p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de linux-intel-iotg-5.15 · Página 171

Vulnerabilidades publicadas para linux-intel-iotg-5.15 en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 4693

  1. CVE-2022-48746

    Media · CVSS 5.5EPSS 0,24%Corrección disponible

    net/mlx5e: Fix handling of wrong devices during bond netevent

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix handling of wrong devices during bond netevent Current implementation of bond netevent handler only check if the handled netdev is VF representor and it missing a check if the VF representor is on the same phys device of the bond handling the netevent. Fix by adding the missing check and optimizing the check if the netdev is VF representor so it will not access uninitialized private data and crashes. BUG: kernel NULL pointer dereference, address: 000000000000036c PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Workqueue: eth3bond0 bond_mii_monitor [bonding] RIP: 0010

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2022-48745

    Media · CVSS 4.7EPSS 0,18%Corrección disponible

    net/mlx5: Use del_timer_sync in fw reset flow of halting poll

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Use del_timer_sync in fw reset flow of halting poll Substitute del_timer() with del_timer_sync() in fw reset polling deactivation flow, in order to prevent a race condition which occurs when del_timer() is called and timer is deactivated while another process is handling the timer interrupt. A situation that led to the following call trace: RIP: 0010:run_timer_softirq+0x137/0x420 <IRQ> recalibrate_cpu_khz+0x10/0x10 ktime_get+0x3e/0xa0 ? sched_clock_cpu+0xb/0xc0 __do_softirq+0xf5/0x2ea irq_exit_rcu+0xc1/0xf0 sysvec_apic_timer_interrupt+0x9e/0xc0 asm_sysvec

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2022-48743

    Alta · CVSS 8.1EPSS 0,65%Corrección disponible

    net: amd-xgbe: Fix skb data length underflow

    In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix this by dropping the packet if such length underflows are seen because of inconsistencies in the hardware descriptors.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2022-48742

    Alta · CVSS 7.8EPSS 0,24%Corrección disponible

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()

    In the Linux kernel, the following vulnerability has been resolved: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() While looking at one unrelated syzbot bug, I found the replay logic in __rtnl_newlink() to potentially trigger use-after-free. It is better to clear master_dev and m_ops inside the loop, in case we have to replay it.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2022-48741

    Media · CVSS 5.5EPSS 0,22%Corrección disponible

    ovl: fix NULL pointer dereference in copy up warning

    In the Linux kernel, the following vulnerability has been resolved: ovl: fix NULL pointer dereference in copy up warning This patch is fixing a NULL pointer dereference to get a recently introduced warning message working.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2022-48740

    Alta · CVSS 7.8EPSS 0,24%Corrección disponible

    selinux: fix double free of cond_list on error paths

    In the Linux kernel, the following vulnerability has been resolved: selinux: fix double free of cond_list on error paths On error path from cond_read_list() and duplicate_policydb_cond_list() the cond_list_destroy() gets called a second time in caller functions, resulting in NULL pointer deref. Fix this by resetting the cond_list_len to 0 in cond_list_destroy(), making subsequent calls a noop. Also consistently reset the cond_list pointer to NULL after freeing. [PM: fix line lengths in the description]

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2022-48739

    Alta · CVSS 7.1EPSS 0,23%Corrección disponible

    ASoC: hdmi-codec: Fix OOB memory accesses

    In the Linux kernel, the following vulnerability has been resolved: ASoC: hdmi-codec: Fix OOB memory accesses Correct size of iec_status array by changing it to the size of status array of the struct snd_aes_iec958. This fixes out-of-bounds slab read accesses made by memcpy() of the hdmi-codec driver. This problem is reported by KASAN.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2022-48738

    Alta · CVSS 7.1EPSS 0,23%Corrección disponible

    ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2022-48735

    Alta · CVSS 7.8EPSS 0,23%Corrección disponible

    ALSA: hda: Fix UAF of leds class devs at unbinding

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesn't work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback. For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2022-48734

    Media · CVSS 5.5EPSS 0,18%Corrección disponible

    btrfs: fix deadlock between quota disable and qgroup rescan worker

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock between quota disable and qgroup rescan worker Quota disable ioctl starts a transaction before waiting for the qgroup rescan worker completes. However, this wait can be infinite and results in deadlock because of circular dependency among the quota disable ioctl, the qgroup rescan worker and the other task with transaction such as block group relocation task. The deadlock happens with the steps following: 1) Task A calls ioctl to disable quota. It starts a transaction and waits for qgroup rescan worker completes. 2) Task B such as block group reloca

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2022-48733

    Alta · CVSS 7.8EPSS 0,23%Corrección disponible

    btrfs: fix use-after-free after failure to create a snapshot

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after failure to create a snapshot At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and then attach it to the transaction's list of pending snapshots. After that we call btrfs_commit_transaction(), and if that returns an error we jump to 'fail' label, where we kfree() the pending snapshot structure. This can result in a later use-after-free of the pending snapshot: 1) We allocated the pending snapshot and added it to the transaction's list of pending snapshots; 2) We call btrfs_commit_transaction(), and it fails either at

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2022-48732

    Alta · CVSS 7.8EPSS 0,24%Corrección disponible

    drm/nouveau: fix off by one in BIOS boundary checking

    In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix off by one in BIOS boundary checking Bounds checking when parsing init scripts embedded in the BIOS reject access to the last byte. This causes driver initialization to fail on Apple eMac's with GeForce 2 MX GPUs, leaving the system with no working console. This is probably only seen on OpenFirmware machines like PowerPC Macs because the BIOS image provided by OF is only the used parts of the ROM, not a power-of-two blocks read from PCI directly so PCs always have empty bytes at the end that are never accessed.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2022-48731

    Media · CVSS 5.5EPSS 0,17%Corrección disponible

    mm/kmemleak: avoid scanning potential huge holes

    In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid scanning potential huge holes When using devm_request_free_mem_region() and devm_memremap_pages() to add ZONE_DEVICE memory, if requested free mem region's end pfn were huge(e.g., 0x400000000), the node_end_pfn() will be also huge (see move_pfn_range_to_zone()). Thus it creates a huge hole between node_start_pfn() and node_end_pfn(). We found on some AMD APUs, amdkfd requested such a free mem region and created a huge hole. In such a case, following code snippet was just doing busy test_bit() looping on the huge hole. for (pfn = start_pfn; pfn < end

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2022-48730

    Media · CVSS 5.5EPSS 0,26%Corrección disponible

    dma-buf: heaps: Fix potential spectre v1 gadget

    In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix potential spectre v1 gadget It appears like nr could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via speculative execution by using array_index_nospec. [sumits: added fixes and cc: stable tags]

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2022-48728

    Media · CVSS 5.5EPSS 0,24%Corrección disponible

    IB/hfi1: Fix AIP early init panic

    In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix AIP early init panic An early failure in hfi1_ipoib_setup_rn() can lead to the following panic: BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0 PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI Workqueue: events work_for_cpu_fn RIP: 0010:try_to_grab_pending+0x2b/0x140 Code: 1f 44 00 00 41 55 41 54 55 48 89 d5 53 48 89 fb 9c 58 0f 1f 44 00 00 48 89 c2 fa 66 0f 1f 44 00 00 48 89 55 00 40 84 f6 75 77 <f0> 48 0f ba 2b 00 72 09 31 c0 5b 5d 41 5c 41 5d c3 48 89 df e8 6c RSP: 0018:ffffb6b3cf7cfa48 EFLAGS: 00010046 RAX: 0000000000000246 R

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2022-48727

    Alta · CVSS 7.3EPSS 0,22%Corrección disponible

    KVM: arm64: Avoid consuming a stale esr value when SError occur

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Avoid consuming a stale esr value when SError occur When any exception other than an IRQ occurs, the CPU updates the ESR_EL2 register with the exception syndrome. An SError may also become pending, and will be synchronised by KVM. KVM notes the exception type, and whether an SError was synchronised in exit_code. When an exception other than an IRQ occurs, fixup_guest_exit() updates vcpu->arch.fault.esr_el2 from the hardware register. When an SError was synchronised, the vcpu esr value is used to determine if the exception was due to an HVC. If so, ELR_EL2 is mo

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2022-48726

    Alta · CVSS 7.8EPSS 0,24%Corrección disponible

    RDMA/ucma: Protect mc during concurrent multicast leaves

    In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Protect mc during concurrent multicast leaves Partially revert the commit mentioned in the Fixes line to make sure that allocation and erasing multicast struct are locked. BUG: KASAN: use-after-free in ucma_cleanup_multicast drivers/infiniband/core/ucma.c:491 [inline] BUG: KASAN: use-after-free in ucma_destroy_private_ctx+0x914/0xb70 drivers/infiniband/core/ucma.c:579 Read of size 8 at addr ffff88801bb74b00 by task syz-executor.1/25529 CPU: 0 PID: 25529 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2022-48725

    Media · CVSS 5.5EPSS 0,22%Corrección disponible

    RDMA/siw: Fix refcounting leak in siw_create_qp()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix refcounting leak in siw_create_qp() The atomic_inc() needs to be paired with an atomic_dec() on the error path.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2022-48724

    Media · CVSS 5.5EPSS 0,24%Corrección disponible

    iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() After commit e3beca48a45b ("irqdomain/treewide: Keep firmware node unconditionally allocated"). For tear down scenario, fn is only freed after fail to allocate ir_domain, though it also should be freed in case dmar_enable_qi returns error. Besides free fn, irq_domain and ir_msi_domain need to be removed as well if intel_setup_irq_remapping fails to enable queued invalidation. Improve the rewinding path by add out_free_ir_domain and out_free_fwnode lables per Baolu's suggestion.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2022-48723

    Media · CVSS 5.5EPSS 0,22%Corrección disponible

    spi: uniphier: fix reference count leak in uniphier_spi_probe()

    In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: fix reference count leak in uniphier_spi_probe() The issue happens in several error paths in uniphier_spi_probe(). When either dma_get_slave_caps() or devm_spi_register_master() returns an error code, the function forgets to decrease the refcount of both `dma_rx` and `dma_tx` objects, which may lead to refcount leaks. Fix it by decrementing the reference count of specific objects in those error paths.

    linux-intel-iotg-5.15Sistemas operativos
    • Actualiza a 5.15.0-1008.11~20.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →