p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de linux-hwe-5.15 · Page n° 177

Vulnérabilité publiée pour linux-hwe-5.15 au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 4389

  1. CVE-2022-48689

    Moyenne · CVSS 5.3EPSS 0,19%Correctif disponible

    tcp: TX zerocopy should not sense pfmemalloc status

    In the Linux kernel, the following vulnerability has been resolved: tcp: TX zerocopy should not sense pfmemalloc status We got a recent syzbot report [1] showing a possible misuse of pfmemalloc page status in TCP zerocopy paths. Indeed, for pages coming from user space or other layers, using page_is_pfmemalloc() is moot, and possibly could give false positives. There has been attempts to make page_is_pfmemalloc() more robust, but not using it in the first place in this context is probably better, removing cpu cycles. Note to stable teams : You need to backport 84ce071e38a6 ("net: introduce __skb_fill_page_desc_noacc") as a prereq. Race

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-57.63~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2022-48688

    Moyenne · CVSS 5.5EPSS 0,24%Correctif disponible

    i40e: Fix kernel crash during module removal

    In the Linux kernel, the following vulnerability has been resolved: i40e: Fix kernel crash during module removal The driver incorrectly frees client instance and subsequent i40e module removal leads to kernel crash. Reproducer: 1. Do ethtool offline test followed immediately by another one host# ethtool -t eth0 offline; ethtool -t eth0 offline 2. Remove recursively irdma module that also removes i40e module host# modprobe -r irdma Result: [ 8675.035651] i40e 0000:3d:00.0 eno1: offline testing starting [ 8675.193774] i40e 0000:3d:00.0 eno1: testing finished [ 8675.201316] i40e 0000:3d:00.0 eno1: offline testing starting [ 8675.358921] i40e

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-57.63~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2022-48687

    Moyenne · CVSS 5.5EPSS 0,24%Correctif disponible

    ipv6: sr: fix out-of-bounds read when setting HMAC data.

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual length of the SECRET attribute, it is possible to provide invalid combinations (e.g., secret = "", secretlen = 64). This case is not checked in the code and with an appropriately crafted netlink message, an out-o

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-57.63~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2022-48686

    Critique · CVSS 9.8EPSS 0,7%Correctif disponible

    nvme-tcp: fix UAF when detecting digest errors

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-57.63~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2022-48675

    Moyenne · CVSS 5.5EPSS 0,18%Correctif disponible

    IB/core: Fix a nested dead lock as part of ODP flow

    In the Linux kernel, the following vulnerability has been resolved: IB/core: Fix a nested dead lock as part of ODP flow Fix a nested dead lock as part of ODP flow by using mmput_async(). From the below call trace [1] can see that calling mmput() once we have the umem_odp->umem_mutex locked as required by ib_umem_odp_map_dma_and_lock() might trigger in the same task the exit_mmap()->__mmu_notifier_release()->mlx5_ib_invalidate_range() which may dead lock when trying to lock the same mutex. Moving to use mmput_async() will solve the problem as the above exit_mmap() flow will be called in other task and will be executed once the lock will be

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-57.63~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2022-48674

    Élevée · CVSS 7.8EPSS 0,23%Correctif disponible

    erofs: fix pcluster use-after-free on UP platforms

    In the Linux kernel, the following vulnerability has been resolved: erofs: fix pcluster use-after-free on UP platforms During stress testing with CONFIG_SMP disabled, KASAN reports as below: ================================================================== BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789 CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. __mutex_lock+0xe5/0xc30 .. z_erofs_do_read_page+0x8ce/0x1560 .. z_erofs_readahead+0x31c/0x580 .. Freed by task 7787 kasan_

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-57.63~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2022-48672

    Élevée · CVSS 7.8EPSS 0,25%Correctif disponible

    of: fdt: fix off-by-one error in unflatten_dt_nodes()

    In the Linux kernel, the following vulnerability has been resolved: of: fdt: fix off-by-one error in unflatten_dt_nodes() Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") forgot to fix up the depth check in the loop body in unflatten_dt_nodes() which makes it possible to overflow the nps[] buffer... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-57.63~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2024-27390

    Moyenne · CVSS 5.8EPSS 0,22%Correctif disponible

    ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()")) I think the synchronize_net() call in ipv6_mc_down() is not needed. Under load, synchronize_net() can last between 200 usec and 5 ms. KASAN seems to agree as well.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2024-27388

    Critique · CVSS 9.8EPSS 0,96%Correctif disponible

    SUNRPC: fix some memleaks in gssx_dec_option_array

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the corresponding paths.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2024-27078

    Moyenne · CVSS 5.5EPSS 0,29%Correctif disponible

    media: v4l2-tpg: fix some memleaks in tpg_alloc

    In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: fix some memleaks in tpg_alloc In tpg_alloc, resources should be deallocated in each and every error-handling paths, since they are allocated in for statements. Otherwise there would be memleaks because tpg_free is called only when tpg_alloc return 0.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2024-27077

    Moyenne · CVSS 5.5EPSS 0,29%Correctif disponible

    media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity

    In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity but isn't freed in its following error-handling paths. This patch adds such deallocation to prevent memleak of entity->name.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2024-27075

    Élevée · CVSS 7.8EPSS 0,33%Correctif disponible

    media: dvb-frontends: avoid stack overflow warnings with clang

    In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: avoid stack overflow warnings with clang A previous patch worked around a KASAN issue in stv0367, now a similar problem showed up with clang: drivers/media/dvb-frontends/stv0367.c:1222:12: error: stack frame size (3624) exceeds limit (2048) in 'stv0367ter_set_frontend' [-Werror,-Wframe-larger-than] 1214 | static int stv0367ter_set_frontend(struct dvb_frontend *fe) Rework the stv0367_writereg() function to be simpler and mark both register access functions as noinline_for_stack so the temporary i2c_msg structures do not get duplicated on the stack wh

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2024-27074

    Moyenne · CVSS 5.5EPSS 0,29%Correctif disponible

    media: go7007: fix a memleak in go7007_load_encoder

    In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain: saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go) go is freed and thus bounce is leaked.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2024-27073

    Élevée · CVSS 7.8EPSS 0,29%Correctif disponible

    media: ttpci: fix two memleaks in budget_av_attach

    In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks in budget_av_attach When saa7146_register_device and saa7146_vv_init fails, budget_av_attach should free the resources it allocates, like the error-handling of ttpci_budget_init does. Besides, there are two fixme comment refers to such deallocations.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2024-27072

    Moyenne · CVSS 5.5EPSS 0,21%Correctif disponible

    media: usbtv: Remove useless locks in usbtv_video_free()

    In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Remove useless locks in usbtv_video_free() Remove locks calls in usbtv_video_free() because are useless and may led to a deadlock as reported here: https://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000 Also remove usbtv_stop() call since it will be called when unregistering the device. Before 'c838530d230b' this issue would only be noticed if you disconnect while streaming and now it is noticeable even when disconnecting while not streaming. [hverkuil: fix minor spelling mistake in log message]

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-127.137~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2024-27065

    Élevée · CVSS 7.8EPSS 0,26%Correctif disponible

    netfilter: nf_tables: do not compare internal table flags on updates

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not compare internal table flags on updates Restore skipping transaction if table update does not modify flags.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2023-52652

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    NTB: fix possible name leak in ntb_register_device()

    In the Linux kernel, the following vulnerability has been resolved: NTB: fix possible name leak in ntb_register_device() If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. [mani: reworded commit message]

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2024-27059

    Moyenne · CVSS 5.5EPSS 0,24%Correctif disponible

    USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command

    In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer. Protect against this possibility by refusing to bind to the device if either

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-116.126~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2024-27054

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    s390/dasd: fix double module refcount decrement

    In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix double module refcount decrement Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on this error path causes refcount to artificially decrease on each error while it should just stay the same.

    linux-hwe-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-113.123~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →