Debian Linux vulnerabilities

CVE-2020-16166 [LOW] CVE-2020-16166: linux - The Linux kernel through 5.7.11 allows remote attackers to make observations tha... The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c. Scope: local bookworm: resolved (fixed in 5.7.17-1) bullseye: resolved (fixed in 5.7.17-1) forky: resolved (fixed in 5.

CVE-2022-49321 [MEDIUM] CVE-2022-49321: linux - In the Linux kernel, the following vulnerability has been resolved: xprtrdma: t... In the Linux kernel, the following vulnerability has been resolved: xprtrdma: treat all calls not a bcall when bc_serv is NULL When a rdma server returns a fault format reply, nfs v3 client may treats it as a bcall when bc service is not exist. The debug message at rpcrdma_bc_receive_call are, [56579.837169] RPC: rpcrdma_bc_receive_call: callback XID 00000001, lengt

CVE-2021-47515 [MEDIUM] CVE-2021-47515: linux - In the Linux kernel, the following vulnerability has been resolved: seg6: fix t... In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving interface index into the IPv4 socket control block (v5.16-rc4, net/ipv4/ip_input.c line 510): IPCB(skb)->iif = skb->skb_iif; If that IPv4 packet is meant to be encapsulated in

CVE-2024-38565 [MEDIUM] CVE-2024-38565: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ar552... In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: enable proper endpoint verification Syzkaller reports [1] hitting a warning about an endpoint in use not having an expected type to it. Fix the issue by checking for the existence of all proper endpoints with their according types intact. Sadly, this patch has not been tested on real h

CVE-2024-35884 [MEDIUM] CVE-2024-35884: linux - In the Linux kernel, the following vulnerability has been resolved: udp: do not... In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in a tunnel When rx-udp-gro-forwarding is enabled UDP packets might be GROed when being forwarded. If such packets might land in a tunnel this can cause various issues and udp_gro_receive makes sure this isn't the case by looking for a matching socket.

CVE-2021-43389 [MEDIUM] CVE-2021-43389: linux - An issue was discovered in the Linux kernel before 5.14.15. There is an array-in... An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. Scope: local bookworm: resolved (fixed in 5.14.16-1) bullseye: resolved (fixed in 5.10.84-1) forky: resolved (fixed in 5.14.16-1) sid: resolved (fixed in 5.14.16-1) trixie: resolved (fixed in 5.14.16-1)

CVE-2022-49048 [MEDIUM] CVE-2022-49048: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: fix p... In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6_forward() when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev vxlan100 root tc qdisc add dev vxlan100 root netem corrupt 5% Scope:

CVE-2022-49194 [MEDIUM] CVE-2022-49194: linux - In the Linux kernel, the following vulnerability has been resolved: net: bcmgen... In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: Use stronger register read/writes to assure ordering GCC12 appears to be much smarter about its dependency tracking and is aware that the relaxed variants are just normal loads and stores and this is causing problems like: [ 210.074549] ------------[ cut here ]------------ [ 210.07922

CVE-2019-12819 [MEDIUM] CVE-2019-12819: linux - An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_r... An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free. This will cause a denial of service. Scope: local bookworm: resolved (fixed in 4.19.37-1) bullseye: resolved (fixed in 4.19.37-1) forky: resolved (fixed in 4.19.37-1) sid:

CVE-2022-48828 [MEDIUM] CVE-2022-48828: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix i... In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix ia_size underflow iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dump

CVE-2022-49142 [MEDIUM] CVE-2022-49142: linux - In the Linux kernel, the following vulnerability has been resolved: net: preser... In the Linux kernel, the following vulnerability has been resolved: net: preserve skb_end_offset() in skb_unclone_keeptruesize() syzbot found another way to trigger the infamous WARN_ON_ONCE(delta truesize value, we also need to make sure TCP wont fill new tailroom that pskb_expand_head() was able to get from a addr = kmalloc(...) followed by ksize(addr) Split skb_u

CVE-2023-52881 [MEDIUM] CVE-2023-52881: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: do not... In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 guidelines: The ACK value is considered acceptable only if it is in the range of ((SND.UNA - MAX.SND.WND) SND.

CVE-2022-42721 [MEDIUM] CVE-2022-42721: linux - A list management bug in BSS handling in the mac80211 stack in the Linux kernel ... A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.149-1) forky: resolved (fixed in 6.0.2-1)

CVE-2014-3610 [MEDIUM] CVE-2014-3610: linux - The WRMSR processing functionality in the KVM subsystem in the Linux kernel thro... The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the hand

CVE-2019-15292 [MEDIUM] CVE-2019-15292: linux - An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-f... An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c. Scope: local bookworm: resolved (fixed in 4.19.37-1) bullseye: resolved (fixed in 4.19.37-1) forky: resolved (fixed in 4.19.37-1) sid: resolved (fixed in 4.19.37-1) t

CVE-2018-21008 [MEDIUM] CVE-2018-21008: linux - An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can ... An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c. Scope: local bookworm: resolved (fixed in 4.18.6-1) bullseye: resolved (fixed in 4.18.6-1) forky: resolved (fixed in 4.18.6-1) sid: resolved (fixed in 4.18.6-1) trixie: resolved (fixed

CVE-2018-15594 [MEDIUM] CVE-2018-15594: linux - arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain ... arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests. Scope: local bookworm: resolved (fixed in 4.17.15-1) bullseye: resolved (fixed in 4.17.15-1) forky: resolved (fixed in 4.17.15-1) sid: resolved (fixed in 4.17.15-1) trixie: resol

CVE-2021-26931 [MEDIUM] CVE-2021-26931: linux - An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in X... An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causi

CVE-2021-26401 [MEDIUM] CVE-2021-26401: linux - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some... LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. Scope: local bookworm: resolved (fixed in 5.16.12-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in 5.16.12-1) sid: resolved (fixed in 5.16.12-1) trixie: resolved (fixed in 5.16.12-1)

CVE-2018-16597 [MEDIUM] CVE-2018-16597: linux - An issue was discovered in the Linux kernel before 4.8. Incorrect access checkin... An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem. Scope: local bookworm: resolved (fixed in 4.8.5-1) bullseye: resolved (fixed in 4.8.5-1) forky: resolved (fixed in 4.8.5-1) sid: resolved (fixed in 4.8.5-1) trixie: resolved (