Debian Linux vulnerabilities

CVE-2017-15102 [MEDIUM] CVE-2017-15102: linux - The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel ... The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference. Scope: local bookworm: resolved (fixed in 4.7.8-1) bullseye:

CVE-2020-27067 [MEDIUM] CVE-2020-27067: linux - In the l2tp subsystem, there is a possible use after free due to a race conditio... In the l2tp subsystem, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152409173 Scope: local bookworm: resolved (fixed in 4.15.4-1) bullseye: resolved (fixed in 4.

CVE-2024-27032 [MEDIUM] CVE-2024-27032: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential panic during recovery During recovery, if FAULT_BLOCK is on, it is possible that f2fs_reserve_new_block() will return -ENOSPC during recovery, then it may trigger panic. Also, if fault injection rate is 1 and only FAULT_BLOCK fault type is on, it may encounter deadloop i

CVE-2023-52644 [MEDIUM] CVE-2023-52644: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: b43: ... In the Linux kernel, the following vulnerability has been resolved: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled When QoS is disabled, the queue priority value will not map to the correct ieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS is disabled to prevent trying to stop/wake a non-existent queue and failing to s

CVE-2024-27030 [MEDIUM] CVE-2024-27030: linux - In the Linux kernel, the following vulnerability has been resolved: octeontx2-a... In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Use separate handlers for interrupts For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts are raised to two CPUs at same time then two cores serve same event corrupting the data. Scope: local bookwor

CVE-2019-19332 [MEDIUM] CVE-2019-19332: linux - An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 ... An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of s

CVE-2015-3339 [MEDIUM] CVE-2015-3339: linux - Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel b... Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. Scope: local bookworm: resolved (fixed in 3.16.7-ckt9-3) bullseye: resolved (fixed in

CVE-2020-10751 [MEDIUM] CVE-2020-10751: linux - A flaw was found in the Linux kernels SELinux LSM hook implementation before ver... A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.

CVE-2024-57874 [MEDIUM] CVE-2024-57874: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: ptra... In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potential

CVE-2024-24861 [LOW] CVE-2024-24861: linux - A race condition was found in the Linux kernel's media/xc4000 device driver in x... A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: resolved (

CVE-2022-0487 [MEDIUM] CVE-2022-0487: linux - A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/me... A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1. Scope: local bookworm: resolved (fixed in 5.16.10-1) bullseye: resolved (fixed in 5.10.103

CVE-2022-48696 [MEDIUM] CVE-2022-48696: linux - In the Linux kernel, the following vulnerability has been resolved: regmap: spi... In the Linux kernel, the following vulnerability has been resolved: regmap: spi: Reserve space for register address/padding Currently the max_raw_read and max_raw_write limits in regmap_spi struct do not take into account the additional size of the transmitted register address and padding. This may result in exceeding the maximum permitted SPI message size, which co

CVE-2024-26666 [HIGH] CVE-2024-26666: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix RCU use in TDLS fast-xmit This looks up the link under RCU protection, but isn't guaranteed to actually have protection. Fix that. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.7.7-1) sid: resolved (fixed in 6.7.7-1) trixie: resolved (fixed in 6.7.7

CVE-2013-7470 [MEDIUM] CVE-2013-7470: linux - cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7,... cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310. Scope: local bookworm: resolved (fixed in 3.11.7-1) bullseye: resolved (fixed in 3.11.7-1) forky: resolved (

CVE-2014-5206 [HIGH] CVE-2014-5206: linux - The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 doe... The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which allows local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms via a "mount -o remount" command within a user namespace. Scope: local bookworm: resolved (fixed in

CVE-2016-0774 [HIGH] CVE-2016-0774: linux - The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain L... The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows

CVE-2022-50665 CVE-2022-50665: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11... In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected It has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(), as below, it will not print when debug_mask is not set ATH11K_DBG_DATA. ath11k_dbg(ab, ATH11K_DBG_DATA, "failed to find the peer with peer_id %d\n", ppdu_info

CVE-2023-54129 CVE-2023-54129: linux - In the Linux kernel, the following vulnerability has been resolved: octeontx2-a... In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, whic

CVE-2023-53797 CVE-2023-53797: linux - In the Linux kernel, the following vulnerability has been resolved: HID: wacom:... In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Use ktime_t rather than int when dealing with timestamps Code which interacts with timestamps needs to use the ktime_t type returned by functions like ktime_get. The int type does not offer enough space to store these values, and attempting to use it is a recipe for problems. In this particular c

CVE-2025-40004 [LOW] CVE-2025-40004: linux - In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix... In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix buffer overflow in USB transport layer A buffer overflow vulnerability exists in the USB 9pfs transport layer where inconsistent size validation between packet header parsing and actual data copying allows a malicious USB host to overflow heap buffers. The issue occurs because: - usb9pfs_rx