Debian Linux vulnerabilities

CVE-2023-2019 [MEDIUM] CVE-2023-2019: linux - A flaw was found in the Linux kernel's netdevsim device driver, within the sched... A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved

CVE-2020-11608 [MEDIUM] CVE-2020-11608: linux - An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspc... An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d. Scope: local bookworm: resolved (fixed in 5.5.17-1) bullseye: resolved (fixed in 5.5.17-1) forky: resolved (fixed in 5.5.17-1) sid: resolved (f

CVE-2021-20177 [MEDIUM] CVE-2021-20177: linux - A flaw was found in the Linux kernel's implementation of string matching within ... A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fix

CVE-2023-3212 [MEDIUM] CVE-2023-3212: linux - A NULL pointer dereference issue was found in the gfs2 file system in the Linux ... A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye:

CVE-2024-38540 [MEDIUM] CVE-2024-38540: linux - In the Linux kernel, the following vulnerability has been resolved: bnxt_re: av... In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_stride == 0. In that case, "roundup_pow_of_two(hwq_attr->aux_stride)" gets called. roundup_pow_of_two is docum

CVE-2024-42131 [MEDIUM] CVE-2024-42131: linux - In the Linux kernel, the following vulnerability has been resolved: mm: avoid o... In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications fit into 64-bits). If limits end up being larger, we will hit overflows, possible divisions by 0 etc. Fix th

CVE-2024-26747 [MEDIUM] CVE-2024-26747: linux - In the Linux kernel, the following vulnerability has been resolved: usb: roles:... In the Linux kernel, the following vulnerability has been resolved: usb: roles: fix NULL pointer issue when put module's reference In current design, usb role class driver will get usb_role_switch parent's module reference after the user get usb_role_switch device and put the reference after the user put the usb_role_switch device. However, the parent device of usb_

CVE-2021-47547 [MEDIUM] CVE-2021-47547: linux - In the Linux kernel, the following vulnerability has been resolved: net: tulip:... In the Linux kernel, the following vulnerability has been resolved: net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound In line 5001, if all id in the array 'lp->phy[8]' is not 0, when the 'for' end, the 'k' is 8. At this time, the array 'lp->phy[8]' may be out of bound. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: re

CVE-2023-52800 [MEDIUM] CVE-2023-52800: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11... In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix htt pktlog locking The ath11k active pdevs are protected by RCU but the htt pktlog handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-fr

CVE-2024-26638 [MEDIUM] CVE-2024-26638: linux - In the Linux kernel, the following vulnerability has been resolved: nbd: always... In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure their values is zero by default. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 tc

CVE-2021-39636 [MEDIUM] CVE-2021-39636: linux - In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to ... In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-120612905References: Upstream kernel Scope: lo

CVE-2021-47034 [MEDIUM] CVE-2021-47034: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/64s... In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix pte update for kernel memory on radix When adding a PTE a ptesync is needed to order the update of the PTE with subsequent accesses otherwise a spurious fault may be raised. radix__set_pte_at() does not do this for performance gains. For non-kernel memory this is not an issue as any

CVE-2024-26745 [MEDIUM] CVE-2024-26745: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pse... In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV When kdump kernel tries to copy dump data over SR-IOV, LPAR panics due to NULL pointer exception: Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000

CVE-2024-26846 [MEDIUM] CVE-2024-26846: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do... In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl and ida_destroy has been added by the initial commit. There is some logic around trying to

CVE-2024-42230 [MEDIUM] CVE-2024-42230: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pse... In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL (reloc_on_exc), required for scv instruction support, before other CPUs have been shut down. This means they can execute scv instructions after AIL is disabled, which causes an interrupt at an unexpected entry locati

CVE-2024-53052 [MEDIUM] CVE-2024-53052: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/rw... In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write is in-flight. The freeze side will grab that rwsem for writing, excluding any new writers

CVE-2021-47185 [MEDIUM] CVE-2021-47185: linux - In the Linux kernel, the following vulnerability has been resolved: tty: tty_bu... In the Linux kernel, the following vulnerability has been resolved: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, which look like this one: Workqueue: events_unbound flush_to_ldisc Call trace: dump_backtrace+0x0/0x1ec show_stack+0x24/0x30 dump_stack+0xd0/0x1

CVE-2016-10208 [MEDIUM] CVE-2016-10208: linux - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.... The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image. Scope: local bookworm: resolved (fixed in 4.9.10-1) bullseye: resolved (fixed in 4.9.10-1) forky: resol

CVE-2023-52884 [MEDIUM] CVE-2023-52884: linux - In the Linux kernel, the following vulnerability has been resolved: Input: cyap... In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions Grab input->mutex during suspend/resume functions like it is done in other input drivers. This fixes the following warning during system suspend/resume cycle on Samsung Exynos5250-based Snow Chromebook: ------------[ cut here

CVE-2013-6382 [MEDIUM] CVE-2013-6382: linux - Multiple buffer underflows in the XFS implementation in the Linux kernel through... Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the x