p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de linux-oracle-5.15 · Page n° 97

Vulnérabilité publiée pour linux-oracle-5.15 au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 4250

  1. CVE-2022-49410

    Élevée · CVSS 7.8EPSS 0,3%Correctif disponible

    tracing: Fix potential double free in create_var_ref()

    In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable ref_field, which is allocated in the previous function call to create_hist_field(). Function init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2022-49409

    Élevée · CVSS 7.1EPSS 0,27%Correctif disponible

    ext4: fix bug_on in __es_tree_search

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/extents_status.c:199! [...] RIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline] RIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217 [...] Call Trace: ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766 ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561 ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964 ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384 ext4_map_blocks+0xe26/0

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2022-49407

    Critique · CVSS 9.8EPSS 0,87%Correctif disponible

    dlm: fix plock invalid read

    In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plock_op" and a followed send_op() will append it to a global send_list data structure. In some cases a followed dev_read() moves it to recv_list and dev_write() will cast it to "struct plock_xop" and access fields which are only available in those structures. At this point an invalid read happens by accessing those fields. To fix this issue the "callback" field is moved to "struct plock_op" to indicate that a cast to "plock_xop" is allowed and does the additional

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2022-49405

    Élevée · CVSS 7.8EPSS 0,27%Correctif disponible

    staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

    In the Linux kernel, the following vulnerability has been resolved: staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan() This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2022-49404

    Moyenne · CVSS 5.5EPSS 0,28%Correctif disponible

    RDMA/hfi1: Fix potential integer multiplication overflow errors

    In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix potential integer multiplication overflow errors When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the conversion is done after the multiplication. So arithmetic overflow and thus in incorrect value is possible. Correct an instance of this in the inter packet delay calculation. Fix by ensuring one of the operands is u64 which will promote the other to u64 as well ensuring no overflow.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2022-49402

    Moyenne · CVSS 5.5EPSS 0,28%Correctif disponible

    ftrace: Clean up hash direct_functions on register failures

    In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash direct_functions on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection fault, probably for non-canonical address \ 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [...] [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48 85 d2 74 [...] [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 [ ] RAX: 0000000000000000 RBX: ffffffff813e0df0 RCX: 000000000000003b [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI: ffffffff813e0df0 [ ] RBP: ffffffffa00a

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2022-49400

    Moyenne · CVSS 5.5EPSS 0,28%Correctif disponible

    md: Don't set mddev private to NULL in raid0 pers->free

    In the Linux kernel, the following vulnerability has been resolved: md: Don't set mddev private to NULL in raid0 pers->free In normal stop process, it does like this: do_md_stop | __md_stop (pers->free(); mddev->private=NULL) | md_free (free mddev) __md_stop sets mddev->private to NULL after pers->free. The raid device will be stopped and mddev memory is free. But in reshape, it doesn't free the mddev and mddev will still be used in new raid. In reshape, it first sets mddev->private to new_pers and then runs old_pers->free(). Now raid0 sets mddev->private to NULL in raid0_free. The new raid can't work anymore. It will

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2022-49399

    Moyenne · CVSS 5.5EPSS 0,26%Correctif disponible

    tty: goldfish: Use tty_port_destroy() to destroy port

    In the Linux kernel, the following vulnerability has been resolved: tty: goldfish: Use tty_port_destroy() to destroy port In goldfish_tty_probe(), the port initialized through tty_port_init() should be destroyed in error paths.In goldfish_tty_remove(), qtty->port also should be destroyed or else might leak resources. Fix the above by calling tty_port_destroy().

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1018.23~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2022-49398

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback

    In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely removed without corrupting the list. However, when traversing the list and removing items using gadget giveback, the DWC3 lock is briefly released, allowing other routines to execute. There is a situation where, while items are being removed from the cancelled_list using dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable routine is running in parallel (due to UDC unbind). As

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1018.23~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2022-49397

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    phy: qcom-qmp: fix struct clk leak on probe errors

    In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix struct clk leak on probe errors Make sure to release the pipe clock reference in case of a late probe error (e.g. probe deferral).

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2022-49396

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    phy: qcom-qmp: fix reset-controller leak on probe errors

    In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix reset-controller leak on probe errors Make sure to release the lane reset controller in case of a late probe error (e.g. probe deferral). Note that due to the reset controller being defined in devicetree in "lane" child nodes, devm_reset_control_get_exclusive() cannot be used directly.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2022-49395

    Élevée · CVSS 7.1EPSS 0,29%Correctif disponible

    um: Fix out-of-bounds read in LDT setup

    In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace: show_stack.cold+0x166/0x2a7 __dump_stack+0x3a/0x43 dump_stack_lvl+0x1f/0x27 print_report.cold+0xdb/0xf81 kasan_report+0x119/0x1f0 kasan_check_range+0x3a3/0x440 memcpy+0x52/0x

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2022-49394

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    blk-iolatency: Fix inflight count imbalances and IO hangs on offline

    In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for the device. To ensure that the inflight counters stay balanced, iolatency_set_limit() freezes the request_queue while manipulating the enabled counter, which ensures that no IO is in flight and thus all counters are zero. Unfortunately, iolatency_set_limit() isn't the only place where the enabled counter is manipulated. iolatency_pd_offline() can als

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2022-49392

    Moyenne · CVSS 5.5EPSS 0,26%Correctif disponible

    serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe

    In the Linux kernel, the following vulnerability has been resolved: serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe platform_get_resource() may fail and return NULL, so we should better check it's return value to avoid a NULL pointer dereference.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1018.23~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2022-49389

    Moyenne · CVSS 5.5EPSS 0,29%Correctif disponible

    usb: usbip: fix a refcount leak in stub_probe()

    In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stub_probe() usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. Fix this by moving usb_put_dev() to sdev_free error path handling. Find this by code review.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1018.23~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2022-49388

    Élevée · CVSS 7.8EPSS 0,29%Correctif disponible

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed

    In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1018.23~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2022-49386

    Moyenne · CVSS 5.5EPSS 0,26%Correctif disponible

    net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks

    In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. am65_cpsw_init_cpts() and am65_cpsw_nuss_probe() don't release the refcount in error case. Add missing of_node_put() to avoid refcount leak.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1018.23~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2022-49385

    Élevée · CVSS 7.8EPSS 0,3%Correctif disponible

    driver: base: fix UAF when driver_attach failed

    In the Linux kernel, the following vulnerability has been resolved: driver: base: fix UAF when driver_attach failed When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1018.23~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2022-49384

    Élevée · CVSS 7.8EPSS 0,27%Correctif disponible

    md: fix double free of io_acct_set bioset

    In the Linux kernel, the following vulnerability has been resolved: md: fix double free of io_acct_set bioset Now io_acct_set is alloc and free in personality. Remove the codes that free io_acct_set in md_free and md_stop.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1017.22~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2022-49382

    Moyenne · CVSS 5.5EPSS 0,27%Correctif disponible

    soc: rockchip: Fix refcount leak in rockchip_grf_init

    In the Linux kernel, the following vulnerability has been resolved: soc: rockchip: Fix refcount leak in rockchip_grf_init of_find_matching_node_and_match returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.

    linux-oracle-5.15Systèmes d’exploitation
    • Mettez à jour vers 5.15.0-1018.23~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →