Debian Linux vulnerabilities

CVE-2019-7221 [HIGH] CVE-2019-7221: linux - The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. Scope: local bookworm: resolved (fixed in 4.19.20-1) bullseye: resolved (fixed in 4.19.20-1) forky: resolved (fixed in 4.19.20-1) sid: resolved (fixed in 4.19.20-1) trixie: resolved (fixed in 4.19.20-1)

CVE-2021-47506 [HIGH] CVE-2021-47506: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix u... In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegat

CVE-2021-47328 [HIGH] CVE-2021-47328: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi... In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn use after free during resets If we haven't done a unbind target call we can race where iscsi_conn_teardown wakes up the EH thread and then frees the conn while those threads are still accessing the conn ehwait. We can only do one TMF per session so this just moves the TMF fields

CVE-2018-9568 [HIGH] CVE-2018-9568: linux - In sk_clone_lock of sock.c, there is a possible memory corruption due to type co... In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel. Scope: local bookworm: resolved (fixed

CVE-2021-47131 [HIGH] CVE-2021-47131: linux - In the Linux kernel, the following vulnerability has been resolved: net/tls: Fi... In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix use-after-free after the TLS device goes down and up When a netdev with active TLS offload goes down, tls_device_down is called to stop the offload and tear down the TLS context. However, the socket stays alive, and it still points to the TLS context, which is now deallocated. If a netdev

CVE-2021-46999 [HIGH] CVE-2021-46999: linux - In the Linux kernel, the following vulnerability has been resolved: sctp: do as... In the Linux kernel, the following vulnerability has been resolved: sctp: do asoc update earlier in sctp_sf_do_dupcook_a There's a panic that occurs in a few of envs, the call trace is as below: [] general protection fault, ... 0x29acd70f1000a: 0000 [#1] SMP PTI [] RIP: 0010:sctp_ulpevent_notify_peer_addr_change+0x4b/0x1fa [sctp] [] sctp_assoc_control_transport+0x1b9/

CVE-2023-52741 [HIGH] CVE-2023-52741: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: Fix u... In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 Call Trace: dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpa

CVE-2024-47696 [HIGH] CVE-2024-47696: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: ... In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flush_workqueue is invoked to flush the work queue iwcm_wq. But at that time, the work queue iwcm_wq was created via the functi

CVE-2021-47477 [HIGH] CVE-2021-47477: linux - In the Linux kernel, the following vulnerability has been resolved: comedi: dt9... In the Linux kernel, the following vulnerability has been resolved: comedi: dt9812: fix DMA buffers on stack USB transfer buffers are typically mapped for DMA and must not be allocated on the stack or transfers will fail. Allocate proper transfer buffers in the various command helpers and return an error on short transfers instead of acting on random stack data. Note

CVE-2024-26782 [HIGH] CVE-2024-26782: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix ... In the Linux kernel, the following vulnerability has been resolved: mptcp: fix double-free on socket dismantle when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inet_opt' for the new socket has the same value as the original one: as a consequence, on program exit it's possible to observe the following splat: BUG:

CVE-2020-12657 [HIGH] CVE-2020-12657: linux - An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-f... An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body. Scope: local bookworm: resolved (fixed in 5.6.7-1) bullseye: resolved (fixed in 5.6.7-1) forky: resolved (fixed in 5.6.7-1) sid: resolved (fixed in 5.6.7-1) trixie: resolved (fixed in 5.6.7-1)

CVE-2023-52669 [HIGH] CVE-2023-52669: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: s39... In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing. Scope: local bookworm: resolved

CVE-2019-2054 [HIGH] CVE-2019-2054: linux - In the seccomp implementation prior to kernel version 4.8, there is a possible s... In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies that allow the use of ptrace. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-119769499 Scope: local

CVE-2023-52775 [HIGH] CVE-2023-52775: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: av... In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid data corruption caused by decline We found a data corruption issue during testing of SMC-R on Redis applications. The benchmark has a low probability of reporting a strange error as shown below. "Error: Protocol error, got "\xe2" as reply type byte" Finally, we found that the retrieved

CVE-2024-27018 [HIGH] CVE-2024-27018: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: skip conntrack input hook for promisc packets For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaround to reset conntrack for these packets. Jianbo Liu reports warning splat

CVE-2018-20976 [HIGH] CVE-2018-20976: linux - An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A... An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure. Scope: local bookworm: resolved (fixed in 4.18.6-1) bullseye: resolved (fixed in 4.18.6-1) forky: resolved (fixed in 4.18.6-1) sid: resolved (fixed in 4.18.6-1) trixie: resolved (fixed in 4.18.6-1)

CVE-2021-33631 [MEDIUM] CVE-2021-33631: linux - Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (files... Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.4-1)

CVE-2020-25670 [HIGH] CVE-2020-25670: linux - A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind(... A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalations. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolved (fixed in 5.10.38-1) sid: resolved (fixed in 5.10.38-1) trixie: resolved (fixed in 5.10.38-1)

CVE-2021-37576 [HIGH] CVE-2021-37576: linux - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc... arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.46-5) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: resolv

CVE-2021-33033 [HIGH] CVE-2021-33033: linux - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/i... The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value. Scope: local bookworm: resolved (fixed in 5.10.24-1) bullseye: resolved (fixed in 5.10.24-1) forky: resolved (fixed in 5.10.24-1