Debian Linux vulnerabilities

CVE-2023-52832 [CRITICAL] CVE-2023-52832: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211_get_tx_power() We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset power level". UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 100 cannot be repres

CVE-2024-35845 [CRITICAL] CVE-2024-35845: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi... In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) s

CVE-2023-1390 [HIGH] CVE-2023-1390: linux - A remote denial of service vulnerability was found in the Linux kernel’s TIPC ke... A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service

CVE-2021-47348 [CRITICAL] CVE-2021-47348: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid HDCP over-read and corruption Instead of reading the desired 5 bytes of the actual target field, the code was reading 8. This could result in a corrupted value if the trailing 3 bytes were non-zero, so instead use an appropriately sized and zero-initialized bounce buffer, an

CVE-2023-52801 [CRITICAL] CVE-2023-52801: linux - In the Linux kernel, the following vulnerability has been resolved: iommufd: Fi... In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to be properly reinserted. Otherwise the domains_itree becomes corrupted and we will UAF. Scope: local bookwor

CVE-2014-4608 [HIGH] CVE-2014-4608: linux - Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1... Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype. Scope: loca

CVE-2023-39180 [MEDIUM] CVE-2023-39180: linux - A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd m... A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of Linux. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are

CVE-2016-4580 [HIGH] CVE-2016-4580: linux - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux k... The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request. Scope: local bookworm: resolved (fixed in 4.5.5-1) bullseye: resolved (fixed in 4.5.5-1) forky: resolved (fixed

CVE-2023-4458 [MEDIUM] CVE-2023-4458: linux - A flaw was found within the parsing of extended attributes in the kernel ksmbd m... A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnera

CVE-2021-4093 [HIGH] CVE-2021-4093: linux - A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtu... A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system o

CVE-2024-35814 [HIGH] CVE-2024-35814: linux - In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fi... In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment checks"), causes a functional regression with vsock in a virtual machine using bounci

CVE-2022-0742 [CRITICAL] CVE-2022-0742: linux - Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attack... Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc. Scope: local bookworm: resolved (fixed in 5.16.14-1) bullseye: resolved forky: resolved (fixed in 5.16.14-1) sid: resolved (fi

CVE-2021-27365 [HIGH] CVE-2021-27365: linux - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data s... An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message. Scope: local bookworm: resolved (fixed in 5.10.

CVE-2016-10764 [CRITICAL] CVE-2016-10764: linux - In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-... In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead. Scope: local bookworm: resolved (fixed in 4.9.6-1) bullseye: resolved (fixed in 4.9.6-1) forky: resolved (fixed in 4.9.6-1) sid: resolve

CVE-2021-47023 [HIGH] CVE-2021-47023: linux - In the Linux kernel, the following vulnerability has been resolved: net: marvel... In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix port event handling on init For some reason there might be a crash during ports creation if port events are handling at the same time because fw may send initial port event with down state. The crash points to cancel_delayed_work() which is called when port went is down. Cu

CVE-2018-6412 [HIGH] CVE-2018-6412: linux - In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Li... In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands. Scope: local bookworm: resolved (fixed in 4.16.5-1) bullseye: resolved (fixed in 4.16.5-1) forky: resolved (fixed in 4.16.5-1) sid: resolved (fi

CVE-2019-18814 [CRITICAL] CVE-2019-18814: linux - An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-... An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. Scope: local bookworm: resolved (fixed in 5.7.6-1) bullseye: resolved (fixed in 5.7.6-1) forky: resolved (fixed in 5.7.6-1) sid: resolved (fixed in 5.7.6-1) trixie: resolved (fixed in 5.7.6-1)

CVE-2021-3347 [HIGH] CVE-2021-3347: linux - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a k... An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458. Scope: local bookworm: resolved (fixed in 5.10.12-1) bullseye: resolved (fixed in 5.10.12-1) forky: resolved (fixed in 5.10.12-1) sid: resolved (fixed in 5.10.12-1) tri

CVE-2022-1011 [HIGH] CVE-2022-1011: linux - A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way... A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.106-1) forky: resolved (fixed in 5.16.18-1) sid: res

CVE-2026-31788 [HIGH] CVE-2026-31788: linux - In the Linux kernel, the following vulnerability has been resolved: xen/privcmd... In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the hypervisor will deny any hypercalls affecting other domains. In case the guest is booted usi