Debian Linux vulnerabilities

CVE-2021-47535 [MEDIUM] CVE-2021-47535: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6x... In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Allocate enough space for GMU registers In commit 142639a52a01 ("drm/msm/a6xx: fix crashstate capture for A650") we changed a6xx_get_gmu_registers() to read 3 sets of registers. Unfortunately, we didn't change the memory allocation for the array. That leads to a KASAN warning (this was

CVE-2021-47224 [MEDIUM] CVE-2021-47224: linux - In the Linux kernel, the following vulnerability has been resolved: net: ll_tem... In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: Make sure to free skb when it is completely used With the skb pointer piggy-backed on the TX BD, we have a simple and efficient way to free the skb buffer when the frame has been transmitted. But in order to avoid freeing the skb while there are still fragments from the skb in use, we

CVE-2017-2583 [HIGH] CVE-2017-2583: linux - The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linu... The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a "MOV SS, NULL selector" instruction, which allows guest OS users to cause a denial of service (guest OS crash) or gain guest OS privileges via a crafted application. Scope: local bookworm: resolved (fixed in 4.9.6-1) bullseye: resolved (fixed in 4.

CVE-2024-26924 [MEDIUM] CVE-2024-26924: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just

CVE-2015-8550 [HIGH] CVE-2015-8550: linux - Xen, when used on a system providing PV backends, allows local guest OS administ... Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability. Scope: local bookworm: resolved (fixed in 4.3.3-3) bullseye: resolved (fixed in 4.3.3-3) forky: resolved (fixed in 4.3.3-3) s

CVE-2015-8961 [HIGH] CVE-2015-8961: linux - The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel befo... The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field. Scope: local bookworm: resolved (fixed in 4.3.3-1) bullseye: resolved (fixed in 4.3.3-1) forky: resolved (fixed in 4.3.3-1) sid: resolved (fixe

CVE-2023-52810 [HIGH] CVE-2023-52810: linux - In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Add... In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Add check for negative db_l2nbperpage l2nbperpage is log2(number of blks per page), and the minimum legal value should be 0, not negative. In the case of l2nbperpage being negative, an error will occur when subsequently used as shift exponent. Syzbot reported this bug: UBSAN: shift-out-of-boun

CVE-2021-47456 [HIGH] CVE-2021-47456: linux - In the Linux kernel, the following vulnerability has been resolved: can: peak_p... In the Linux kernel, the following vulnerability has been resolved: can: peak_pci: peak_pci_remove(): fix UAF When remove the module peek_pci, referencing 'chan' again after releasing 'dev' will cause UAF. Fix this by releasing 'dev' later. The following log reveals it: [ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.963414 ] Re

CVE-2016-9120 [HIGH] CVE-2016-9120: linux - Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in... Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time. Scope: local bookworm: resolved (fixed in 4.6.1-1) bullseye: resolved (fixed in 4.6.1-1) forky: resolved (fixed in 4.6.1-1) s

CVE-2024-38384 [HIGH] CVE-2024-38384: linux - In the Linux kernel, the following vulnerability has been resolved: blk-cgroup:... In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with

CVE-2021-46973 [HIGH] CVE-2021-46973: linux - In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ... In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Avoid potential use after free in MHI send It is possible that the MHI ul_callback will be invoked immediately following the queueing of the skb for transmission, leading to the callback decrementing the refcount of the associated sk and freeing the skb. As such the dereference of skb and t

CVE-2021-47099 [MEDIUM] CVE-2021-47099: linux - In the Linux kernel, the following vulnerability has been resolved: veth: ensur... In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"), if GRO is enabled on a veth device and TSO is disabled on the peer device, TCP skbs will go through the NAPI callback. If there is no XDP program attached, the veth code does not p

CVE-2022-29968 [HIGH] CVE-2022-29968: linux - An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in f... An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private. Scope: local bookworm: resolved (fixed in 5.17.6-1) bullseye: resolved forky: resolved (fixed in 5.17.6-1) sid: resolved (fixed in 5.17.6-1) trixie: resolved (fixed in 5.17.6-1)

CVE-2014-9870 [HIGH] CVE-2014-9870: linux - The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08... The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly consider user-space access to the TPIDRURW register, which allows local users to gain privileges via a crafted application, aka Android internal bug 28749743 and Qualcomm internal bug CR561044. Scope: local bookworm: resolved (fixed in 3

CVE-2022-3526 [MEDIUM] CVE-2022-3526: linux - A vulnerability classified as problematic was found in Linux Kernel. This vulner... A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function macvlan_handle_frame of the file drivers/net/macvlan.c of the component skb. The manipulation leads to memory leak. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211024. S

CVE-2019-14816 [HIGH] CVE-2019-14816: linux - There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3... There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: reso

CVE-2024-44985 [HIGH] CVE-2024-44985: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: preve... In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a possible UAF. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved forky: resolved (fixed i

CVE-2019-14814 [HIGH] CVE-2019-14814: linux - There is heap-based buffer overflow in Linux kernel, all versions up to, excludi... There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid

CVE-2015-9004 [HIGH] CVE-2015-9004: linux - kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping... kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions. Scope: local bookworm: resolved (fixed in 3.16.7-ckt7-1) bullseye: resolved (fixed in 3.16.7-ckt7-1) forky: resolved (fixed in 3.16.7-ckt7-1) sid: resolved

CVE-2017-7374 [HIGH] CVE-2017-7374: linux - Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 all... Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service (NULL pointer dereference) or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be freed prematurely. Scope: local bookworm: resolved (fixed in 4.9.25-1) bu