p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de linux-intel-iotg-5.15 · Page n° 111

Vulnérabilité publiée pour linux-intel-iotg-5.15 au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 4693

  1. CVE-2022-49058

    Critique · CVSS 9.1EPSS 0,87%Correctif disponible

    cifs: potential buffer overflow in handling symlinks

    In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max) It's caused because Smatch marks 'link_len' as untrusted since it comes from sscanf(). Add a check to ensure that 'link_len' is not larger than the size of the 'link_str' buffer.

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2022-49055

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    drm/amdkfd: Check for potential null return of kmalloc_array()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check for potential null return of kmalloc_array() As the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference. Therefore, it is better to check the return value of kmalloc_array() to avoid this confusion.

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2022-49054

    Élevée · CVSS 7.1EPSS 0,3%Correctif disponible

    Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests

    In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests hv_panic_page might contain guest-sensitive information, do not dump it over to Hyper-V by default in isolated guests. While at it, update some comments in hyperv_{panic,die}_event().

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2022-49053

    Élevée · CVSS 7.8EPSS 0,29%Correctif disponible

    scsi: target: tcmu: Fix possible page UAF

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release().

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2022-49052

    Élevée · CVSS 7.1EPSS 0,29%Correctif disponible

    mm: fix unexpected zeroed page mapping with zram swap

    In the Linux kernel, the following vulnerability has been resolved: mm: fix unexpected zeroed page mapping with zram swap Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlo

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2022-49051

    Élevée · CVSS 7EPSS 0,45%Correctif disponible

    net: usb: aqc111: Fix out-of-bounds accesses in RX fixup

    In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup aqc111_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (desc_offset..desc_offset+2*pkt_count) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is fa

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2022-49050

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    memory: renesas-rpc-if: fix platform-device leak in error path

    In the Linux kernel, the following vulnerability has been resolved: memory: renesas-rpc-if: fix platform-device leak in error path Make sure to free the flash platform device in the event that registration fails during probe.

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2022-49049

    Moyenne · CVSS 6.8EPSS 0,26%Correctif disponible

    mm/secretmem: fix panic when growing a memfd_secret

    In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix panic when growing a memfd_secret When one tries to grow an existing memfd_secret with ftruncate, one gets a panic [1]. For example, doing the following reliably induces the panic: fd = memfd_secret(); ftruncate(fd, 10); ptr = mmap(NULL, 10, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); strcpy(ptr, "123456789"); munmap(ptr, 10); ftruncate(fd, 20); The basic reason for this is, when we grow with ftruncate, we call down into simple_setattr, and then truncate_inode_pages_range, and eventually we try to zero part of the memory. The

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2022-49048

    Élevée · CVSS 7.5EPSS 0,69%Correctif disponible

    ipv6: fix panic when forwarding a pkt with no in6 dev

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6_forward() when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev vxlan100 root tc qdisc add dev vxlan100 root netem corrupt 5%

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2022-49046

    Moyenne · CVSS 5.5EPSS 0,26%Correctif disponible

    i2c: dev: check return value when calling dev_set_name()

    In the Linux kernel, the following vulnerability has been resolved: i2c: dev: check return value when calling dev_set_name() If dev_set_name() fails, the dev_name() is null, check the return value of dev_set_name() to avoid the null-ptr-deref.

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2022-49044

    Élevée · CVSS 7.8EPSS 0,28%Correctif disponible

    dm integrity: fix memory corruption when tag_size is less than digest size

    In the Linux kernel, the following vulnerability has been resolved: dm integrity: fix memory corruption when tag_size is less than digest size It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integ

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2021-47657

    Moyenne · CVSS 5.5EPSS 0,28%Correctif disponible

    drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()

    In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virtio_gpu_array_put_free() could be called with objs equal to NULL. Ensure that objs is not NULL in virtio_gpu_array_put_free(), or otherwise return from the function.

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2021-47656

    Élevée · CVSS 7.8EPSS 0,26%Correctif disponible

    jffs2: fix use-after-free in jffs2_clear_xattr_subsystem

    In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result, an error is returned in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then called in jffs2_build_filesystem() and then again in jffs2_do_fill_super(). Finally we can observe the following report: ================================================================== BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2021-47654

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    samples/landlock: Fix path_list memory leak

    In the Linux kernel, the following vulnerability has been resolved: samples/landlock: Fix path_list memory leak Clang static analysis reports this error sandboxer.c:134:8: warning: Potential leak of memory pointed to by 'path_list' ret = 0; ^ path_list is allocated in parse_path() but never freed.

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2021-47653

    Élevée · CVSS 7.8EPSS 0,27%Correctif disponible

    media: davinci: vpif: fix use-after-free on driver unbind

    In the Linux kernel, the following vulnerability has been resolved: media: davinci: vpif: fix use-after-free on driver unbind The driver allocates and registers two platform device structures during probe, but the devices were never deregistered on driver unbind. This results in a use-after-free on driver unbind as the device structures were allocated using devres and would be freed by driver core when remove() returns. Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors. Note that the platform device structures must be freed using a proper release callback to avoid leakin

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2021-47652

    Moyenne · CVSS 5.5EPSS 0,26%Correctif disponible

    video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()

    In the Linux kernel, the following vulnerability has been resolved: video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:fb_destroy_modelist+0x38/0x100 ... Call Trace: ufx_usb_probe.cold+0x2b5/0xac1 [smscufx] usb_probe_interface+0x1aa/0x3c0 [usbcore] really_probe+0x167/0x460 ... ret_from_fork+0x1f/0x30 If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will be called to destroy modelist in the error handling path. But modelist has not been initialized yet, so it will result in null-ptr-deref. Initialize

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2021-47651

    Moyenne · CVSS 5.5EPSS 0,25%Correctif disponible

    soc: qcom: rpmpd: Check for null return of devm_kcalloc

    In the Linux kernel, the following vulnerability has been resolved: soc: qcom: rpmpd: Check for null return of devm_kcalloc Because of the possible failure of the allocation, data->domains might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and directly return -ENOMEM without releasing data manually if fails, because the comment of the devm_kmalloc() says "Memory allocated with this function is automatically freed on driver detach.".

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2021-47650

    Moyenne · CVSS 5.5EPSS 0,26%Correctif disponible

    ASoC: soc-compress: prevent the potentially use of null pointer

    In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-compress: prevent the potentially use of null pointer There is one call trace that snd_soc_register_card() ->snd_soc_bind_card()->soc_init_pcm_runtime() ->snd_soc_dai_compress_new()->snd_soc_new_compress(). In the trace the 'codec_dai' transfers from card->dai_link, and we can see from the snd_soc_add_pcm_runtime() in snd_soc_bind_card() that, if value of card->dai_link->num_codecs is 0, then 'codec_dai' could be null pointer caused by index out of bound in 'asoc_rtd_to_codec(rtd, 0)'. And snd_soc_register_card() is called by various platforms. Therefore, it is be

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2021-47649

    Moyenne · CVSS 5.5EPSS 0,25%Correctif disponible

    udmabuf: validate ubuf->pagecount

    In the Linux kernel, the following vulnerability has been resolved: udmabuf: validate ubuf->pagecount Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The problem was in ubuf->pages == ZERO_PTR. ubuf->pagecount is calculated from arguments passed from user-space. If user creates udmabuf with list.size == 0 then ubuf->pagecount will be also equal to zero; it causes kmalloc_array() to return ZERO_PTR. Fix it by validating ubuf->pagecount before passing it to kmalloc_array().

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2021-47648

    Moyenne · CVSS 5.5EPSS 0,25%Correctif disponible

    gpu: host1x: Fix a memory leak in 'host1x_remove()'

    In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix a memory leak in 'host1x_remove()' Add a missing 'host1x_channel_list_free()' call in the remove function, as already done in the error handling path of the probe function.

    linux-intel-iotg-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1008.11~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →