Debian Linux vulnerabilities

CVE-2021-37159 [MEDIUM] CVE-2021-37159: linux - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 ... hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.70-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixi

CVE-2023-52886 [MEDIUM] CVE-2023-52886: linux - In the Linux kernel, the following vulnerability has been resolved: USB: core: ... In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors(): BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011 CPU:

CVE-2022-44034 [MEDIUM] CVE-2022-44034: linux - An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/s... An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/scr24x_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between scr24x_open() and scr24x_remove(). Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.4.4-1) sid:

CVE-2023-40791 [MEDIUM] CVE-2023-40791: linux - extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails ... extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.4.13-1) sid: resolved (fixed in 6.4.13-1) trixie: resolved (fixed in 6.4.13-1)

CVE-2019-19529 [MEDIUM] CVE-2019-19529: linux - In the Linux kernel before 5.3.11, there is a use-after-free bug that can be cau... In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41. Scope: local bookworm: resolved (fixed in 5.3.15-1) bullseye: resolved (fixed in 5.3.15-1) forky: resolved (fixed in 5.3.15-1) sid: resolved (fixed in 5.3.15-1) trixie: resolved (fixed in 5.

CVE-2020-0066 [MEDIUM] CVE-2020-0066: linux - In the netlink driver, there is a possible out of bounds write due to a race con... In the netlink driver, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-65025077 Scope: local bookworm: resolved (fixed in 4.2.5-1) bullseye: resolved (fixed in 4

CVE-2022-1280 [MEDIUM] CVE-2022-1280: linux - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/dr... A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of service (DoS) or a kernel information leak. Scope: local bookworm: resolved (fixed in 5.15.3-1) bullseye: open forky: resolved (fixed in 5.15.3-1) sid: resolved (fixed

CVE-2018-12633 [MEDIUM] CVE-2018-12633: linux - An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioct... An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches

CVE-2023-52581 [MEDIUM] CVE-2023-52581: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type will wrap before reaching the boundary and nft_trans_gc_space() always returns true. This means we recycle t

CVE-2024-38544 [MEDIUM] CVE-2024-38544: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: F... In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wr

CVE-2022-39842 [MEDIUM] CVE-2022-39842: linux - An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in ... An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer dis

CVE-2023-39193 [MEDIUM] CVE-2023-39193: linux - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_che... A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved (fixed in 5.10.197-1) forky: resol

CVE-2020-8647 [MEDIUM] CVE-2020-8647: linux - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the... There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) sid: resolved (fixed in 5.5.13-1) trixie: resolved (fixed in 5.5.13-1)

CVE-2014-9717 [MEDIUM] CVE-2014-9717: linux - fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 sys... fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace. Scope: local bookworm: resolved (fixed in 4.0.2-1) bullseye: resol

CVE-2018-12130 [MEDIUM] CVE-2018-12130: intel-microcode - Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some micro... Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-in

CVE-2020-11565 [MEDIUM] CVE-2020-11565: linux - An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/... An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only

CVE-2020-10742 [MEDIUM] CVE-2020-10742: linux - A flaw was found in the Linux kernel. An index buffer overflow during Direct IO ... A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality and system availability. Scope: local bookworm: resolved (fixed in 3.1

CVE-2021-29155 [MEDIUM] CVE-2021-29155: linux - An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.... An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by

CVE-2024-35910 [MEDIUM] CVE-2024-35910: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: proper... In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago. When TCP sockets are closed, we call in

CVE-2022-2663 [MEDIUM] CVE-2022-2663: linux - An issue was found in the Linux kernel in nf_conntrack_irc where the message han... An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.149-1) forky: resolved (fixed in 6.0.