Debian Linux vulnerabilities

CVE-2023-32249 [MEDIUM] CVE-2023-32249: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: not ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if binding session is guest. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.3.7-1)

CVE-2022-49928 [MEDIUM] CVE-2022-49928: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed There is a null-ptr-deref when xps sysfs alloc failed: BUG: KASAN: null-ptr-deref in sysfs_do_create_link_sd+0x40/0xd0 Read of size 8 at addr 0000000000000030 by task gssproxy/457 CPU: 5 PID: 457 Comm: gssproxy Not tainted 6.0.0-09040-g02357b27e

CVE-2023-52522 [MEDIUM] CVE-2023-52522: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix po... In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or

CVE-2022-49160 [MEDIUM] CVE-2022-49160: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash during module load unload test During purex packet handling the driver was incorrectly freeing a pre-allocated structure. Fix this by skipping that entry. System crashed with the following stack during a module unload test. Call Trace: sbitmap_init_node+0x7f/0x1e0 sbitmap_qu

CVE-2024-57997 [MEDIUM] CVE-2024-57997: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36... In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix channel survey memory allocation size KASAN reported a memory allocation issue in wcn->chan_survey due to incorrect size calculation. This commit uses kcalloc to allocate memory for wcn->chan_survey, ensuring proper initialization and preventing the use of uninitialized values whe

CVE-2022-28389 [MEDIUM] CVE-2022-28389: linux - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel throug... mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: resolved (fixed in 5.17.3-1)

CVE-2023-6622 [MEDIUM] CVE-2023-6622: linux - A null pointer dereference vulnerability was found in nft_dynset_init() in net/n... A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in

CVE-2022-49468 [MEDIUM] CVE-2022-49468: linux - In the Linux kernel, the following vulnerability has been resolved: thermal/cor... In the Linux kernel, the following vulnerability has been resolved: thermal/core: Fix memory leak in __thermal_cooling_device_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff888010080000 (size 264312): comm "182", pid 102533, jiffies 4296434960 (age 10.100s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff f

CVE-2024-26602 [MEDIUM] CVE-2024-26602: linux - In the Linux kernel, the following vulnerability has been resolved: sched/memba... In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the ability for this to be called at too high of a frequency and s

CVE-2022-36879 [MEDIUM] CVE-2022-36879: linux - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policie... An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed in 5.18.16-1) sid: resolved (fixed in 5.18.16-1) trixie: resolved (fixed in 5.18.16-1)

CVE-2024-26773 [MEDIUM] CVE-2024-26773: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: avoid... In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid allocating blocks from a group with a corrupted block bitmap in the following concurrency and making the situation

CVE-2023-23454 [MEDIUM] CVE-2023-23454: linux - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows att... cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). Scope: local bookworm: resolved (fixed in 6.1.7-1) bullseye: resolved (fixed in 5.10.162

CVE-2024-38620 [MEDIUM] CVE-2024-38620: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCI_AMP controllers no longer has any use so remove it along with the capability of creating AMP controllers. Since we no longer need to differentiate between AMP and Primary controllers, as only HCI_PRIMARY is left, this also remove

CVE-2024-50265 [MEDIUM] CVE-2024-50265: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: remo... In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial t

CVE-2023-52656 [MEDIUM] CVE-2023-52656: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring: d... In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to SCM_RIGHTS This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: resolved (fixed in 6

CVE-2022-49080 [MEDIUM] CVE-2022-49080: linux - In the Linux kernel, the following vulnerability has been resolved: mm/mempolic... In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix mpol_new leak in shared_policy_replace If mpol_new is allocated but not used in restart loop, mpol_new will be freed via mpol_put before returning to the caller. But refcnt is not initialized yet, so mpol_put could not do the right things and might leak the unused mpol_new. This wo

CVE-2022-48804 [MEDIUM] CVE-2022-48804: linux - In the Linux kernel, the following vulnerability has been resolved: vt_ioctl: f... In the Linux kernel, the following vulnerability has been resolved: vt_ioctl: fix array_index_nospec in vt_setactivate array_index_nospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a transient integer underflow. vsa.console should be decreased first and then sanitized with array_index_nospe

CVE-2022-50171 [MEDIUM] CVE-2022-50171: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: his... In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - don't sleep when in softirq When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error: BUG: scheduling while atomic: swapper/57/0/0x00000300 Call trace: dump_b

CVE-2021-29649 [MEDIUM] CVE-2021-29649: linux - An issue was discovered in the Linux kernel before 5.11.11. The user mode driver... An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677. Scope: local bookworm: resolved (fixed in 5.10.28-1) bullseye: resolved (fixed in 5.10.28-1) forky: resolved (fixed in

CVE-2024-40970 [MEDIUM] CVE-2024-40970: linux - In the Linux kernel, the following vulnerability has been resolved: Avoid hw_de... In the Linux kernel, the following vulnerability has been resolved: Avoid hw_desc array overrun in dw-axi-dmac I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put() handles the hw_desc considering the descs_allocated, this scenario would result in a ke