-4440: linux - In the Linux kernel, the following vulnerability has been resolved: x86/xen: Dr... In the Linux kernel, the following vulnerability has been resolved: x86/xen: Drop USERGS_SYSRET64 paravirt call commit afd30525a659ac0ae0904f0cb4a2ca75522c3123 upstream. USERGS_SYSRET64 is used to return from a syscall via SYSRET, but a Xen PV guest will nevertheless use the IRET hypercall, as there is no sysret PV hypercall defined. So instead of testing all the prereq

CVE-2023-1380 [HIGH] CVE-2023-1380: linux - A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net... A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. Scope: local bookworm: resolved (fixed in 6.1.27-1) bullseye: resolve

CVE-2022-47940 [HIGH] CVE-2022-47940: linux - An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.... An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trixie: resolved (fixed in 5.19.6-1)

CVE-2021-47232 [HIGH] CVE-2021-47232: linux - In the Linux kernel, the following vulnerability has been resolved: can: j1939:... In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free, hold skb ref while in use This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to a Use-after-Free if the skb is taken concurrently from the session queue

CVE-2023-52776 [MEDIUM] CVE-2023-52776: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12... In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dfs-radar and temperature event locking The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as RCU read-side critical sect

CVE-2020-25643 [HIGH] CVE-2020-25643: linux - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5... A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system avail

CVE-2024-36912 [HIGH] CVE-2024-36912: linux - In the Linux kernel, the following vulnerability has been resolved: Drivers: hv... In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid ret

CVE-2023-35001 [HIGH] CVE-2023-35001: linux - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poor... Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace Scope: local bookworm: resolved (fixed in 6.1.38-1) bullseye: resolved (fixed in 5.10.179-2) forky: resolved (fixed in 6.4.4-1) sid: resolved (fixed in 6.4.4-1) trixie: resolved (fixed in 6.4.4-1)

CVE-2012-3400 [HIGH] CVE-2012-3400: linux - Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c... Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem. Scope: local bookworm: resolved (fixed in 3.2.23-1) bullseye: resolved (fixed in 3.2.23-1) forky: resolved (fixed in 3

CVE-2022-1786 [HIGH] CVE-2022-1786: linux - A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the ... A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.120-1) fork

CVE-2021-29154 [HIGH] CVE-2021-29154: linux - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation... BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. Scope: local bookworm: resolved (fixed in 5.10.28-1) bullseye: resolved (fixed in 5.10.28-1) forky: resolved (fixed in 5.

CVE-2023-4004 [HIGH] CVE-2023-4004: linux - A use-after-free flaw was found in the Linux kernel's netfilter in the way a use... A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191

CVE-2023-3390 [HIGH] CVE-2023-3390: linux - A use-after-free vulnerability was found in the Linux kernel's netfilter subsyst... A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recomme

CVE-2023-5717 [HIGH] CVE-2023-5717: linux - A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Perf... A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading

CVE-2021-47107 [HIGH] CVE-2021-47107: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix R... In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix READDIR buffer overflow If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has alway

CVE-2020-27815 [HIGH] CVE-2020-27815: linux - A flaw was found in the JFS filesystem code in the Linux Kernel which allows a l... A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Scope: local bookworm: resolved (fixed in 5.10.4-1

CVE-2021-3612 [HIGH] CVE-2021-3612: linux - An out-of-bounds memory write flaw was found in the Linux kernel's joystick devi... An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availa

CVE-2023-3389 [HIGH] CVE-2023-3389: linux - A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exp... A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992e