p PatchFirst

PatchFirst · Latest vulnerabilities

linux-raspi vulnerabilities · Page 157

Vulnerabilities published for linux-raspi in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3427

  1. CVE-2022-33741

    High · CVSS 7.1EPSS 0.33%Fix available

    CVE-2022-33741

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

    linux-raspiOperating systems
    • Update to 5.4.0-1071.81
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2022-33740

    High · CVSS 7.1EPSS 0.33%Fix available

    CVE-2022-33740

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

    linux-raspiOperating systems
    • Update to 5.4.0-1071.81
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2022-26365

    High · CVSS 7.1EPSS 0.33%Fix available

    CVE-2022-26365

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

    linux-raspiOperating systems
    • Update to 5.4.0-1071.81
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2022-33744

    High · CVSS 8.9EPSS 0.32%Fix available

    CVE-2022-33744

    Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages.

    linux-raspiOperating systems
    • Update to 5.4.0-1071.81
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2022-34918

    High · CVSS 7.8EPSS 5.45%Public exploitFix available

    CVE-2022-34918

    An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.

    linux-raspiOperating systems
    • Update to 5.4.0-1068.78
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2022-20166

    Medium · CVSS 6.7EPSS 0.16%Fix available

    CVE-2022-20166

    In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182388481References: Upstream kernel

    linux-raspiOperating systems
    • Update to 5.4.0-1056.63
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2022-20154

    High · CVSS 7.3EPSS 0.12%Fix available

    CVE-2022-20154

    In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel

    linux-raspiOperating systems
    • Update to 5.4.0-1056.63
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2022-20141

    High · CVSS 7.3EPSS 0.14%Fix available

    CVE-2022-20141

    In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel

    linux-raspiOperating systems
    • Update to 5.4.0-1046.50
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2022-20132

    Medium · CVSS 4.6EPSS 0.21%Fix available

    CVE-2022-20132

    In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel

    linux-raspiOperating systems
    • Update to 5.4.0-1053.60
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2022-21499

    Medium · CVSS 6.7EPSS 0.62%Fix available

    CVE-2022-21499

    KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

    linux-raspiOperating systems
    • Update to 5.4.0-1065.75
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2022-1966

    Not ratedFix available

    UBUNTU-CVE-2022-1966

    Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

    linux-raspiOperating systems
    • Update to 5.4.0-1065.75
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2022-1652

    High · CVSS 7.8EPSS 0.54%Fix available

    CVE-2022-1652

    Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.

    linux-raspiOperating systems
    • Update to 5.4.0-1068.78
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2022-1462

    High · CVSS 7.3EPSS 0.34%Fix available

    CVE-2022-1462

    An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.

    linux-raspiOperating systems
    • Update to 5.4.0-1071.81
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →