Debian Linux vulnerabilities

CVE-2024-35823 [MEDIUM] CVE-2024-35823: linux - In the Linux kernel, the following vulnerability has been resolved: vt: fix uni... In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffe

CVE-2017-1000255 [MEDIUM] CVE-2017-1000255: linux - On Linux running on PowerPC hardware (Power8 or later) a user process can craft ... On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker

CVE-2022-2905 [MEDIUM] CVE-2022-2905: linux - An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem ... An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.140-1) forky: resolved (fixed in 5.19.6

CVE-2021-3732 [MEDIUM] CVE-2021-3732: linux - A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user m... A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.46-5) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.1

CVE-2024-35878 [MEDIUM] CVE-2024-35878: linux - In the Linux kernel, the following vulnerability has been resolved: of: module:... In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf() In of_modalias(), we can get passed the str and len parameters which would cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr when the length is also 0. Also, we need to filter out the negative values of the len para

CVE-2023-4194 [MEDIUM] CVE-2023-4194: linux - A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could a... A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 6

CVE-2023-28866 [MEDIUM] CVE-2023-28866: linux - In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds... In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not. Scope: local bookworm: resolved (fixed in 6.1.20-2) bullseye: resolved forky: resolved (fixed in 6.1.20-2) sid: resolved (fixed in 6.1.20-2) trixie: resolved (fixed in 6.1.20-2)

CVE-2022-48853 [MEDIUM] CVE-2022-48853: linux - In the Linux kernel, the following vulnerability has been resolved: swiotlb: fi... In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO interface with: dxfer_len == 524288, dxdfer_dir == S

CVE-2023-2162 [MEDIUM] CVE-2023-2162: linux - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drive... A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. Scope: local bookworm: resolved (fixed in 6.1.11-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.11-1) sid: resolved (fixed in 6.1.11-1)

CVE-2023-52618 [MEDIUM] CVE-2023-52618: linux - In the Linux kernel, the following vulnerability has been resolved: block/rnbd-... In the Linux kernel, the following vulnerability has been resolved: block/rnbd-srv: Check for unlikely string overflow Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnb

CVE-2021-47140 [MEDIUM] CVE-2021-47140: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/amd: ... In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Clear DMA ops when switching domain Since commit 08a27c1c3ecf ("iommu: Add support to change default domain of an iommu group") a user can switch a device between IOMMU and direct DMA through sysfs. This doesn't work for AMD IOMMU at the moment because dev->dma_ops is not cleared when swi

CVE-2023-39189 [MEDIUM] CVE-2023-39189: linux - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_ad... A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved

CVE-2023-6121 [MEDIUM] CVE-2023-6121: linux - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in th... An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg). Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: re

CVE-2025-68254 CVE-2025-68254: linux - In the Linux kernel, the following vulnerability has been resolved: staging: rt... In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets lie within the received frame buffer. A malformed beacon with an ESR IE positioned at the end of

CVE-2022-50818 CVE-2022-50818: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: pm800... In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix running_req for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@(none)$ more /sys/class/sas_phy/phy-0:0:8/target_port_protocols sata root@(none)$ echo 0 > sys/class/sas_phy/phy-0:0:8/enable root@(none)$ [ 67.855950] sas: ex 500e004aaaaaaa1f phy08 change

CVE-2025-68346 CVE-2025-68346: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: dice:... In the Linux kernel, the following vulnerability has been resolved: ALSA: dice: fix buffer overflow in detect_stream_formats() The function detect_stream_formats() reads the stream_count value directly from a FireWire device without validating it. This can lead to out-of-bounds writes when a malicious device provides a stream_count value greater than MAX_STREAMS. Fix by appl

CVE-2025-68217 CVE-2025-68217: linux - In the Linux kernel, the following vulnerability has been resolved: Input: pega... In the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buf

CVE-2025-71197 CVE-2025-71197: linux - In the Linux kernel, the following vulnerability has been resolved: w1: therm: ... In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy '

CVE-2025-40220 CVE-2025-40220: linux - In the Linux kernel, the following vulnerability has been resolved: fuse: fix l... In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser thre

CVE-2025-40084 CVE-2025-40084: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: tran... In the Linux kernel, the following vulnerability has been resolved: ksmbd: transport_ipc: validate payload size before reading handle handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Va