Debian Linux vulnerabilities

CVE-2024-58087 [HIGH] CVE-2024-58087: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference count within the lock for lookup to avoid racy issue with session expire. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: resolved forky: resolved (fixed in 6.12.6-1) sid: resolved (fixed in 6.12.6-1) t

CVE-2017-1000365 [HIGH] CVE-2017-1000365: linux - The Linux Kernel imposes a size restriction on the arguments and environmental s... The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced

CVE-2022-48788 [HIGH] CVE-2022-48788: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: ... In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix possible use-after-free in transport error_recovery work While nvme_rdma_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must f

CVE-2022-36123 [HIGH] CVE-2022-36123: linux - The Linux kernel before 5.18.13 lacks a certain clear operation for the block st... The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: resolved (fixed in 5.18.14-1) sid: resolved (fixed in 5.18.14-1) trixie: resolved (fixed in 5.18.14-1)

CVE-2024-42285 [HIGH] CVE-2024-42285: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: ... In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees bot

CVE-2019-5108 [MEDIUM] CVE-2019-5108: linux - An exploitable denial-of-service vulnerability exists in the Linux kernel prior ... An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading t

CVE-2024-35888 [MEDIUM] CVE-2024-35888: linux - In the Linux kernel, the following vulnerability has been resolved: erspan: mak... In the Linux kernel, the following vulnerability has been resolved: erspan: make sure erspan_base_hdr is present in skb->head syzbot reported a problem in ip6erspan_rcv() [1] Issue is that ip6erspan_rcv() (and erspan_rcv()) no longer make sure erspan_base_hdr is present in skb linear part (skb->head) before getting @ver field from it. Add the missing pskb_may_pull()

CVE-2021-33034 [HIGH] CVE-2021-33034: linux - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-fre... In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolved (fixed in 5.10.38-1) sid: resolved (fixed in 5.10.38-1) trixie: resolved (fixed in 5.1

CVE-2024-44940 [HIGH] CVE-2024-44940: linux - In the Linux kernel, the following vulnerability has been resolved: fou: remove... In the Linux kernel, the following vulnerability has been resolved: fou: remove warn in gue_gro_receive on unsupported protocol Drop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is not known or does not have a GRO handler. Such a packet is easily constructed. Syzbot generates them and sets off this warning. Remove the warning as it is expected and not

CVE-2022-48655 [HIGH] CVE-2022-48655: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: a... In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before an

CVE-2024-26736 [HIGH] CVE-2024-26736: linux - In the Linux kernel, the following vulnerability has been resolved: afs: Increa... In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in afs_update_volume_status() The max length of volume->vid value is 20 characters. So increase idbuf[] size up to 24 to avoid overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. [DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()] Sc

CVE-2024-26582 [HIGH] CVE-2024-26582: linux - In the Linux kernel, the following vulnerability has been resolved: net: tls: f... In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and we trigger a use-after-free in process_rx_list when we try to read from the partially-read skb. Scope: local b

CVE-2018-20856 [HIGH] CVE-2018-20856: linux - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, ... An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled. Scope: local bookworm: resolved (fixed in 4.18.8-1) bullseye: resolved (fixed in 4.18.8-1) forky: resolved (fixed in 4.18.8-1) sid: resolved (fixed in 4.18.8-1) trixie: resolved (fixed in 4.18.8-1)

CVE-2024-47695 [HIGH] CVE-2024-47695: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-c... In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds In the function init_conns(), after the create_con() and create_cm() for loop if something fails. In the cleanup for loop after the destroy tag, we access out of bound memory because cid is set to clt_path->s.con_num. This commits resets the ci

CVE-2023-52441 [HIGH] CVE-2023-52441: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false. Scope: local bookworm: res

CVE-2020-25221 [HIGH] CVE-2020-25221: linux - get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allow... get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd94674

CVE-2022-48789 [HIGH] CVE-2022-48789: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: f... In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix possible use-after-free in transport error_recovery work While nvme_tcp_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flu

CVE-2022-49017 [HIGH] CVE-2022-49017: linux - In the Linux kernel, the following vulnerability has been resolved: tipc: re-fe... In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipc_msg_validate As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: tipc_crypto_rcv_comple

CVE-2017-1000363 [HIGH] CVE-2017-1000363: linux - Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and ... Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array

CVE-2024-53206 [HIGH] CVE-2024-53206: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: Fix us... In the Linux kernel, the following vulnerability has been resolved: tcp: Fix use-after-free of nreq in reqsk_timer_handler(). The cited commit replaced inet_csk_reqsk_queue_drop_and_put() with __inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handler(). Then, oreq should be passed to reqsk_put() instead of req; otherwise use-after-free of nreq could happen