Debian Linux vulnerabilities

CVE-2023-52703 [MEDIUM] CVE-2023-52703: linux - In the Linux kernel, the following vulnerability has been resolved: net/usb: ka... In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path syzbot reported that act_len in kalmia_send_init_packet() is uninitialized when passing it to the first usb_bulk_msg error path. Jiri Pirko noted that it's pointless to pass it in the error path, and that the value that would be printed

CVE-2022-49677 [MEDIUM] CVE-2022-49677: linux - In the Linux kernel, the following vulnerability has been resolved: ARM: cns3xx... In the Linux kernel, the following vulnerability has been resolved: ARM: cns3xxx: Fix refcount leak in cns3xxx_init of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in

CVE-2022-49628 [MEDIUM] CVE-2022-49628: linux - In the Linux kernel, the following vulnerability has been resolved: net: stmmac... In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix leaks in probe These two error paths should clean up before returning. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: resolved (fixed in 5.18.14-1) sid: resolved (fixed in 5.18.14-1) trixie: resolved (fixed in 5.18.14-1)

CVE-2022-49591 [MEDIUM] CVE-2022-49591: linux - In the Linux kernel, the following vulnerability has been resolved: net: dsa: m... In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: ksz_common: Fix refcount leak bug In ksz_switch_register(), we should call of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: open forky: resolved (fixed in 5.18.16-1

CVE-2022-49510 [MEDIUM] CVE-2022-49510: linux - In the Linux kernel, the following vulnerability has been resolved: drm/omap: f... In the Linux kernel, the following vulnerability has been resolved: drm/omap: fix NULL but dereferenced coccicheck error Fix the following coccicheck warning: ./drivers/gpu/drm/omapdrm/omap_overlay.c:89:22-25: ERROR: r_ovl is NULL but dereferenced. Here should be ovl->idx rather than r_ovl->idx. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved

CVE-2022-49324 [MEDIUM] CVE-2022-49324: linux - In the Linux kernel, the following vulnerability has been resolved: mips: cpc: ... In the Linux kernel, the following vulnerability has been resolved: mips: cpc: Fix refcount leak in mips_cpc_default_phys_base Add the missing of_node_put() to release the refcount incremented by of_find_compatible_node(). Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.18.5-1) sid: resolved (f

CVE-2022-49705 [MEDIUM] CVE-2022-49705: linux - In the Linux kernel, the following vulnerability has been resolved: 9p: fix fid... In the Linux kernel, the following vulnerability has been resolved: 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl We need to release directory fid if we fail halfway through open This fixes fid leaking with xfstests generic 531 Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: resolved (fixed in 5.18.14-1) sid: resolved (fixed i

CVE-2022-49403 [MEDIUM] CVE-2022-49403: linux - In the Linux kernel, the following vulnerability has been resolved: lib/string_... In the Linux kernel, the following vulnerability has been resolved: lib/string_helpers: fix not adding strarray to device's resource list Add allocated strarray to device's resource list. This is a must to automatically release strarray when the device disappears. Without this fix we have a memory leak in the few drivers which use devm_kasprintf_strarray(). Scope: l

CVE-2022-49621 [MEDIUM] CVE-2022-49621: linux - In the Linux kernel, the following vulnerability has been resolved: cpufreq: pm... In the Linux kernel, the following vulnerability has been resolved: cpufreq: pmac32-cpufreq: Fix refcount leak bug In pmac_cpufreq_init_MacRISC3(), we need to add corresponding of_node_put() for the three node pointers whose refcount have been incremented by of_find_node_by_name(). Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.1

CVE-2022-49245 [MEDIUM] CVE-2022-49245: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: rockc... In the Linux kernel, the following vulnerability has been resolved: ASoC: rockchip: Fix PM usage reference of rockchip_i2s_tdm_resume pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. We fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced. Scope: lo

CVE-2022-49417 [MEDIUM] CVE-2022-49417: linux - In the Linux kernel, the following vulnerability has been resolved: iwlwifi: me... In the Linux kernel, the following vulnerability has been resolved: iwlwifi: mei: fix potential NULL-ptr deref If SKB allocation fails, continue rather than using the NULL pointer. Coverity CID: 1497650 Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.18.5-1) trixie: resolved (fixed

CVE-2022-49128 [MEDIUM] CVE-2022-49128: linux - In the Linux kernel, the following vulnerability has been resolved: drm/bridge:... In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Add missing pm_runtime_put_sync pm_runtime_get_sync() will increase the rumtime PM counter even when it returns an error. Thus a pairing decrement is needed to prevent refcount leak. Fix this by replacing this API with pm_runtime_resume_and_get(), which will not change the runtime PM cou

CVE-2021-47315 [MEDIUM] CVE-2021-47315: linux - In the Linux kernel, the following vulnerability has been resolved: memory: fsl... In the Linux kernel, the following vulnerability has been resolved: memory: fsl_ifc: fix leak of IO mapping on probe failure On probe error the driver should unmap the IO memory. Smatch reports: drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: r

CVE-2024-56535 [MEDIUM] CVE-2024-56535: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89... In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() kmalloc may fail, return value might be NULL and will cause NULL pointer dereference. Add check NULL return of kmalloc in btc_fw_set_monreg(). Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.3-1)

CVE-2024-56534 [MEDIUM] CVE-2024-56534: linux - In the Linux kernel, the following vulnerability has been resolved: isofs: avoi... In the Linux kernel, the following vulnerability has been resolved: isofs: avoid memory leak in iocharset A memleak was found as below: unreferenced object 0xffff0000d10164d8 (size 8): comm "pool-udisksd", pid 108217, jiffies 4295408555 hex dump (first 8 bytes): 75 74 66 38 00 cc cc cc utf8.... backtrace (crc de430d31): [] kmemleak_alloc+0xb8/0xc8 [] __kmalloc_node_

CVE-2024-46805 [MEDIUM] CVE-2024-46805: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix the waring dereferencing hive Check the amdgpu_hive_info *hive that maybe is NULL. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved forky: resolved (fixed in 6.10.9-1) sid: resolved (fixed in 6.10.9-1) trixie: resolved (fixed in 6.10.9-1)

CVE-2024-49890 [MEDIUM] CVE-2024-49890: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm:... In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: ensure the fw_info is not null before using it This resolves the dereference null return value warning reported by Coverity. Scope: local bookworm: resolved (fixed in 6.1.115-1) bullseye: resolved (fixed in 5.10.234-1) forky: resolved (fixed in 6.11.4-1) sid: resolved (fixed in 6.11.4-1)

CVE-2023-52708 [MEDIUM] CVE-2023-52708: linux - In the Linux kernel, the following vulnerability has been resolved: mmc: mmc_sp... In the Linux kernel, the following vulnerability has been resolved: mmc: mmc_spi: fix error handling in mmc_spi_probe() If mmc_add_host() fails, it doesn't need to call mmc_remove_host(), or it will cause null-ptr-deref, because of deleting a not added device in mmc_remove_host(). To fix this, goto label 'fail_glue_init', if mmc_add_host() fails, and change the labe

CVE-2024-56369 [MEDIUM] CVE-2024-56369: linux - In the Linux kernel, the following vulnerability has been resolved: drm/modes: ... In the Linux kernel, the following vulnerability has been resolved: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() drm_mode_vrefresh() is trying to avoid divide by zero by checking whether htotal or vtotal are zero. But we may still end up with a div-by-zero of vtotal*htotal*... Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: open forky

CVE-2024-36959 [MEDIUM] CVE-2024-36959: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: de... In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly. Scope: local bookworm: resolved (fixed in 6.1.94-1) bul