p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in linux-lowlatency-hwe-5.15 · Seite 168

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für linux-lowlatency-hwe-5.15: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 4513

  1. CVE-2024-36968

    Hoch · CVSS 7.6EPSS 0,29%Korrektur verfügbar

    Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID:

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-127.137~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2024-36967

    Mittel · CVSS 6.8EPSS 0,21%Korrektur verfügbar

    KEYS: trusted: Fix memory leak in tpm2_key_encode()

    In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2_key_encode() 'scratch' is never freed. Fix this by calling kfree() in the success, and in the error case.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2024-36965

    Hoch · CVSS 7.8EPSS 0,22%Korrektur verfügbar

    remoteproc: mediatek: Make sure IPI buffer fits in L2TCM

    In the Linux kernel, the following vulnerability has been resolved: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM The IPI buffer location is read from the firmware that we load to the System Companion Processor, and it's not granted that both the SRAM (L2TCM) size that is defined in the devicetree node is large enough for that, and while this is especially true for multi-core SCP, it's still useful to check on single-core variants as well. Failing to perform this check may make this driver perform R/W operations out of the L2TCM boundary, resulting (at best) in a kernel panic. To fix that, check that the IPI buffer fits, otherw

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2024-36964

    Hoch · CVSS 8.8EPSS 0,5%Korrektur verfügbar

    fs/9p: only translate RWX permissions for plain 9P2000

    In the Linux kernel, the following vulnerability has been resolved: fs/9p: only translate RWX permissions for plain 9P2000 Garbage in plain 9P2000's perm bits is allowed through, which causes it to be able to set (among others) the suid bit. This was presumably not the intent since the unix extended bits are handled explicitly and conditionally on .u.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2024-36960

    Hoch · CVSS 7.1EPSS 0,29%Korrektur verfügbar

    drm/vmwgfx: Fix invalid reads in fence signaled events

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drm_event to the size of the structure that's actually used. The length of the drm_event was set to the parent structure instead of to the drm_vmw_event_fence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2024-36959

    Mittel · CVSS 5.5EPSS 0,25%Korrektur verfügbar

    pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2024-36957

    Mittel · CVSS 5.5EPSS 0,24%Korrektur verfügbar

    octeontx2-af: avoid off-by-one read from userspace

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer is NUL terminated, we use memdup_user_nul instead.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2024-36955

    Hoch · CVSS 7.7EPSS 0,24%Korrektur verfügbar

    ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() The documentation for device_get_named_child_node() mentions this important point: " The caller is responsible for calling fwnode_handle_put() on the returned fwnode pointer. " Add fwnode_handle_put() to avoid a leaked reference.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2024-36954

    Hoch · CVSS 8.2EPSS 0,25%Korrektur verfügbar

    tipc: fix a possible memleak in tipc_buf_append

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2024-36953

    Mittel · CVSS 4.4EPSS 0,23%Korrektur verfügbar

    KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully. Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2024-36952

    Mittel · CVSS 4.7EPSS 0,22%Korrektur verfügbar

    scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the fabric. Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes causes the race condition where the final DA_ID and LOGO are skipped from being sent to the fabric switch.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2024-36950

    Mittel · CVSS 4.4EPSS 0,26%Korrektur verfügbar

    firewire: ohci: mask bus reset interrupts between ISR and bottom half

    In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt. Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask b

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2024-36947

    Mittel · CVSS 5.3EPSS 0,48%Korrektur verfügbar

    qibfs: fix dentry leak

    In the Linux kernel, the following vulnerability has been resolved: qibfs: fix dentry leak simple_recursive_removal() drops the pinning references to all positives in subtree. For the cases when its argument has been kept alive by the pinning alone that's exactly the right thing to do, but here the argument comes from dcache lookup, that needs to be balanced by explicit dput(). Fucked-up-by: Al Viro <[email protected]>

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2024-36946

    Mittel · CVSS 5.5EPSS 0,27%Korrektur verfügbar

    phonet: fix rtm_phonet_notify() skb allocation

    In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() skb allocation fill_route() stores three components in the skb: - struct rtmsg - RTA_DST (u8) - RTA_OIF (u32) Therefore, rtm_phonet_notify() should use NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(1) + nla_total_size(4)

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2024-36944

    Mittel · CVSS 5.5EPSS 0,17%Korrektur verfügbar

    Reapply "drm/qxl: simplify qxl_fence_wait"

    In the Linux kernel, the following vulnerability has been resolved: Reapply "drm/qxl: simplify qxl_fence_wait" This reverts commit 07ed11afb68d94eadd4ffc082b97c2331307c5ea. Stephen Rostedt reports: "I went to run my tests on my VMs and the tests hung on boot up. Unfortunately, the most I ever got out was: [ 93.607888] Testing event system initcall: OK [ 93.667730] Running tests on all trace events: [ 93.669757] Testing all events: OK [ 95.631064] ------------[ cut here ]------------ Timed out after 60 seconds" and further debugging points to a possible circular locking dependency between the console_owner locking and

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2024-36940

    Hoch · CVSS 7.8EPSS 0,25%Korrektur verfügbar

    pinctrl: core: delete incorrect free in pinctrl_enable()

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2024-36939

    Mittel · CVSS 5.5EPSS 0,23%Korrektur verfügbar

    nfs: Handle error of rpc_proc_register() in nfs_net_init().

    In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_register() in nfs_net_init(). syzkaller reported a warning [0] triggered while destroying immature netns. rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2"). Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") converted the procfs to per-netns and made the problem more visible. Even when rpc_proc_register() fails, nfs_net_init() could succeed, and thus nfs_net_exit() will be called while destroying the netns. The

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2024-36938

    Mittel · CVSS 5.5EPSS 0,24%Korrektur verfügbar

    bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue

    In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2024-36937

    Mittel · CVSS 5.6EPSS 0,22%Korrektur verfügbar

    xdp: use flags field to disambiguate broadcast redirect

    In the Linux kernel, the following vulnerability has been resolved: xdp: use flags field to disambiguate broadcast redirect When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination. When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the 'map' pointer in struct bpf_redirect_info to point to the destina

    linux-lowlatency-hwe-5.15Betriebssysteme
    • Auf 5.15.0-118.128~20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →