p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de linux-ibm · Página 102

Vulnerabilidades publicadas para linux-ibm en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 3088

  1. CVE-2024-38552

    Alta · CVSS 7.3EPSS 0,3%Corrección disponible

    drm/amd/display: Fix potential index out of bounds in color transformation function

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential index out of bounds in color transformation function Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2024-38549

    Media · CVSS 6.8EPSS 0,28%Corrección disponible

    drm/mediatek: Add 0 size check to mtk_drm_gem_obj

    In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add 0 size check to mtk_drm_gem_obj Add a check to mtk_drm_gem_init if we attempt to allocate a GEM object of 0 bytes. Currently, no such check exists and the kernel will panic if a userspace application attempts to allocate a 0x0 GBM buffer. Tested by attempting to allocate a 0x0 GBM buffer on an MT8188 and verifying that we now return EINVAL.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2024-38544

    Crítica · CVSS 9.8EPSS 0,81%Corrección disponible

    RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wrong because if the completer task is already running in a separate thread it may have already processed the skb and freed it which can cause a seg fault. This has been observed infrequently in testing at high scale. This patch fixes this by changing the order of enqueuing the p

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1086.91
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2024-38538

    Alta · CVSS 7.3EPSS 0,28%Corrección disponible

    net: bridge: xmit: make sure we have at least eth header len bytes

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than ETH_HLEN bytes) skb. To fix it check if we can actually pull that amount instead of assuming. Tested with dropwatch: drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3) origin: software timestamp: Mon May 13 11:31:53 2024 778214037 nsec protocol: 0x88a8 length: 2 original length: 2 drop reason: PKT_TOO_SMALL [1] BUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:6

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1083.88
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2024-36978

    Alta · CVSS 7.8EPSS 0,28%Corrección disponible

    net: sched: sch_multiq: fix possible OOB write in multiq_tune()

    In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1079.84
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2024-36974

    Alta · CVSS 7.8EPSS 0,28%Corrección disponible

    net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP

    In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called. First call (with valid attributes) sets dev->num_tc to a non zero value. Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1079.84
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2024-36971

    Alta · CVSS 7.8EPSS 2,7%En el catálogo KEVCorrección disponible

    net: fix __dst_negative_advice() race

    In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL ds

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2024-36968

    Alta · CVSS 7.6EPSS 0,29%Corrección disponible

    Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID:

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1083.88
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2024-36964

    Alta · CVSS 8.8EPSS 0,5%Corrección disponible

    fs/9p: only translate RWX permissions for plain 9P2000

    In the Linux kernel, the following vulnerability has been resolved: fs/9p: only translate RWX permissions for plain 9P2000 Garbage in plain 9P2000's perm bits is allowed through, which causes it to be able to set (among others) the suid bit. This was presumably not the intent since the unix extended bits are handled explicitly and conditionally on .u.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2024-36960

    Alta · CVSS 7.1EPSS 0,29%Corrección disponible

    drm/vmwgfx: Fix invalid reads in fence signaled events

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drm_event to the size of the structure that's actually used. The length of the drm_event was set to the parent structure instead of to the drm_vmw_event_fence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2024-36959

    Media · CVSS 5.5EPSS 0,25%Corrección disponible

    pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2024-36954

    Alta · CVSS 8.2EPSS 0,25%Corrección disponible

    tipc: fix a possible memleak in tipc_buf_append

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2024-36953

    Media · CVSS 4.4EPSS 0,23%Corrección disponible

    KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully. Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1083.88
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2024-36952

    Media · CVSS 4.7EPSS 0,22%Corrección disponible

    scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the fabric. Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes causes the race condition where the final DA_ID and LOGO are skipped from being sent to the fabric switch.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1084.89
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2024-36950

    Media · CVSS 4.4EPSS 0,26%Corrección disponible

    firewire: ohci: mask bus reset interrupts between ISR and bottom half

    In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt. Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask b

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2024-36946

    Media · CVSS 5.5EPSS 0,27%Corrección disponible

    phonet: fix rtm_phonet_notify() skb allocation

    In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() skb allocation fill_route() stores three components in the skb: - struct rtmsg - RTA_DST (u8) - RTA_OIF (u32) Therefore, rtm_phonet_notify() should use NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(1) + nla_total_size(4)

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2024-36940

    Alta · CVSS 7.8EPSS 0,25%Corrección disponible

    pinctrl: core: delete incorrect free in pinctrl_enable()

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2024-36939

    Media · CVSS 5.5EPSS 0,23%Corrección disponible

    nfs: Handle error of rpc_proc_register() in nfs_net_init().

    In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_register() in nfs_net_init(). syzkaller reported a warning [0] triggered while destroying immature netns. rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2"). Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") converted the procfs to per-netns and made the problem more visible. Even when rpc_proc_register() fails, nfs_net_init() could succeed, and thus nfs_net_exit() will be called while destroying the netns. The

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1077.82
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2024-36938

    Media · CVSS 5.5EPSS 0,24%Corrección disponible

    bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue

    In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.

    linux-ibmSistemas operativos
    • Actualiza a 5.4.0-1083.88
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →