Debian Linux vulnerabilities

CVE-2024-27041 [MEDIUM] CVE-2024-27041: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini() Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULL before the call to dc_enable_dmub_notifications(), check beforehand to ensure there will not be a possible NULL-ptr-deref there. Also, since commit 1e88eb1b2c25 ("dr

CVE-2024-39504 [MEDIUM] CVE-2024-39504: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: validate mandatory meta and payload Check for mandatory netlink attributes in payload and meta expression when used embedded from the inner expression, otherwise NULL pointer dereference is possible from userspace. Scope: local bookworm: resolved bullseye: resolved forky: resol

CVE-2024-41052 [MEDIUM] CVE-2024-41052: linux - In the Linux kernel, the following vulnerability has been resolved: vfio/pci: I... In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Init the count variable in collecting hot-reset devices The count variable is used without initialization, it results in mistakes in the device counting and crashes the userspace if the get hot reset info path is triggered. Scope: local bookworm: resolved bullseye: resolved forky: resolved

CVE-2023-52472 [MEDIUM] CVE-2023-52472: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: rsa... In the Linux kernel, the following vulnerability has been resolved: crypto: rsa - add a check for allocation failure Static checkers insist that the mpi_alloc() allocation can fail so add a check to prevent a NULL dereference. Small allocations like this can't actually fail in current kernels, but adding a check is very simple and makes the static checkers happy. Sc

CVE-2023-52473 [MEDIUM] CVE-2023-52473: linux - In the Linux kernel, the following vulnerability has been resolved: thermal: co... In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix NULL pointer dereference in zone registration error path If device_register() in thermal_zone_device_register_with_trips() returns an error, the tz variable is set to NULL and subsequently dereferenced in kfree(tz->tzp). Commit adc8749b150c ("thermal/drivers/core: Use put_device()

CVE-2024-41001 [MEDIUM] CVE-2024-41001: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/sq... In the Linux kernel, the following vulnerability has been resolved: io_uring/sqpoll: work around a potential audit memory leak kmemleak complains that there's a memory leak related to connect handling: unreferenced object 0xffff0001093bdf00 (size 128): comm "iou-sqp-455", pid 457, jiffies 4294894164 hex dump (first 32 bytes): 02 00 fa ea 7f 00 00 01 00 00 00 00 00 0

CVE-2023-52882 [MEDIUM] CVE-2023-52882: linux - In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-... In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doi

CVE-2022-3061 [MEDIUM] CVE-2022-3061: linux - Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any... Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error. Scope: local bookworm: resolved (fixed in 5.18.2-1) bullseye: resolved (fixed in 5.10.149-1) forky: resolved (fixed in 5.18.2-1) sid: resolved (fixed i

CVE-2022-49405 [MEDIUM] CVE-2022-49405: linux - In the Linux kernel, the following vulnerability has been resolved: staging: r8... In the Linux kernel, the following vulnerability has been resolved: staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan() This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved forky: resolved (fixed in 5.18.5-1)

CVE-2022-49185 [MEDIUM] CVE-2022-49185: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: no... In the Linux kernel, the following vulnerability has been resolved: pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113

CVE-2024-36478 [MEDIUM] CVE-2024-36478: linux - In the Linux kernel, the following vulnerability has been resolved: null_blk: f... In the Linux kernel, the following vulnerability has been resolved: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' Writing 'power' and 'submit_queues' concurrently will trigger kernel panic: Test script: modprobe null_blk nr_devices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submit_queues; echo 4 > submit_que

CVE-2021-47113 [MEDIUM] CVE-2021-47113: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: abor... In the Linux kernel, the following vulnerability has been resolved: btrfs: abort in rename_exchange if we fail to insert the second ref Error injection stress uncovered a problem where we'd leave a dangling inode ref if we failed during a rename_exchange. This happens because we insert the inode ref for one side of the rename, and then for the other side. If this se

CVE-2022-48824 [MEDIUM] CVE-2022-48824: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: myrs:... In the Linux kernel, the following vulnerability has been resolved: scsi: myrs: Fix crash in error case In myrs_detect(), cs->disable_intr is NULL when privdata->hw_init() fails with non-zero. In this case, myrs_cleanup(cs) will call a NULL ptr and crash the kernel. [ 1.105606] myrs 0000:00:03.0: Unknown Initialization Error 5A [ 1.105872] myrs 0000:00:03.0: Failed

CVE-2024-56705 [MEDIUM] CVE-2024-56705: linux - In the Linux kernel, the following vulnerability has been resolved: media: atom... In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for rgby_data memory allocation failure In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css_s3a_hmem_decode()

CVE-2024-26925 [MEDIUM] CVE-2024-26925: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC s

CVE-2021-47659 [MEDIUM] CVE-2021-47659: linux - In the Linux kernel, the following vulnerability has been resolved: drm/plane: ... In the Linux kernel, the following vulnerability has been resolved: drm/plane: Move range check for format_count earlier While the check for format_count > 64 in __drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset iden

CVE-2024-26642 [MEDIUM] CVE-2024-26642: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-

CVE-2024-36946 [MEDIUM] CVE-2024-36946: linux - In the Linux kernel, the following vulnerability has been resolved: phonet: fix... In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() skb allocation fill_route() stores three components in the skb: - struct rtmsg - RTA_DST (u8) - RTA_OIF (u32) Therefore, rtm_phonet_notify() should use NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(1) + nla_total_size(4) Scope: local bookworm: resolved (fixed in

CVE-2024-42259 [MEDIUM] CVE-2024-42259: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915/ge... In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending ad

CVE-2022-49636 [MEDIUM] CVE-2022-49636: linux - In the Linux kernel, the following vulnerability has been resolved: vlan: fix m... In the Linux kernel, the following vulnerability has been resolved: vlan: fix memory leak in vlan_newlink() Blamed commit added back a bug I fixed in commit 9bbd917e0bec ("vlan: fix memory leak in vlan_dev_set_egress_priority") If a memory allocation fails in vlan_changelink() after other allocations succeeded, we need to call vlan_dev_free_egress_priority() to free