Debian Linux vulnerabilities

CVE-2021-30002 [MEDIUM] CVE-2021-30002: linux - An issue was discovered in the Linux kernel before 5.11.3 when a webcam device e... An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b. Scope: local bookworm: resolved (fixed in 5.10.24-1) bullseye: resolved (fixed in 5.10.24-1) forky: resolved (fixed in 5.10.24-1) sid: resolved (fixed in 5.10.24-1)

CVE-2021-47329 [MEDIUM] CVE-2021-47329: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: megar... In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix resource leak in case of probe failure The driver doesn't clean up all the allocated resources properly when scsi_add_host(), megasas_start_aen() function fails during the PCI device probe. Clean up all those resources. Scope: local bookworm: resolved (fixed in 5.14.6-1) bull

CVE-2023-52861 [MEDIUM] CVE-2023-52861: linux - In the Linux kernel, the following vulnerability has been resolved: drm: bridge... In the Linux kernel, the following vulnerability has been resolved: drm: bridge: it66121: Fix invalid connector dereference Fix the NULL pointer dereference when no monitor is connected, and the sound card is opened from userspace. Instead return an empty buffer (of zeroes) as the EDID information to the sound framework if there is no connector attached. Scope: loca

CVE-2021-47503 [MEDIUM] CVE-2021-47503: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: pm80x... In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc() Calling scsi_remove_host() before scsi_add_host() results in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000108 RIP: 0010:device_del+0x63/0x440 Call Trace: device_unregister+0x17/0x60 scsi_remove_host+0xee/0x2a0 pm8

CVE-2024-36888 [MEDIUM] CVE-2024-36888: linux - In the Linux kernel, the following vulnerability has been resolved: workqueue: ... In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix selection of wake_cpu in kick_pool() With cpu_possible_mask=0-63 and cpu_online_mask=0-7 the following kernel oops was observed: smp: Bringing up secondary CPUs ... smp: Brought up 1 node, 8 CPUs Unable to handle kernel pointer dereference in virtual kernel address space Failing addre

CVE-2015-8551 [MEDIUM] CVE-2015-8551: linux - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1... The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence o

CVE-2023-5090 [MEDIUM] CVE-2023-5090: linux - A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() ... A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition. Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: resolved forky: resolved (fixed in 6.5.8-1) sid: resolved (fixed in 6.5.8-1) trixie: resolved (fix

CVE-2023-0394 [MEDIUM] CVE-2023-0394: linux - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ip... A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. Scope: local bookworm: resolved (fixed in 6.1.7-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (fixed in 6.1.7-1) sid: resolved (fixed in 6.1.7-1) trixie: resolved (fixed in 6.1.7-1

CVE-2024-26817 [MEDIUM] CVE-2024-26817: linux - In the Linux kernel, the following vulnerability has been resolved: amdkfd: use... In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer overflow This uses calloc instead of doing the multiplication which might overflow. Scope: local bookworm: resolved (fixed in 6.1.90-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.8.9-1) sid: resolved (fixed in 6.8.9-1)

CVE-2021-47307 [MEDIUM] CVE-2021-47307: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: preve... In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL deref in cifs_compose_mount_options() The optional @ref parameter might contain an NULL node_name, so prevent dereferencing it in cifs_compose_mount_options(). Addresses-Coverity: 1476408 ("Explicit null dereferenced") Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye:

CVE-2018-18690 [MEDIUM] CVE-2018-18690: linux - In the Linux kernel before 4.17, a local attacker able to set attributes on an x... In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short

CVE-2022-49664 [MEDIUM] CVE-2022-49664: linux - In the Linux kernel, the following vulnerability has been resolved: tipc: move ... In the Linux kernel, the following vulnerability has been resolved: tipc: move bc link creation back to tipc_node_create Shuang Li reported a NULL pointer dereference crash: [] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc] [] Call Trace: [] [] tipc_bcast_rcv+0xa2/0x190 [tipc] [] tipc_node_bc_rcv+0x8b/0x2

CVE-2014-7970 [MEDIUM] CVE-2014-7970: linux - The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17... The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call. Scope: local bookworm: resolved (fixed in 3.16.7-1) bullseye: resolved (fixe

CVE-2023-52887 [MEDIUM] CVE-2023-52887: linux - In the Linux kernel, the following vulnerability has been resolved: net: can: j... In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new This patch enhances error handling in scenarios with RTS (Request to Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE backtraces with a new error handling method. This p

CVE-2021-47179 [MEDIUM] CVE-2021-47179: linux - In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix ... In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() Commit de144ff4234f changes _pnfs_return_layout() to call pnfs_mark_matching_lsegs_return() passing NULL as the struct pnfs_layout_range argument. Unfortunately, pnfs_mark_matching_lsegs_return() doesn't check if we have a va

CVE-2022-49280 [MEDIUM] CVE-2022-49280: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: preve... In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent underflow in nfssvc_decode_writeargs() Smatch complains: fs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs() warn: no lower bound on 'args->len' Change the type to unsigned to prevent this issue. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) fo

CVE-2024-35880 [MEDIUM] CVE-2024-35880: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/kb... In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: hold io_buffer_list reference over mmap If we look up the kbuf, ensure that it doesn't get unregistered until after we're done with it. Since we're inside mmap, we cannot safely use the io_uring lock. Rely on the fact that we can lookup the buffer list under RCU now and grab a referen

CVE-2022-49356 [MEDIUM] CVE-2022-49356: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Tra... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Trap RDMA segment overflows Prevent svc_rdma_build_writes() from walking off the end of a Write chunk's segment array. Caught with KASAN. The test that this fix replaces is invalid, and might have been left over from an earlier prototype of the PCL work. Scope: local bookworm: resolved (fixe

CVE-2020-12769 [MEDIUM] CVE-2020-12769: linux - An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c ... An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8. Scope: local bookworm: resolved (fixed in 5.4.19-1) bullseye: resolved (fixed in 5.4.19-1) forky: resolved (fixed in 5.4.19-1) sid: resolved (fixed in 5.4.19-1) trixie: res

CVE-2024-38618 [MEDIUM] CVE-2024-38618: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: timer... In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expi