p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de linux-ibm · Page n° 123

Vulnérabilité publiée pour linux-ibm au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 3088

  1. CVE-2024-26830

    Élevée · CVSS 8.4EPSS 0,23%Correctif disponible

    i40e: Do not allow untrusted VF to remove administratively set MAC

    In the Linux kernel, the following vulnerability has been resolved: i40e: Do not allow untrusted VF to remove administratively set MAC Currently when PF administratively sets VF's MAC address and the VF is put down (VF tries to delete all MACs) then the MAC is removed from MAC filters and primary VF MAC is zeroed. Do not allow untrusted VF to remove primary MAC when it was set administratively by PF. Reproducer: 1) Create VF 2) Set VF interface up 3) Administratively set the VF's MAC 4) Put VF interface down [root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs [root@host ~]# ip link set enp2s0f0v0 up [root@host ~]# ip link

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1078.83
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2024-26828

    Critique · CVSS 9.4EPSS 0,75%Correctif disponible

    cifs: fix underflow in parse_server_interfaces()

    In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1075.80
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2024-26825

    Moyenne · CVSS 5.5EPSS 0,24%Correctif disponible

    nfc: nci: free rx_data_reassembly skb on NCI device cleanup

    In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free rx_data_reassembly skb on NCI device cleanup rx_data_reassembly skb is stored during NCI data exchange for processing fragmented packets. It is dropped only when the last fragment is processed or when an NTF packet with NCI_OP_RF_DEACTIVATE_NTF opcode is received. However, the NCI device may be deallocated before that which leads to skb leak. As by design the rx_data_reassembly skb is bound to the NCI device and nothing prevents the device to be freed before the skb is processed in some way and cleaned, free it on the NCI device cleanup. Found by Linux Veri

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1071.76
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2024-26820

    Moyenne · CVSS 5.5EPSS 0,24%Correctif disponible

    hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed

    In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as the register call is received before netvsc_probe is finished. This is because we register register_netdevice_notifier() very early( even before vmbus_driver_register()). To fix this, we try to register each such matching VF( if it is visible as a netdevice) at the end of netvsc_probe.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1075.80
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2024-24856

    Moyenne · CVSS 5.3EPSS 0,17%Correctif disponible

    NULL pointer deference in acpi_db_convert_to_package of Linux acpi module

    The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a successful allocation, but the subsequent code directly dereferences the pointer that receives it, which may lead to null pointer dereference. To fix this issue, a null pointer check should be added. If it is null, return exception code AE_NO_MEMORY.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1056.61
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2024-26817

    Moyenne · CVSS 5.5EPSS 0,76%Correctif disponible

    amdkfd: use calloc instead of kzalloc to avoid integer overflow

    In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer overflow This uses calloc instead of doing the multiplication which might overflow.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1075.80
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2021-47219

    Élevée · CVSS 7.1EPSS 0,25%Correctif disponible

    scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()

    In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() The following issue was observed running syzkaller: BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815 CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_s

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1088.93
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2021-47217

    Moyenne · CVSS 5.5EPSS 0,24%Correctif disponible

    x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails

    In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails Check for a valid hv_vp_index array prior to derefencing hv_vp_index when setting Hyper-V's TSC change callback. If Hyper-V setup failed in hyperv_init(), the kernel will still report that it's running under Hyper-V, but will have silently disabled nearly all functionality. BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 4 PID: 1 Comm: swapper/0 Not

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2021-47216

    Moyenne · CVSS 5.5EPSS 0,23%Correctif disponible

    scsi: advansys: Fix kernel pointer leak

    In the Linux kernel, the following vulnerability has been resolved: scsi: advansys: Fix kernel pointer leak Pointers should be printed with %p or %px rather than cast to 'unsigned long' and printed with %lx. Change %lx to %p to print the hashed pointer.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2021-47212

    Moyenne · CVSS 5.5EPSS 0,2%Correctif disponible

    net/mlx5: Update error handler for UCTX and UMEM

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Update error handler for UCTX and UMEM In the fast unload flow, the device state is set to internal error, which indicates that the driver started the destroy process. In this case, when a destroy command is being executed, it should return MLX5_CMD_STAT_OK. Fix MLX5_CMD_OP_DESTROY_UCTX and MLX5_CMD_OP_DESTROY_UMEM to return OK instead of EIO. This fixes a call trace in the umem release process - [ 2633.536695] Call Trace: [ 2633.537518] ib_uverbs_remove_one+0xc3/0x140 [ib_uverbs] [ 2633.538596] remove_client_context+0x8b/0xd0 [ib_core] [ 2633.539641] disable_

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1082.87
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2021-47210

    Moyenne · CVSS 5.5EPSS 0,22%Correctif disponible

    usb: typec: tipd: Remove WARN_ON in tps6598x_block_read

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: Remove WARN_ON in tps6598x_block_read Calling tps6598x_block_read with a higher than allowed len can be handled by just returning an error. There's no need to crash systems with panic-on-warn enabled.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2021-47207

    Moyenne · CVSS 5.7EPSS 0,23%Correctif disponible

    ALSA: gus: fix null pointer dereference on pointer block

    In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: fix null pointer dereference on pointer block The pointer block return from snd_gf1_dma_next_block could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2021-47206

    Moyenne · CVSS 5.5EPSS 0,23%Correctif disponible

    usb: host: ohci-tmio: check return value after calling platform_get_resource()

    In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-tmio: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2021-47204

    Élevée · CVSS 7.8EPSS 0,23%Correctif disponible

    net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove

    In the Linux kernel, the following vulnerability has been resolved: net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove Access to netdev after free_netdev() will cause use-after-free bug. Move debug log before free_netdev() call to avoid it.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2021-47203

    Élevée · CVSS 8.8EPSS 0,35%Correctif disponible

    scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a local "fail_msg" string is set and a log message output. The job is then added to a completions list for cancellation. Processing of any further jobs from the txq list continues, but since "fail_msg" remains set, jobs are added to the completions list regardless of whether a wqe was passed to the adapter. If successfully added to txcmplq, jobs are added to both lists resulting in list

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2021-47202

    Moyenne · CVSS 5.5EPSS 0,24%Correctif disponible

    thermal: Fix NULL pointer dereferences in of_thermal_ functions

    In the Linux kernel, the following vulnerability has been resolved: thermal: Fix NULL pointer dereferences in of_thermal_ functions of_parse_thermal_zones() parses the thermal-zones node and registers a thermal_zone device for each subnode. However, if a thermal zone is consuming a thermal sensor and that thermal sensor device hasn't probed yet, an attempt to set trip_point_*_temp for that thermal zone device can cause a NULL pointer dereference. Fix it. console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... Call trace:

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1034.38
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2021-47201

    Élevée · CVSS 7.8EPSS 0,25%Correctif disponible

    iavf: free q_vectors before queues in iavf_disable_vf

    In the Linux kernel, the following vulnerability has been resolved: iavf: free q_vectors before queues in iavf_disable_vf iavf_free_queues() clears adapter->num_active_queues, which iavf_free_q_vectors() relies on, so swap the order of these two function calls in iavf_disable_vf(). This resolves a panic encountered when the interface is disabled and then later brought up again after PF communication is restored.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2021-47194

    Élevée · CVSS 7.8EPSS 0,25%Correctif disponible

    cfg80211: call cfg80211_stop_ap when switch from P2P_GO type

    In the Linux kernel, the following vulnerability has been resolved: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type If the userspace tools switch from NL80211_IFTYPE_P2P_GO to NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it does not call the cleanup cfg80211_stop_ap(), this leads to the initialization of in-use data. For example, this path re-init the sdata->assigned_chanctx_list while it is still an element of assigned_vifs list, and makes that linked list corrupt.

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2021-47192

    Moyenne · CVSS 5.3EPSS 0,61%Correctif disponible

    scsi: core: sysfs: Fix hang when device state is set via sysfs

    In the Linux kernel, the following vulnerability has been resolved: scsi: core: sysfs: Fix hang when device state is set via sysfs This fixes a regression added with: commit f0f82e2476f6 ("scsi: core: Fix capacity set to zero after offlinining device") The problem is that after iSCSI recovery, iscsid will call into the kernel to set the dev's state to running, and with that patch we now call scsi_rescan_device() with the state_mutex held. If the SCSI error handler thread is just starting to test the device in scsi_send_eh_cmnd() then it's going to try to grab the state_mutex. We are then stuck, because when scsi_rescan_device() tries to

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1013.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2021-47191

    Élevée · CVSS 7.1EPSS 0,24%Correctif disponible

    scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()

    In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() The following warning was observed running syzkaller: [ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] d

    linux-ibmSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1092.97
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →