Debian Linux vulnerabilities

CVE-2014-0196 [MEDIUM] CVE-2014-0196: linux - The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14... The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. Scope: local bookw

CVE-2022-0995 [HIGH] CVE-2022-0995: linux - An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_q... An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.106-1) forky: r

CVE-2025-38352 [HIGH] CVE-2025-38352: linux - In the Linux kernel, the following vulnerability has been resolved: posix-cpu-t... In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_c

CVE-2021-1048 [HIGH] CVE-2021-1048: linux - In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory ... In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204573007References: Upstream kernel Scope: local bookworm: resolved

CVE-2023-0266 [HIGH] CVE-2023-0266: linux - A use after free vulnerability exists in the ALSA PCM package in the Linux Kerne... A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e Scope: local bookworm: resolved (fixe

CVE-2024-53104 [HIGH] CVE-2024-53104: linux - In the Linux kernel, the following vulnerability has been resolved: media: uvcv... In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. Scope: local bookworm: resolved (fixed in 6.1.119-1) bull

CVE-2024-36971 [HIGH] CVE-2024-36971: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix __... In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol

CVE-2024-53150 [HIGH] CVE-2024-53150: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-a... In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For a

CVE-2024-53197 [HIGH] CVE-2024-53197: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-a... In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configurati

CVE-2021-0920 [MEDIUM] CVE-2021-0920: linux - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a... In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel Scope: local bookworm: resolved (fixed in 5.

CVE-2024-50302 [MEDIUM] CVE-2024-50302: linux - In the Linux kernel, the following vulnerability has been resolved: HID: core: ... In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. Scope: local bookworm: resolved (fixed in 6.1.1

CVE-2025-39964 [LOW] CVE-2025-39964: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: af_... In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->wri

CVE-2017-5753 [MEDIUM] CVE-2017-5753: linux - Systems with microprocessors utilizing speculative execution and branch predicti... Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Scope: local bookworm: resolved (fixed in 4.15.11-1) bullseye: resolved (fixed in 4.15.11-1) forky: resolved (fixed in 4.15.11-1) sid: resolved (fixed in 4.15.11-1) trixie

CVE-2018-3639 [MEDIUM] CVE-2018-3639: intel-microcode - Systems with microprocessors utilizing speculative execution and speculative exe... Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. Scope: local bookworm: resolved (fix

CVE-2023-32233 [HIGH] CVE-2023-32233: linux - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when ... In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. Scope: local bookworm: resolved (fixed in 6.1.27-1) bullseye: resolved (fixed in

CVE-2022-34918 [HIGH] CVE-2022-34918: linux - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug... An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can b

CVE-2023-3269 [HIGH] CVE-2023-3269: linux - A vulnerability exists in the memory management subsystem of the Linux kernel. T... A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges. Scope: local bookworm: resolved (fixed in 6.1.37

CVE-2024-0582 [HIGH] CVE-2024-0582: linux - A memory leak flaw was found in the Linux kernel’s io_uring functionality in how... A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.6.8-1) sid: resolved (fi

CVE-2015-3636 [MEDIUM] CVE-2015-3636: linux - The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 doe... The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 pro

CVE-2016-0728 [HIGH] CVE-2016-0728: linux - The join_session_keyring function in security/keys/process_keys.c in the Linux k... The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands. Scope: local bookworm: resolved (fixed in 4.3.3-6) bullseye: resolved (fixed in