Debian Linux vulnerabilities

CVE-2019-17055 [LOW] CVE-2019-17055: linux - base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in... base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21. Scope: local bookworm: resolved (fixed in 5.3.7-1) bullseye: resolved (fixed in 5.3.7-1) forky: resolved (fixed in 5.3.7-1) sid: resolved (fixed i

CVE-2019-17054 [LOW] CVE-2019-17054: linux - atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Li... atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c. Scope: local bookworm: resolved (fixed in 5.3.7-1) bullseye: resolved (fixed in 5.3.7-1) forky: resolved (fixed in 5.3.7-1) sid: resolved (fixed in 5.3.7

CVE-2019-17053 [LOW] CVE-2019-17053: linux - ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module... ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7. Scope: local bookworm: resolved (fixed in 5.3.7-1) bullseye: resolved (fixed in 5.3.7-1) forky: resolved (fixed in 5.3.7-1) sid: resolved (fixe

CVE-2019-15919 [LOW] CVE-2019-15919: linux - An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs... An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free. Scope: local bookworm: resolved (fixed in 4.19.37-1) bullseye: resolved (fixed in 4.19.37-1) forky: resolved (fixed in 4.19.37-1) sid: resolved (fixed in 4.19.37-1) trixie: resolved (fixed in 4.19.37-1)

CVE-2024-43845 [LOW] CVE-2024-43845: linux - In the Linux kernel, the following vulnerability has been resolved: udf: Fix bo... In the Linux kernel, the following vulnerability has been resolved: udf: Fix bogus checksum computation in udf_rename() Syzbot reports uninitialized memory access in udf_rename() when updating checksum of '..' directory entry of a moved directory. This is indeed true as we pass on-stack diriter.fi to the udf_update_tag() and because that has only struct fileIdentDesc i

CVE-2014-2568 [LOW] CVE-2014-2568: linux - Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetl... Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was

CVE-2022-50358 [MEDIUM] CVE-2022-50358: linux - In the Linux kernel, the following vulnerability has been resolved: brcmfmac: r... In the Linux kernel, the following vulnerability has been resolved: brcmfmac: return error when getting invalid max_flowrings from dongle When firmware hit trap at initialization, host will read abnormal max_flowrings number from dongle, and it will cause kernel panic when doing iowrite to initialize dongle ring. To detect this error at early stage, we directly retu

CVE-2023-52870 [MEDIUM] CVE-2023-52870: linux - In the Linux kernel, the following vulnerability has been resolved: clk: mediat... In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: resolved (fixed in 5.10.205-1) forky: resolved (fixed in 6.6.8-1) sid: reso

CVE-2023-23003 [MEDIUM] CVE-2023-23003: linux - In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the ha... In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value. Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: open forky: resolved (fixed in 5.16.7-1) sid: resolved (fixed in 5.16.7-1) trixie: resolved (fixed in 5.16.7-1)

CVE-2013-2930 [LOW] CVE-2013-2930: linux - The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Lin... The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application. Scope: local bookworm: resolved (fixed in 3.11.8-1) bullseye: resolved (fixed in 3.11.8-1) forky: resolved (fixed in 3.11.8-1) sid: r

CVE-2024-41007 [LOW] CVE-2024-41007: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: avoid ... In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCP_USER_TIMEOUT, and the other peer retracted its window to zero, tcp_retransmit_timer() can retransmit a packet every two jiffies (2 ms for HZ=1000), for about 4 minutes after TCP_USER_TIMEOUT has 'expired'. The fix is to make sure tcp_r

CVE-2018-13053 [LOW] CVE-2018-13053: linux - The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel ... The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used. Scope: local bookworm: resolved (fixed in 4.18.20-1) bullseye: resolved (fixed in 4.18.20-1) forky: resolved (fixed in 4.18.20-1) sid: resolved (fixed in 4.18.20-1) trixie: resolved (fixe

CVE-2021-21781 [LOW] CVE-2021-21781: linux - An information disclosure vulnerability exists in the ARM SIGPAGE functionality ... An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. Th

CVE-2018-20855 [LOW] CVE-2018-20855: linux - An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common i... An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace. Scope: local bookworm: resolved (fixed in 4.18.8-1) bullseye: resolved (fixed in 4.18.8-1) forky: resolved (fixed in 4.18.8-1) sid: resolved (fixed in 4.18.8-1)

CVE-2022-32296 [LOW] CVE-2022-32296: linux - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observi... The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056. Scope: local bookworm: resolved (fixed in 5.17.11-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.17.11-1) sid: resolved (fixed in 5.17.11-1

CVE-2022-24448 [LOW] CVE-2022-24448: linux - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an... An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. Scope: local bookworm: resolved (fixed in 5.16.7

CVE-2021-3655 [LOW] CVE-2021-3655: linux - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Mi... A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory. Scope: local bookworm: resolved (fixed in 5.10.46-3) bullseye: resolved (fixed in 5.10.46-3) forky: resolved (fixed in 5.10.46-3) sid: resolved (fixed in 5.10.46-3) trixie: resolved (fixed in 5.1

CVE-2021-38209 [LOW] CVE-2021-38209: linux - net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows... net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in

CVE-2021-20239 [LOW] CVE-2021-20239: linux - A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protoc... A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality. Scope: local bookworm: resolved (fixed in 5.10.4-1) bullseye: resolved (fixed in 5.10.4-1) forky: resolved (fixed in 5

CVE-2024-26992 [LOW] CVE-2024-26992: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pm... In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and because exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak host kernel addresses to the guest. Bug