Debian Linux vulnerabilities

CVE-2024-36013 [MEDIUM] CVE-2024-36013: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports

CVE-2023-39180 [MEDIUM] CVE-2023-39180: linux - A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd m... A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of Linux. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are

CVE-2021-47308 [MEDIUM] CVE-2021-47308: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: libfc... In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix array index out of bound exception Fix array index out of bound exception in fc_rport_prli_resp(). Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.70-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: resolved (fixe

CVE-2016-4485 [HIGH] CVE-2016-4485: linux - The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 d... The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message. Scope: local bookworm: resolved (fixed in 4.5.4-1) bullseye: resolved (fixed in 4.5.4-1) forky: resolved (fixed in 4.5.4-1) sid: resolved (fixed

CVE-2023-52801 [CRITICAL] CVE-2023-52801: linux - In the Linux kernel, the following vulnerability has been resolved: iommufd: Fi... In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to be properly reinserted. Otherwise the domains_itree becomes corrupted and we will UAF. Scope: local bookwor

CVE-2023-4458 [MEDIUM] CVE-2023-4458: linux - A flaw was found within the parsing of extended attributes in the kernel ksmbd m... A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnera

CVE-2016-4580 [HIGH] CVE-2016-4580: linux - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux k... The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request. Scope: local bookworm: resolved (fixed in 4.5.5-1) bullseye: resolved (fixed in 4.5.5-1) forky: resolved (fixed

CVE-2024-38605 [HIGH] CVE-2024-38605: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: core:... In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix NULL module pointer assignment at card init The commit 81033c6b584b ("ALSA: core: Warn on empty module") introduced a WARN_ON() for a NULL module pointer passed at snd_card object creation, and it also wraps the code around it with '#ifdef MODULE'. This works in most cases, but the dev

CVE-2021-45485 [HIGH] CVE-2021-45485: linux - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_co... In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.70-1) fo

CVE-2021-4093 [HIGH] CVE-2021-4093: linux - A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtu... A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system o

CVE-2020-29569 [HIGH] CVE-2020-29569: linux - An issue was discovered in the Linux kernel through 5.10.1, as used with Xen thr... An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-

CVE-2018-16882 [HIGH] CVE-2018-16882: linux - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor pr... A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A gu

CVE-2024-35814 [HIGH] CVE-2024-35814: linux - In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fi... In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment checks"), causes a functional regression with vsock in a virtual machine using bounci

CVE-2019-18805 [CRITICAL] CVE-2019-18805: linux - An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before... An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. Scope: local bookworm:

CVE-2022-0742 [CRITICAL] CVE-2022-0742: linux - Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attack... Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc. Scope: local bookworm: resolved (fixed in 5.16.14-1) bullseye: resolved forky: resolved (fixed in 5.16.14-1) sid: resolved (fi

CVE-2021-27365 [HIGH] CVE-2021-27365: linux - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data s... An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message. Scope: local bookworm: resolved (fixed in 5.10.

CVE-2016-10764 [CRITICAL] CVE-2016-10764: linux - In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-... In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead. Scope: local bookworm: resolved (fixed in 4.9.6-1) bullseye: resolved (fixed in 4.9.6-1) forky: resolved (fixed in 4.9.6-1) sid: resolve

CVE-2018-6412 [HIGH] CVE-2018-6412: linux - In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Li... In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands. Scope: local bookworm: resolved (fixed in 4.16.5-1) bullseye: resolved (fixed in 4.16.5-1) forky: resolved (fixed in 4.16.5-1) sid: resolved (fi

CVE-2023-52434 [HIGH] CVE-2023-52434: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervi

CVE-2019-18814 [CRITICAL] CVE-2019-18814: linux - An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-... An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. Scope: local bookworm: resolved (fixed in 5.7.6-1) bullseye: resolved (fixed in 5.7.6-1) forky: resolved (fixed in 5.7.6-1) sid: resolved (fixed in 5.7.6-1) trixie: resolved (fixed in 5.7.6-1)