Debian Linux vulnerabilities

CVE-2021-28038 [MEDIUM] CVE-2021-28038: linux - An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV.... An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists

CVE-2024-36350 [MEDIUM] CVE-2024-36350: amd64-microcode - A transient execution vulnerability in some AMD processors may allow an attacker... A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 3.20251202.1) sid: resolved (fixed in 3.20251202.1) trixie: open

CVE-2018-7755 [MEDIUM] CVE-2018-7755: linux - An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.... An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security prote

CVE-2024-38587 [MEDIUM] CVE-2024-38587: linux - In the Linux kernel, the following vulnerability has been resolved: speakup: Fi... In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof() vs ARRAY_SIZE() bug The "buf" pointer is an array of u16 values. This code should be using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds. Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: resolved (fixed

CVE-2022-1016 [MEDIUM] CVE-2022-1016: linux - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_ch... A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.113-1)

CVE-2015-9289 [MEDIUM] CVE-2015-9289: linux - In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspa... In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23. Scope: local bookworm: resolved (fixed in 4.1.5-1) bullseye: resolved (fixed in 4.1.5-1) forky: resolved (fixed

CVE-2024-35823 [MEDIUM] CVE-2024-35823: linux - In the Linux kernel, the following vulnerability has been resolved: vt: fix uni... In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffe

CVE-2024-35857 [MEDIUM] CVE-2024-35857: linux - In the Linux kernel, the following vulnerability has been resolved: icmp: preve... In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL. if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) Second problem is a read from dev->ip6_ptr with no NULL check: if (!list_empt

CVE-2017-1000255 [MEDIUM] CVE-2017-1000255: linux - On Linux running on PowerPC hardware (Power8 or later) a user process can craft ... On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker

CVE-2022-2905 [MEDIUM] CVE-2022-2905: linux - An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem ... An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.140-1) forky: resolved (fixed in 5.19.6

CVE-2021-3732 [MEDIUM] CVE-2021-3732: linux - A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user m... A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.46-5) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.1

CVE-2024-35878 [MEDIUM] CVE-2024-35878: linux - In the Linux kernel, the following vulnerability has been resolved: of: module:... In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf() In of_modalias(), we can get passed the str and len parameters which would cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr when the length is also 0. Also, we need to filter out the negative values of the len para

CVE-2023-4194 [MEDIUM] CVE-2023-4194: linux - A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could a... A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 6

CVE-2023-28866 [MEDIUM] CVE-2023-28866: linux - In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds... In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not. Scope: local bookworm: resolved (fixed in 6.1.20-2) bullseye: resolved forky: resolved (fixed in 6.1.20-2) sid: resolved (fixed in 6.1.20-2) trixie: resolved (fixed in 6.1.20-2)

CVE-2022-48853 [MEDIUM] CVE-2022-48853: linux - In the Linux kernel, the following vulnerability has been resolved: swiotlb: fi... In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO interface with: dxfer_len == 524288, dxdfer_dir == S

CVE-2023-2162 [MEDIUM] CVE-2023-2162: linux - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drive... A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. Scope: local bookworm: resolved (fixed in 6.1.11-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.11-1) sid: resolved (fixed in 6.1.11-1)

CVE-2023-52618 [MEDIUM] CVE-2023-52618: linux - In the Linux kernel, the following vulnerability has been resolved: block/rnbd-... In the Linux kernel, the following vulnerability has been resolved: block/rnbd-srv: Check for unlikely string overflow Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnb

CVE-2021-47140 [MEDIUM] CVE-2021-47140: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/amd: ... In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Clear DMA ops when switching domain Since commit 08a27c1c3ecf ("iommu: Add support to change default domain of an iommu group") a user can switch a device between IOMMU and direct DMA through sysfs. This doesn't work for AMD IOMMU at the moment because dev->dma_ops is not cleared when swi

CVE-2023-39189 [MEDIUM] CVE-2023-39189: linux - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_ad... A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved

CVE-2023-6121 [MEDIUM] CVE-2023-6121: linux - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in th... An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg). Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: re