Debian Linux vulnerabilities

CVE-2024-42114 [MEDIUM] CVE-2024-42114: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80... In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM") watchdog: BUG: soft lockup - CPU#1 stuck fo

CVE-2021-39711 [MEDIUM] CVE-2021-39711: linux - In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read d... In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to Incorrect Size Value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154175781References: Upstream kernel Scope: local bookworm: resolved

CVE-2020-25284 [MEDIUM] CVE-2020-25284: linux - The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5... The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe. Scope: local bookworm: resolved (fixed in 5.8.10-1) bullseye: resolved (fixed in 5.8.10-1) forky: resolved (fixed in 5.

CVE-2013-2140 [LOW] CVE-2013-2140: linux - The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the X... The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via filesystem write operations on a read-only disk that supports the (1) BLKIF_OP_DISCARD (aka discard or TRIM) or (2) SCSI UNMAP feature. Scope: local bookworm: resolve

CVE-2024-42229 [MEDIUM] CVE-2024-42229: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: aea... In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key. Scope: loca

CVE-2024-42157 [MEDIUM] CVE-2024-42157: linux - In the Linux kernel, the following vulnerability has been resolved: s390/pkey: ... In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe sensitive data on failure Wipe sensitive data from stack also if the copy_to_user() fails. Scope: local bookworm: resolved (fixed in 6.1.98-1) bullseye: resolved (fixed in 5.10.223-1) forky: resolved (fixed in 6.9.9-1) sid: resolved (fixed in 6.9.9-1) trixie: resolved (fixed in 6.9.9

CVE-2023-52597 [MEDIUM] CVE-2023-52597: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: s390: ... In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control (fpc) register of a guest cpu. The new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the host process: if a

CVE-2013-0343 [LOW] CVE-2013-0343: linux - The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel thr... The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) message

CVE-2023-32251 [LOW] CVE-2023-32251: linux - A vulnerability has been identified in the Linux kernel's ksmbd component (kerne... A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-force protection, potentially allowing attackers to co

CVE-2014-9683 [LOW] CVE-2014-9683: linux - Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/cr... Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename. Scope: local bookworm: resolved (fixed in 3.16.7-ckt4-1) bullseye: resolved (fixed in 3.16.

CVE-2023-3772 [MEDIUM] CVE-2023-3772: linux - A flaw was found in the Linux kernel’s IP framework for transforming packets (XF... A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5

CVE-2022-49713 [MEDIUM] CVE-2022-49713: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: ... In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix memory leak in dwc2_hcd_init usb_create_hcd will alloc memory for hcd, and we should call usb_put_hcd to free it when platform_get_resource() fails to prevent memory leak. goto error2 label instead error1 to fix this. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: reso

CVE-2022-49657 [MEDIUM] CVE-2022-49657: linux - In the Linux kernel, the following vulnerability has been resolved: usbnet: fix... In the Linux kernel, the following vulnerability has been resolved: usbnet: fix memory leak in error case usbnet_write_cmd_async() mixed up which buffers need to be freed in which error case. v2: add Fixes tag v3: fix uninitialized buf pointer Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed in 5.18

CVE-2022-49206 [MEDIUM] CVE-2022-49206: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: ... In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in error flow for subscribe event routine In case the second xa_insert() fails, the obj_event is not released. Fix the error unwind flow to free that memory to avoid a memory leak. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1)

CVE-2022-49514 [MEDIUM] CVE-2022-49514: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: media... In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe Call of_node_put(platform_node) to avoid refcount leak in the error path. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.18.5-1)

CVE-2022-49135 [MEDIUM] CVE-2022-49135: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix memory leak [why] Resource release is needed on the error handling path to prevent memory leak. [how] Fix this by adding kfree on the error handling path. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: open forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed

CVE-2022-49486 [MEDIUM] CVE-2022-49486: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe of_find_i2c_device_by_node() takes a reference, In error paths, we should call put_device() to drop the reference to aviod refount leak. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fi

CVE-2022-49422 [MEDIUM] CVE-2022-49422: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix the error handling path in idxd_cdev_register() If a call to alloc_chrdev_region() fails, the already allocated resources are leaking. Add the needed error handling path to fix the leak. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1)

CVE-2021-47654 [MEDIUM] CVE-2021-47654: linux - In the Linux kernel, the following vulnerability has been resolved: samples/lan... In the Linux kernel, the following vulnerability has been resolved: samples/landlock: Fix path_list memory leak Clang static analysis reports this error sandboxer.c:134:8: warning: Potential leak of memory pointed to by 'path_list' ret = 0; ^ path_list is allocated in parse_path() but never freed. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolve

CVE-2022-49461 [MEDIUM] CVE-2022-49461: linux - In the Linux kernel, the following vulnerability has been resolved: amt: fix me... In the Linux kernel, the following vulnerability has been resolved: amt: fix memory leak for advertisement message When a gateway receives an advertisement message, it extracts relay information and then it should be freed. But the advertisement handler doesn't free it. So, memory leak would occur. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolv