p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de linux-raspi · Page n° 92

Vulnérabilité publiée pour linux-raspi au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 3427

  1. CVE-2024-41063

    Moyenne · CVSS 5.5EPSS 0,18%Correctif disponible

    Bluetooth: hci_core: cancel all works upon hci_unregister_dev()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause deadlock at destroy_workqueue(), for hci_error_reset() is called from hdev->req_workqueue which destroy_workqueue() needs to flush. We need to make sure that hdev->{rx_work,cmd_work,tx_work} which are queued into hdev->workqueue and hdev->{power_on,error_reset} which are queued into hdev->req_workqueue are no longer running by the moment destroy_workqueue(hdev->workqueue);

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2024-41059

    Élevée · CVSS 7.8EPSS 0,27%Correctif disponible

    hfsplus: fix uninit-value in copy_name

    In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 hfsplus_listxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750 vfs_listxattr fs/xattr.c:493 [inline] listxattr+0x1f3/0x6b0 fs/xattr.c:840 path_listxattr fs/xattr.c:864 [inline] __do_sys_listxattr fs/xattr.c:876 [inline] __se_sys_listxattr fs/xattr.c:873 [inline] __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873 x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195 do_syscall_

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2024-41049

    Élevée · CVSS 7.8EPSS 0,28%Correctif disponible

    filelock: fix potential use-after-free in posix_lock_inode

    In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1116.128
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2024-41046

    Élevée · CVSS 8.8EPSS 0,45%Correctif disponible

    net: ethernet: lantiq_etop: fix double free in detach

    In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1116.128
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2024-41044

    Moyenne · CVSS 5.5EPSS 0,29%Correctif disponible

    ppp: reject claimed-as-LCP but actually malformed packets

    In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP packet has an actual body beyond PPP_LCP header bytes, and reject claimed-as-LCP but actually malformed data otherwise.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1116.128
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2024-41042

    Élevée · CVSS 7.8EPSS 0,32%Correctif disponible

    netfilter: nf_tables: prefer nft_chain_validate

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It also follows maps via ->validate callback in nft_lookup, so there appears no reason to iterate the maps again. nf_tables_check_loops() and all its helper functions can be removed. This improves ruleset load time significantly, from 23s down to 12s. This also fixes a crash bug. Old loop detection code can result in unbounded recursion: BUG: TASK stack guard page was hit at .... Oops

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2024-41041

    Élevée · CVSS 7.8EPSS 0,29%Correctif disponible

    udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().

    In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). syzkaller triggered the warning [0] in udp_v4_early_demux(). In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount of the looked-up sk and use sock_pfree() as skb->destructor, so we check SOCK_RCU_FREE to ensure that the sk is safe to access during the RCU grace period. Currently, SOCK_RCU_FREE is flagged for a bound socket after being put into the hash table. Moreover, the SOCK_RCU_FREE check is done too early in udp_v[46]_early_demux() and sk_lookup(), so there could be a small race window: CPU

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1116.128
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2024-41035

    Moyenne · CVSS 5.5EPSS 0,3%Correctif disponible

    USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor

    In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descrip

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1116.128
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2024-41034

    Élevée · CVSS 7.8EPSS 0,32%Correctif disponible

    nilfs2: fix kernel bug on rename operation of broken directory

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare block write may fail BUG_ON check for access exceeding the folio/page size. This is because nilfs_dotdot(), which gets parent directory reference entry ("..") of the directory to be moved or renamed, does not check consistency enough, and may return location exceeding folio/page size for broken directories. Fix this issue by checking required directory entries ("." and "..") in the firs

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1116.128
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2024-41022

    Élevée · CVSS 7EPSS 0,24%Correctif disponible

    drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() The "instance" variable needs to be signed for the error handling to work.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2024-41020

    Élevée · CVSS 7.8EPSS 0,19%Correctif disponible

    filelock: Fix fcntl/close race recovery compat path

    In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2024-41016

    Élevée · CVSS 7.8EPSS 0,25%Correctif disponible

    ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1129.142
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2024-41015

    Élevée · CVSS 7.8EPSS 0,25%Correctif disponible

    ocfs2: add bounds checking to ocfs2_check_dir_entry()

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: add bounds checking to ocfs2_check_dir_entry() This adds sanity checks for ocfs2_dir_entry to make sure all members of ocfs2_dir_entry don't stray beyond valid memory region.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2024-41091

    Élevée · CVSS 8.8EPSS 0,26%Correctif disponible

    tun: add missing verification for short frame

    In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tun_xdp_one-->eth_type_trans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tun_get_user() already prohibi

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2024-41090

    Élevée · CVSS 8.8EPSS 0,26%Correctif disponible

    tap: add missing verification for short frame

    In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits shor

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2024-41012

    Élevée · CVSS 7.8EPSS 0,23%Correctif disponible

    filelock: Remove locks reliably when fcntl/close race is detected

    In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the first do_lock_file_wait() that created the lock while denying the second do_lock_file_wait() that tries to remove the lock. Separately, posix_lock_file() could also fail to remove a lock due to GFP_KERNEL allocation failure (when splitting a range in the middle). After the bug has been triggered, use-after-free reads will occur in lock_get_status() when userspace reads /proc/locks. This ca

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2024-41011

    Élevée · CVSS 7.8EPSS 0,22%Correctif disponible

    drm/amdkfd: don't allow mapping the MMIO HDP page with large pages

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the MMIO HDP page with large pages We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap registers. We remap the HDP flush registers into this space to allow userspace (CPU or GPU) to flush the HDP when it updates VRAM. However, on systems with >4K pages, we end up exposing PAGE_SIZE of MMIO space.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1119.131
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2022-48863

    Moyenne · CVSS 6.8EPSS 0,25%Correctif disponible

    mISDN: Fix memory leak in dsp_pipeline_build()

    In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE.

    linux-raspiSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1117.129
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →