Debian Linux vulnerabilities

CVE-2020-0066 [MEDIUM] CVE-2020-0066: linux - In the netlink driver, there is a possible out of bounds write due to a race con... In the netlink driver, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-65025077 Scope: local bookworm: resolved (fixed in 4.2.5-1) bullseye: resolved (fixed in 4

CVE-2022-1280 [MEDIUM] CVE-2022-1280: linux - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/dr... A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of service (DoS) or a kernel information leak. Scope: local bookworm: resolved (fixed in 5.15.3-1) bullseye: open forky: resolved (fixed in 5.15.3-1) sid: resolved (fixed

CVE-2018-12633 [MEDIUM] CVE-2018-12633: linux - An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioct... An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches

CVE-2023-52581 [MEDIUM] CVE-2023-52581: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type will wrap before reaching the boundary and nft_trans_gc_space() always returns true. This means we recycle t

CVE-2024-38544 [MEDIUM] CVE-2024-38544: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: F... In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wr

CVE-2022-39842 [MEDIUM] CVE-2022-39842: linux - An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in ... An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer dis

CVE-2023-39193 [MEDIUM] CVE-2023-39193: linux - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_che... A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved (fixed in 5.10.197-1) forky: resol

CVE-2020-8647 [MEDIUM] CVE-2020-8647: linux - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the... There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) sid: resolved (fixed in 5.5.13-1) trixie: resolved (fixed in 5.5.13-1)

CVE-2014-9717 [MEDIUM] CVE-2014-9717: linux - fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 sys... fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace. Scope: local bookworm: resolved (fixed in 4.0.2-1) bullseye: resol

CVE-2018-12130 [MEDIUM] CVE-2018-12130: intel-microcode - Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some micro... Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-in

CVE-2020-11565 [MEDIUM] CVE-2020-11565: linux - An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/... An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only

CVE-2020-10742 [MEDIUM] CVE-2020-10742: linux - A flaw was found in the Linux kernel. An index buffer overflow during Direct IO ... A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality and system availability. Scope: local bookworm: resolved (fixed in 3.1

CVE-2021-29155 [MEDIUM] CVE-2021-29155: linux - An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.... An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by

CVE-2024-35910 [MEDIUM] CVE-2024-35910: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: proper... In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago. When TCP sockets are closed, we call in

CVE-2022-2663 [MEDIUM] CVE-2022-2663: linux - An issue was found in the Linux kernel in nf_conntrack_irc where the message han... An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.149-1) forky: resolved (fixed in 6.0.

CVE-2021-28038 [MEDIUM] CVE-2021-28038: linux - An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV.... An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists

CVE-2024-36350 [MEDIUM] CVE-2024-36350: amd64-microcode - A transient execution vulnerability in some AMD processors may allow an attacker... A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 3.20251202.1) sid: resolved (fixed in 3.20251202.1) trixie: open

CVE-2018-7755 [MEDIUM] CVE-2018-7755: linux - An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.... An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security prote

CVE-2022-1016 [MEDIUM] CVE-2022-1016: linux - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_ch... A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.113-1)

CVE-2015-9289 [MEDIUM] CVE-2015-9289: linux - In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspa... In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23. Scope: local bookworm: resolved (fixed in 4.1.5-1) bullseye: resolved (fixed in 4.1.5-1) forky: resolved (fixed