Debian Linux vulnerabilities

CVE-2023-4921 [HIGH] CVE-2023-4921: linux - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq componen... A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgradi

CVE-2021-47107 [HIGH] CVE-2021-47107: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix R... In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix READDIR buffer overflow If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has alway

CVE-2022-0500 [HIGH] CVE-2022-0500: linux - A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a po... A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.16.10-1) bullseye: open forky: resolved (fixed in 5.16.10-1) s

CVE-2022-1882 [HIGH] CVE-2022-1882: linux - A use-after-free flaw was found in the Linux kernel’s pipes functionality in how... A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in

CVE-2023-20938 [HIGH] CVE-2023-20938: linux - In binder_transaction_buffer_release of binder.c, there is a possible use after ... In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel Scope: local bo

CVE-2024-27075 [HIGH] CVE-2024-27075: linux - In the Linux kernel, the following vulnerability has been resolved: media: dvb-... In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: avoid stack overflow warnings with clang A previous patch worked around a KASAN issue in stv0367, now a similar problem showed up with clang: drivers/media/dvb-frontends/stv0367.c:1222:12: error: stack frame size (3624) exceeds limit (2048) in 'stv0367ter_set_frontend' [-Werror,-

CVE-2021-20268 [HIGH] CVE-2021-20268: linux - An out-of-bounds access flaw was found in the Linux kernel's implementation of t... An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system

CVE-2023-1281 [HIGH] CVE-2023-1281: linux - Use After Free vulnerability in Linux kernel traffic control index filter (tcind... Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue

CVE-2021-4028 [HIGH] CVE-2021-4028: linux - A flaw in the Linux kernel's implementation of RDMA communications manager liste... A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the syste

CVE-2020-14351 [HIGH] CVE-2020-14351: linux - A flaw was found in the Linux kernel. A use-after-free memory flaw was found in ... A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Scope: local bookworm: resolved (fixed

CVE-2024-47742 [HIGH] CVE-2024-47742: linux - In the Linux kernel, the following vulnerability has been resolved: firmware_lo... In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such. However, there are a couple codepaths in the kernel where firmware file names contain string components

CVE-2024-36978 [HIGH] CVE-2024-36978: linux - In the Linux kernel, the following vulnerability has been resolved: net: sched:... In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur. Scope: local bookworm: resolved (fixed in 6.1.99-1)

CVE-2024-1085 [HIGH] CVE-2024-1085: linux - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon... A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making

CVE-2023-1670 [HIGH] CVE-2023-1670: linux - A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Etherne... A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.20-2) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.20-2) sid: resolved (fixed in 6.1.20-2) t

CVE-2024-26753 [HIGH] CVE-2024-26753: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: vir... In the Linux kernel, the following vulnerability has been resolved: crypto: virtio/akcipher - Fix stack overflow on memcpy sizeof(struct virtio_crypto_akcipher_session_para) is less than sizeof(struct virtio_crypto_op_ctrl_req::u), copying more bytes from stack variable leads stack overflow. Clang reports this issue by commands: make -j CC=clang-14 mrproper >/dev/null

CVE-2022-48948 [HIGH] CVE-2022-48948: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget... In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This

CVE-2021-47404 [HIGH] CVE-2021-47404: linux - In the Linux kernel, the following vulnerability has been resolved: HID: betop:... In the Linux kernel, the following vulnerability has been resolved: HID: betop: fix slab-out-of-bounds Write in betop_probe Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty be

CVE-2024-42148 [HIGH] CVE-2024-42148: linux - In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix ... In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. Currently there is a read/write o

CVE-2024-53142 [HIGH] CVE-2024-53142: linux - In the Linux kernel, the following vulnerability has been resolved: initramfs: ... In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffer overrun The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as: 37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data ... 55 ============= ================== ========================= 56 Field name Fi

CVE-2024-53194 [HIGH] CVE-2024-53194: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: Fix us... In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Route