Debian Linux vulnerabilities

CVE-2023-33203 [MEDIUM] CVE-2023-33203: linux - The Linux kernel before 6.2.9 has a race condition and resultant use-after-free ... The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device. Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.25-1) sid: resolved (fixed in 6.1.25-1) trixie: resolve

CVE-2022-20148 [MEDIUM] CVE-2022-20148: linux - In TBD of TBD, there is a possible use-after-free due to a race condition. This ... In TBD of TBD, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219513976References: Upstream kernel Scope: local bookworm: resolved (fixed in 5.15.3-1

CVE-2022-20567 [MEDIUM] CVE-2022-20567: linux - In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a ra... In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References: Upstream kernel Scope: local bookworm: resolved (fixed in 4.1

CVE-2022-20154 [MEDIUM] CVE-2022-20154: linux - In lock_sock_nested of sock.c, there is a possible use after free due to a race ... In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel Scope: local bookworm: resolved (fixed in 5.15.1

CVE-2024-40918 [MEDIUM] CVE-2024-40918: linux - In the Linux kernel, the following vulnerability has been resolved: parisc: Try... In the Linux kernel, the following vulnerability has been resolved: parisc: Try to fix random segmentation faults in package builds PA-RISC systems with PA8800 and PA8900 processors have had problems with random segmentation faults for many years. Systems with earlier processors are much more stable. Systems with PA8800 and PA8900 processors have a large L2 cache wh

CVE-2024-27005 [MEDIUM] CVE-2024-27005: linux - In the Linux kernel, the following vulnerability has been resolved: interconnec... In the Linux kernel, the following vulnerability has been resolved: interconnect: Don't access req_list while it's being manipulated The icc_lock mutex was split into separate icc_lock and icc_bw_lock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to icc_node::req_list. The icc_set_bw() function will eventually iterate over re

CVE-2024-57893 [MEDIUM] CVE-2024-57893: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: ... In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix races at processing SysEx messages OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a

CVE-2024-56662 [MEDIUM] CVE-2024-56662: linux - In the Linux kernel, the following vulnerability has been resolved: acpi: nfit:... In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs i

CVE-2022-3594 [MEDIUM] CVE-2022-3594: linux - A vulnerability was found in Linux Kernel. It has been declared as problematic. ... A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier o

CVE-2017-13080 [MEDIUM] CVE-2017-13080: firmware-nonfree - Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Tempora... Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients. Scope: local bookworm: resolved (fixed in 20180825-1) bullseye: resolved (fixed in 20180825-1) forky: resolved (fixed in 20180825-1) sid: resolve

CVE-2024-57878 [MEDIUM] CVE-2024-57878: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: ptra... In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR Currently fpmr_set() doesn't initialize the temporary 'fpmr' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently an arbitrary value will be written back to target->thread.uw.fpmr, potentially leaking up

CVE-2020-2732 [MEDIUM] CVE-2020-2732: linux - A flaw was discovered in the way that the KVM hypervisor handled instruction emu... A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5

CVE-2024-57877 [MEDIUM] CVE-2024-57877: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: ptra... In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_POE Currently poe_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently an arbitrary value will be written back to target->thread.por_el0, potentially leaking up t

CVE-2012-2319 [HIGH] CVE-2012-2319: linux - Multiple buffer overflows in the hfsplus filesystem implementation in the Linux ... Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020. Scope: local bookworm: resolved (fixed in 3.2.17-1) bullseye: resolved (fixed in 3.2.17-1) forky: resolved (fixed in 3.2.17-1) sid: resolved (fixed in 3.2.17-1) trixi

CVE-2013-0871 [MEDIUM] CVE-2013-0871: linux - Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allo... Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death. Scope: local bookworm: resolved (fixed in 3.2.39-1) bullseye: resolved (fixed in 3.2.39-1) forky: resolved (fixed in 3.2.39-1) sid: resolved (fixed in 3.2.39

CVE-2015-4036 [HIGH] CVE-2015-4036: linux - Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in ... Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was anno

CVE-2014-0069 [HIGH] CVE-2014-0069: linux - The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13... The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev syst

CVE-2023-20569 [MEDIUM] CVE-2023-20569: amd64-microcode - A side channel vulnerability on some of the AMD CPUs may allow an attacker to in... A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. Scope: local bookworm: resolved (fixed in 3.20230719.1~deb12u1) bullseye: resolved (fixed in 3.20230719.1~deb11u1) f

CVE-2014-3688 [MEDIUM] CVE-2014-3688: linux - The SCTP implementation in the Linux kernel before 3.17.4 allows remote attacker... The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c. Scope: local bookworm: resolved (fixed in 3.16.7-1) bullseye: resolved (

CVE-2023-54102 CVE-2023-54102: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc:... In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copy_from_user() for a debugfs entry. Currently, it is possible that copy_from_user() copies more bytes than what would fit in the mybuf char array. Add a min()