Debian Linux vulnerabilities

CVE-2020-10690 [MEDIUM] CVE-2020-10690: linux - There is a use-after-free in kernel versions before 5.5 due to a race condition ... There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process w

CVE-2020-3702 [MEDIUM] CVE-2020-3702: linux - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN... u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,

CVE-2019-15214 [MEDIUM] CVE-2019-15214: linux - An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-... An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c. Scope: local bookworm: resolved (fixed in 4.19.37-1) bullseye: resolved (fixed in 4.19.37-1) forky: resolved (fixed i

CVE-2022-2308 [MEDIUM] CVE-2022-2308: linux - A flaw was found in vDPA with VDUSE backend. There are currently no checks in VD... A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitia

CVE-2024-26875 [MEDIUM] CVE-2024-26875: linux - In the Linux kernel, the following vulnerability has been resolved: media: pvru... In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix uaf in pvr2_context_set_notify [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26 CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0

CVE-2020-0305 [MEDIUM] CVE-2020-0305: linux - In cdev_get of char_dev.c, there is a possible use-after-free due to a race cond... In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744 Scope: local bookworm: resolved (fixed in 5.4.13-1) bullseye: resolved (fixed in 5.4.

CVE-2016-5728 [MEDIUM] CVE-2016-5728: linux - Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in... Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header, aka a "double fetch" vulnerability. Scope: local bookworm: resolved (fi

CVE-2017-15102 [MEDIUM] CVE-2017-15102: linux - The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel ... The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference. Scope: local bookworm: resolved (fixed in 4.7.8-1) bullseye:

CVE-2020-27067 [MEDIUM] CVE-2020-27067: linux - In the l2tp subsystem, there is a possible use after free due to a race conditio... In the l2tp subsystem, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152409173 Scope: local bookworm: resolved (fixed in 4.15.4-1) bullseye: resolved (fixed in 4.

CVE-2024-27032 [MEDIUM] CVE-2024-27032: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential panic during recovery During recovery, if FAULT_BLOCK is on, it is possible that f2fs_reserve_new_block() will return -ENOSPC during recovery, then it may trigger panic. Also, if fault injection rate is 1 and only FAULT_BLOCK fault type is on, it may encounter deadloop i

CVE-2024-26924 [MEDIUM] CVE-2024-26924: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just

CVE-2023-52644 [MEDIUM] CVE-2023-52644: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: b43: ... In the Linux kernel, the following vulnerability has been resolved: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled When QoS is disabled, the queue priority value will not map to the correct ieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS is disabled to prevent trying to stop/wake a non-existent queue and failing to s

CVE-2024-27030 [MEDIUM] CVE-2024-27030: linux - In the Linux kernel, the following vulnerability has been resolved: octeontx2-a... In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Use separate handlers for interrupts For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts are raised to two CPUs at same time then two cores serve same event corrupting the data. Scope: local bookwor

CVE-2019-19332 [MEDIUM] CVE-2019-19332: linux - An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 ... An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of s

CVE-2023-52502 [MEDIUM] CVE-2023-52502: linux - In the Linux kernel, the following vulnerability has been resolved: net: nfc: f... In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Final

CVE-2015-3339 [MEDIUM] CVE-2015-3339: linux - Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel b... Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. Scope: local bookworm: resolved (fixed in 3.16.7-ckt9-3) bullseye: resolved (fixed in

CVE-2020-10751 [MEDIUM] CVE-2020-10751: linux - A flaw was found in the Linux kernels SELinux LSM hook implementation before ver... A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.

CVE-2024-57874 [MEDIUM] CVE-2024-57874: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: ptra... In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potential

CVE-2024-24861 [LOW] CVE-2024-24861: linux - A race condition was found in the Linux kernel's media/xc4000 device driver in x... A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: resolved (

CVE-2024-26804 [MEDIUM] CVE-2024-26804: linux - In the Linux kernel, the following vulnerability has been resolved: net: ip_tun... In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110 mm/kasan/report