Debian Linux vulnerabilities

CVE-2018-10840 [MEDIUM] CVE-2018-10840: linux - Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.... Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.3-1) sid: resolved (fixed in 4.17.3-1) trixie: resolve

CVE-2017-18551 [MEDIUM] CVE-2017-18551: linux - An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel befo... An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated. Scope: local bookworm: resolved (fixed in 4.14.17-1) bullseye: resolved (fixed in 4.14.17-1) forky: resolved (fixed in 4.14.17-1) sid: resolved (fixed in 4.14.17-1) trixie: resolved (fixed in 4.14.17-1)

CVE-2019-20636 [MEDIUM] CVE-2019-20636: linux - In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds write... In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. Scope: local bookworm: resolved (fixed in 5.4.13-1) bullseye: resolved (fixed in 5.4.13-1) forky: resolved (fixed in 5.4.13-1) sid: resolved (fixed in 5.4.13-1) trixie: resolved (fixed in 5.4.13-1)

CVE-2020-12465 [MEDIUM] CVE-2020-12465: linux - An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/me... An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) s

CVE-2014-8709 [MEDIUM] CVE-2014-8709: linux - The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before ... The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets. Scope: local bookworm: resolved (fixed in 3.14.2-1) bullseye: resolved (fixed in 3.14.2-1) forky: resolved (fixed in 3.14.2-1) sid: resolved

CVE-2023-52447 [MEDIUM] CVE-2023-52447: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Defer ... In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the

CVE-2021-46953 [MEDIUM] CVE-2021-46953: linux - In the Linux kernel, the following vulnerability has been resolved: ACPI: GTDT:... In the Linux kernel, the following vulnerability has been resolved: ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure When failing the driver probe because of invalid firmware properties, the GTDT driver unmaps the interrupt that it mapped earlier. However, it never checks whether the mapping of the interrupt actially succeeded. Even more, shoul

CVE-2023-4394 [MEDIUM] CVE-2023-4394: linux - A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volu... A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved (fi

CVE-2020-29373 [MEDIUM] CVE-2020-29373: linux - An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsa... An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d. Scope: local bookworm: resolved (fixed in 5.6.7-1) bullseye: resolved (fixed in 5.6.7-1) forky: resolved (fixed in 5.6.7-1

CVE-2022-45888 [MEDIUM] CVE-2022-45888: linux - An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus... An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device. Scope: local bookworm: resolved (fixed in 6.1.119-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.3.7-1)

CVE-2017-10911 [MEDIUM] CVE-2017-10911: linux - The make_response function in drivers/block/xen-blkback/blkback.c in the Linux k... The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216. Scope: local bookworm: resolved (fixed in 4.11.11-1)

CVE-2018-10880 [MEDIUM] CVE-2018-10880: linux - Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem... Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.3-1)

CVE-2013-4350 [MEDIUM] CVE-2013-4350: linux - The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11... The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network. Scope: local bookworm: resolved (fixed in 3.11.5-1) bullseye: resolved (fixed in 3.11.5-1) fo

CVE-2020-10690 [MEDIUM] CVE-2020-10690: linux - There is a use-after-free in kernel versions before 5.5 due to a race condition ... There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process w

CVE-2020-3702 [MEDIUM] CVE-2020-3702: linux - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN... u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,

CVE-2019-15214 [MEDIUM] CVE-2019-15214: linux - An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-... An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c. Scope: local bookworm: resolved (fixed in 4.19.37-1) bullseye: resolved (fixed in 4.19.37-1) forky: resolved (fixed i

CVE-2022-2308 [MEDIUM] CVE-2022-2308: linux - A flaw was found in vDPA with VDUSE backend. There are currently no checks in VD... A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitia

CVE-2024-26875 [MEDIUM] CVE-2024-26875: linux - In the Linux kernel, the following vulnerability has been resolved: media: pvru... In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix uaf in pvr2_context_set_notify [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26 CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0

CVE-2020-0305 [MEDIUM] CVE-2020-0305: linux - In cdev_get of char_dev.c, there is a possible use-after-free due to a race cond... In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744 Scope: local bookworm: resolved (fixed in 5.4.13-1) bullseye: resolved (fixed in 5.4.

CVE-2016-5728 [MEDIUM] CVE-2016-5728: linux - Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in... Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header, aka a "double fetch" vulnerability. Scope: local bookworm: resolved (fi