Debian Linux vulnerabilities

CVE-2024-27057 [MEDIUM] CVE-2024-27057: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend When the system is suspended while audio is active, the sof_ipc4_pcm_hw_free() is invoked to reset the pipelines since during suspend the DSP is turned off, streams will be re-started after resume. If the firmware crashes during

CVE-2024-36951 [MEDIUM] CVE-2024-36951: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd:... In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: range check cp bad op exception interrupts Due to a CP interrupt bug, bad packet garbage exception codes are raised. Do a range check so that the debugger and runtime do not receive garbage codes. Update the user api to guard exception code type checking as well. Scope: local bookworm: o

CVE-2024-26938 [MEDIUM] CVE-2024-26938: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915/bi... In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() If we have no VBT, or the VBT didn't declare the encoder in question, we won't have the 'devdata' for the encoder. Instead of oopsing just bail early. We won't be able to tell whether the port is DP++ or not, but so

CVE-2024-26850 [MEDIUM] CVE-2024-26850: linux - In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm... In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: fix BUG_ON with pud advanced test Architectures like powerpc add debug checks to ensure we find only devmap PUD pte entries. These debug checks are only done with CONFIG_DEBUG_VM. This patch marks the ptes used for PUD advanced test devmap pte entries so that we don't hit on deb

CVE-2024-26959 [MEDIUM] CVE-2024-26959: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuart_close Fix scheduling while atomic BUG in btnxpuart_close(), properly purge the transmit queue and free the receive skb. [ 10.973809] BUG: scheduling while atomic: kworker/u9:0/80/0x00000002 ... [ 10.980740] CPU: 3 PID: 80 Comm: kworker/u9:0 Not tainted 6.8.0-rc7-0

CVE-2024-35816 [MEDIUM] CVE-2024-35816: linux - In the Linux kernel, the following vulnerability has been resolved: firewire: o... In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: prevent leak of left-over IRQ on unbind Commit 5a95f1ded28691e6 ("firewire: ohci: use devres for requested IRQ") also removed the call to free_irq() in pci_remove(), leading to a leftover irq of devm_request_irq() at pci_disable_msi() in pci_remove() when unbinding the driver from th

CVE-2023-52681 [MEDIUM] CVE-2023-52681: linux - In the Linux kernel, the following vulnerability has been resolved: efivarfs: F... In the Linux kernel, the following vulnerability has been resolved: efivarfs: Free s_fs_info on unmount Now that we allocate a s_fs_info struct on fs context creation, we should ensure that we free it again when the superblock goes away. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.8.9-1) sid: resolved (fixed in 6.8.9-1) trixie: res

CVE-2021-47221 [MEDIUM] CVE-2021-47221: linux - In the Linux kernel, the following vulnerability has been resolved: mm/slub: ac... In the Linux kernel, the following vulnerability has been resolved: mm/slub: actually fix freelist pointer vs redzoning It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the freelist pointer), so a cache created with an object size less than 24 would have the freelist poi

CVE-2021-47560 [MEDIUM] CVE-2021-47560: linux - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spec... In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum: Protect driver from buggy firmware When processing port up/down events generated by the device's firmware, the driver protects itself from events reported for non-existent local ports, but not the CPU port (local port 0), which exists, but lacks a netdev. This can result in a NULL p

CVE-2021-47414 [MEDIUM] CVE-2021-47414: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: Flus... In the Linux kernel, the following vulnerability has been resolved: riscv: Flush current cpu icache before other cpus On SiFive Unmatched, I recently fell onto the following BUG when booting: [ 0.000000] ftrace: allocating 36610 entries in 144 pages [ 0.000000] Oops - illegal instruction [#1] [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not

CVE-2021-47273 [MEDIUM] CVE-2021-47273: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-m... In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is disabled When only PHY1 is used (for example on Odroid-HC4), the regmap init code uses the usb2 ports when doesn't initialize the PHY1 regmap entry. This fixes: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000

CVE-2021-46919 [MEDIUM] CVE-2021-46919: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix wq size store permission state WQ size can only be changed when the device is disabled. Current code allows change when device is enabled but wq is disabled. Change the check to detect device state. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed i

CVE-2021-47424 [MEDIUM] CVE-2021-47424: linux - In the Linux kernel, the following vulnerability has been resolved: i40e: Fix f... In the Linux kernel, the following vulnerability has been resolved: i40e: Fix freeing of uninitialized misc IRQ vector When VSI set up failed in i40e_probe() as part of PF switch set up driver was trying to free misc IRQ vectors in i40e_clear_interrupt_scheme and produced a kernel Oops: Trying to free already-free IRQ 266 WARNING: CPU: 0 PID: 5 at kernel/irq/manage.

CVE-2021-47413 [MEDIUM] CVE-2021-47413: linux - In the Linux kernel, the following vulnerability has been resolved: usb: chipid... In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle When passing 'phys' in the devicetree to describe the USB PHY phandle (which is the recommended way according to Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt) the following NULL pointer dereference is observed on i.MX7 and i.MX8MM:

CVE-2021-47016 [MEDIUM] CVE-2021-47016: linux - In the Linux kernel, the following vulnerability has been resolved: m68k: mvme1... In the Linux kernel, the following vulnerability has been resolved: m68k: mvme147,mvme16x: Don't wipe PCC timer config bits Don't clear the timer 1 configuration bits when clearing the interrupt flag and counter overflow. As Michael reported, "This results in no timer interrupts being delivered after the first. Initialization then hangs in calibrate_delay as the jif

CVE-2021-47283 [MEDIUM] CVE-2021-47283: linux - In the Linux kernel, the following vulnerability has been resolved: net:sfc: fi... In the Linux kernel, the following vulnerability has been resolved: net:sfc: fix non-freed irq in legacy irq mode SFC driver can be configured via modparam to work using MSI-X, MSI or legacy IRQ interrupts. In the last one, the interrupt was not properly released on module remove. It was not freed because the flag irqs_hooked was not set during initialization in the

CVE-2024-43860 [MEDIUM] CVE-2024-43860: linux - In the Linux kernel, the following vulnerability has been resolved: remoteproc:... In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_rproc: Skip over memory region when node value is NULL In imx_rproc_addr_init() "nph = of_count_phandle_with_args()" just counts number of phandles. But phandles may be empty. So of_parse_phandle() in the parsing loop (0 < a < nph) may return NULL which is later dereferenced. Adjust

CVE-2024-41019 [MEDIUM] CVE-2024-41019: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: V... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate ff offset This adds sanity checks for ff offset. There is a check on rt->first_free at first, but walking through by ff without any check. If the second ff is a large offset. We may encounter an out-of-bound read. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: reso

CVE-2024-42075 [MEDIUM] CVE-2024-42075: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix re... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix remap of arena. The bpf arena logic didn't account for mremap operation. Add a refcnt for multiple mmap events to prevent use-after-free in arena_vm_close. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.9.8-1) sid: resolved (fixed in 6.9.8-1) trixie: resolved

CVE-2024-57953 [MEDIUM] CVE-2024-57953: linux - In the Linux kernel, the following vulnerability has been resolved: rtc: tps659... In the Linux kernel, the following vulnerability has been resolved: rtc: tps6594: Fix integer overflow on 32bit systems The problem is this multiply in tps6594_rtc_set_offset() tmp = offset * TICKS_PER_HOUR; The "tmp" variable is an s64 but "offset" is a long in the (-277774)-277774 range. On 32bit systems a long can hold numbers up to approximately two billion. The