Debian Linux vulnerabilities

CVE-2019-8956 [HIGH] CVE-2019-8956: linux - In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in... In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory. Scope: local bookworm: resolved (fixed in 4.19.28-1) bullseye: resolved (fixed in 4.19.28-1) forky: resolved (fixed in 4.19.28-1) sid: resolved (fixed in 4.19.28-1) trixie:

CVE-2018-18281 [HIGH] CVE-2018-18281: linux - Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after ... Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused.

CVE-2022-2585 [MEDIUM] CVE-2022-2585: linux - It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU t... It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed in 5.18.16-1) sid: resolved (fixed in 5.18.16-1) trixie: resolved (fixed in 5.18.16-1)

CVE-2020-14356 [HIGH] CVE-2020-14356: linux - A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versio... A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.7.10-1) bullseye: resolved (fixed in 5.7.10-1) forky: resolved (fixed in 5.7.10-1) sid:

CVE-2024-26592 [HIGH] CVE-2024-26592: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on `struct tcp_transport` in ksmbd_tcp_new_connection() function. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved forky: resolved (f

CVE-2022-32981 [HIGH] CVE-2022-32981: linux - An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit pla... An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.1

CVE-2017-7518 [MEDIUM] CVE-2017-7518: linux - A flaw was found in the Linux kernel before version 4.12 in the way the KVM modu... A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not

CVE-2024-26857 [MEDIUM] CVE-2024-26857: linux - In the Linux kernel, the following vulnerability has been resolved: geneve: mak... In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") We have to save skb->network_header in a temporary variable in order to be able

CVE-2021-47013 [HIGH] CVE-2021-47013: linux - In the Linux kernel, the following vulnerability has been resolved: net:emac/em... In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb->len b

CVE-2024-44998 [HIGH] CVE-2024-44998: linux - In the Linux kernel, the following vulnerability has been resolved: atm: idt772... In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeue_rx() We can't dereference "skb" after calling vcc->push() because the skb is released. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved (fixed in 5.10.226-1) forky: resolved (fixed in 6.10.7-1) sid: resolved (fixed in 6.10.7-1) tr

CVE-2022-45934 [HIGH] CVE-2022-45934: linux - An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in ... An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2024-26800 [HIGH] CVE-2024-26800: linux - In the Linux kernel, the following vulnerability has been resolved: tls: fix us... In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptions have completed. If one of them fails, tls_do_decryption will return -EBADMSG and tls_decrypt_sg jumps to the

CVE-2019-11487 [HIGH] CVE-2019-11487: linux - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow,... The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests. Scope: local bookworm: resolved

CVE-2024-26689 [HIGH] CVE-2024-26689: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: preve... In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg() In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in "handle_cap_grant()" refcount

CVE-2024-36894 [MEDIUM] CVE-2024-36894: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget... In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application issues an AIO cancel call, while the UDC is handling a soft disco

CVE-2024-26882 [HIGH] CVE-2024-26882: linux - In the Linux kernel, the following vulnerability has been resolved: net: ip_tun... In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() Apply the same fix than ones found in : 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()") We have to save skb->network_header in a tempo

CVE-2022-3545 [MEDIUM] CVE-2022-3545: linux - A vulnerability has been found in Linux Kernel and classified as critical. Affec... A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211045 was assigned to th

CVE-2024-38570 [HIGH] CVE-2024-38570: linux - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix p... In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and there ares still locks in that lockspace, DLM will unlock those locks automatically. Commit fb6791d100d1b started exploiting this behavior to speed up filesystem unmount: gfs2 would simply free glocks it didn't wa

CVE-2024-41073 [HIGH] CVE-2024-41073: linux - In the Linux kernel, the following vulnerability has been resolved: nvme: avoid... In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECIAL_LOAD when the request is cleaned. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (f

CVE-2019-0155 [HIGH] CVE-2019-0155: linux - Insufficient access control in a subsystem for Intel (R) processor graphics in 6... Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 an