Debian Linux vulnerabilities

CVE-2021-47263 [MEDIUM] CVE-2021-47263: linux - In the Linux kernel, the following vulnerability has been resolved: gpio: wcd93... In the Linux kernel, the following vulnerability has been resolved: gpio: wcd934x: Fix shift-out-of-bounds error bit-mask for pins 0 to 4 is BIT(0) to BIT(4) however we ended up with BIT(n - 1) which is not right, and this was caught by below usban check UBSAN: shift-out-of-bounds in drivers/gpio/gpio-wcd934x.c:34:14 Scope: local bookworm: resolved (fixed in 5.10.46

CVE-2021-47141 [MEDIUM] CVE-2021-47141: linux - In the Linux kernel, the following vulnerability has been resolved: gve: Add NU... In the Linux kernel, the following vulnerability has been resolved: gve: Add NULL pointer checks when freeing irqs. When freeing notification blocks, we index priv->msix_vectors. If we failed to allocate priv->msix_vectors (see abort_with_msix_vectors) this could lead to a NULL pointer dereference if the driver is unloaded. Scope: local bookworm: resolved (fixed in

CVE-2021-47143 [MEDIUM] CVE-2021-47143: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: re... In the Linux kernel, the following vulnerability has been resolved: net/smc: remove device from smcd_dev_list after failed device_add() If the device_add() for a smcd_dev fails, there's no cleanup step that rolls back the earlier list_add(). The device subsequently gets freed, and we end up with a corrupted list. Add some error handling that removes the device from

CVE-2021-47454 [MEDIUM] CVE-2021-47454: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/smp... In the Linux kernel, the following vulnerability has been resolved: powerpc/smp: do not decrement idle task preempt count in CPU offline With PREEMPT_COUNT=y, when a CPU is offlined and then onlined again, we get: BUG: scheduling while atomic: swapper/1/0/0x00000000 no locks held by swapper/1/0. CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.0-rc2+ #100 Call Trace:

CVE-2021-47623 [MEDIUM] CVE-2021-47623: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/fix... In the Linux kernel, the following vulnerability has been resolved: powerpc/fixmap: Fix VM debug warning on unmap Unmapping a fixmap entry is done by calling __set_fixmap() with FIXMAP_PAGE_CLEAR as flags. Today, powerpc __set_fixmap() calls map_kernel_page(). map_kernel_page() is not happy when called a second time for the same page. WARNING: CPU: 0 PID: 1 at arch/

CVE-2021-47218 [MEDIUM] CVE-2021-47218: linux - In the Linux kernel, the following vulnerability has been resolved: selinux: fi... In the Linux kernel, the following vulnerability has been resolved: selinux: fix NULL-pointer dereference when hashtab allocation fails When the hash table slot array allocation fails in hashtab_init(), h->size is left initialized with a non-zero value, but the h->htable pointer is NULL. This may then cause a NULL pointer dereference, since the policydb code relies

CVE-2024-53685 [MEDIUM] CVE-2024-53685: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: give ... In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effec

CVE-2024-56748 [MEDIUM] CVE-2024-56748: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qedf:... In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() Hook "qed_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). Scope: local bookworm: reso

CVE-2024-35930 [MEDIUM] CVE-2024-35930: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc:... In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an unsuccessful status. In such cases, the elsiocb is not issued, the completion is not called, and thus the elsiocb resource is leaked. Check return value after calling lpfc_

CVE-2024-45002 [MEDIUM] CVE-2024-45002: linux - In the Linux kernel, the following vulnerability has been resolved: rtla/osnois... In the Linux kernel, the following vulnerability has been resolved: rtla/osnoise: Prevent NULL dereference in error handling If the "tool->data" allocation fails then there is no need to call osnoise_free_top() and, in fact, doing so will lead to a NULL dereference. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved forky: resolved (fixed in 6.1

CVE-2024-26647 [MEDIUM] CVE-2024-26647: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()' In link_set_dsc_pps_packet(), 'struct display_stream_compressor *dsc' was dereferenced in a DC_LOGGER_INIT(dsc->ctx->logger); before the 'dsc' NULL pointer check. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc

CVE-2024-42074 [MEDIUM] CVE-2024-42074: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: add a null check for chip_pdev structure When acp platform device creation is skipped, chip->chip_pdev value will remain NULL. Add NULL check for chip->chip_pdev structure in snd_acp_resume() function to avoid null pointer dereference. Scope: local bookworm: resolved bullseye: resolv

CVE-2024-26648 [MEDIUM] CVE-2024-26648: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay() In edp_setup_replay(), 'struct dc *dc' & 'struct dmub_replay *replay' was dereferenced before the pointer 'link' & 'replay' NULL check. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_

CVE-2023-28328 [MEDIUM] CVE-2023-28328: linux - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/... A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: reso

CVE-2023-52459 [MEDIUM] CVE-2023-52459: linux - In the Linux kernel, the following vulnerability has been resolved: media: v4l:... In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix duplicated list deletion The list deletion call dropped here is already called from the helper function in the line before. Having a second list_del() call results in either a warning (with CONFIG_DEBUG_LIST=y): list_del corruption, c46c8198->next is LIST_POISON1 (00000100) If

CVE-2023-52663 [MEDIUM] CVE-2023-52663: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe() Driver uses kasprintf() to initialize fw_{code,data}_bin members of struct acp_dev_data, but kfree() is never called to deallocate the memory, which results in a memory leak. Fix the issue by switching to devm_kasprintf(). Additionally, ensure t

CVE-2022-3110 [MEDIUM] CVE-2022-3110: linux - An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_pri... An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of rtw_alloc_hwxmits() and will cause the null pointer dereference. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.18.5-1) trix

CVE-2024-27390 [MEDIUM] CVE-2024-27390: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast... In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()")) I think the synchronize_net() call in ipv6_mc_down() is not needed. Under load, synchronize_net() can last betwee

CVE-2024-35933 [MEDIUM] CVE-2024-35933: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintel_read_version If hci_cmd_sync_complete() is triggered and skb is NULL, then hdev->req_skb is NULL, which will cause this issue. Scope: local bookworm: resolved (fixed in 6.1.90-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.8.

CVE-2024-35828 [MEDIUM] CVE-2024-35828: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: liber... In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer(). Scope: local bookwo