p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости linux-azure-5.15 · Страница 154

За последние 30 дней в linux-azure-5.15 опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 4525

  1. CVE-2024-42244

    Средний · CVSS 5.5EPSS 0,23%Есть исправление

    USB: serial: mos7840: fix crash on resume

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by implementing dedicated suspe

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2024-42240

    Средний · CVSS 5.5EPSS 0,22%Есть исправление

    x86/bhi: Avoid warning in #DB handler due to BHI mitigation

    In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY and calls the clear_bhb_loop() before the TF flag is cleared. This causes the #DB handler (exc_debug_kernel()) to issue a warning because single-step is used outside the entry_SYSENTER_compat() function. To address this issue, entry_SYSENTER_compat() should use CLEAR_BRANCH_HISTORY after making sure the TF flag is cleared. The problem can be reproduced with the following sequence:

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. CVE-2024-42236

    Высокий · CVSS 7.8EPSS 0,24%Есть исправление

    usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short.

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2024-42232

    Критический · CVSS 9.8EPSS 0,76%Есть исправление

    libceph: fix race between delayed_work() and ceph_monc_stop()

    In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e ("libceph: behave in mon_fault() if cur_mon < 0") and use-after-free

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. CVE-2024-42229

    Средний · CVSS 4.1EPSS 0,23%Есть исправление

    crypto: aead,cipher - zeroize key buffer after use

    In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key.

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  7. CVE-2024-42228

    Высокий · CVSS 7EPSS 0,24%Есть исправление

    drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian)

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1073.82~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  8. CVE-2024-42225

    Высокий · CVSS 8.3EPSS 0,53%Есть исправление

    wifi: mt76: replace skb_put with skb_put_zero

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  9. CVE-2024-42224

    Высокий · CVSS 7EPSS 0,24%Есть исправление

    net: dsa: mv88e6xxx: Correct check for empty list

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Correct check for empty list Since commit a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") mv88e6xxx_default_mdio_bus() has checked that the return value of list_first_entry() is non-NULL. This appears to be intended to guard against the list chip->mdios being empty. However, it is not the correct check as the implementation of list_first_entry is not designed to return NULL for empty lists. Instead, use list_first_entry_or_null() which does return NULL if the list is empty. Flagged by Smatch. Compile tested only.

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  10. CVE-2024-42223

    Средний · CVSS 5.5EPSS 0,23%Есть исправление

    media: dvb-frontends: tda10048: Fix integer overflow

    In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: tda10048: Fix integer overflow state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold the calculations.

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  11. CVE-2024-42161

    Средний · CVSS 6.3EPSS 0,22%Есть исправление

    bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD

    In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - Use a default branch in the switch statement to initialize `val'.] GCC warns that `val' may be used uninitialized in the BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as: [...] unsigned long long val; \ [...] \ switch (__CORE_RELO(s, field, BYTE_SIZE)) { \ case 1: val = *(const unsigned char *)p; break; \ case 2: val = *(const unsigned short *)p; break; \ case 4: val = *(const unsigned int *)p; break; \ case 8: val = *(cons

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2024-42160

    Высокий · CVSS 7.8EPSS 0,24%Есть исправление

    f2fs: check validation of fault attrs in f2fs_build_fault_attr()

    In the Linux kernel, the following vulnerability has been resolved: f2fs: check validation of fault attrs in f2fs_build_fault_attr() - It missed to check validation of fault attrs in parse_options(), let's fix to add check condition in f2fs_build_fault_attr(). - Use f2fs_build_fault_attr() in __sbi_store() to clean up code.

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1073.82~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  13. CVE-2024-42158

    Средний · CVSS 4.1EPSS 0,21%Есть исправление

    s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings

    In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings Replace memzero_explicit() and kfree() with kfree_sensitive() to fix warnings reported by Coccinelle: WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1506) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1643) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1770)

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1078.87~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2024-42157

    Средний · CVSS 4.8EPSS 0,22%Есть исправление

    s390/pkey: Wipe sensitive data on failure

    In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe sensitive data on failure Wipe sensitive data from stack also if the copy_to_user() fails.

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. CVE-2024-42156

    Средний · CVSS 4.1EPSS 0,21%Есть исправление

    s390/pkey: Wipe copies of clear-key structures on failure

    In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key.

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1078.87~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  16. CVE-2024-42154

    Средний · CVSS 4.8EPSS 0,26%Есть исправление

    tcp_metrics: validate source addr length

    In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated).

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  17. CVE-2024-42153

    Средний · CVSS 5.7EPSS 0,18%Есть исправление

    i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr

    In the Linux kernel, the following vulnerability has been resolved: i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr When del_timer_sync() is called in an interrupt context it throws a warning because of potential deadlock. The timer is used only to exit from wait_for_completion() after a timeout so replacing the call with wait_for_completion_timeout() allows to remove the problematic timer and its related functions altogether.

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  18. CVE-2024-42152

    Высокий · CVSS 7.5EPSS 0,73%Есть исправление

    nvmet: fix a possible leak when destroy a ctrl during qp establishment

    In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we know that a ctrl was allocated (in the admin connect request handler) and we need to release pending AERs, clear ctrl->sqs and sq->ctrl (for nvme-loop primarily), and drop the final reference on the ctrl. However, a small window is possible where nvmet_sq_destroy starts (as a result of the client giving up and disconnecting) concurrently with the nvme admin connect cmd (which may be in an early stage). But *before* kill_and_confirm o

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  19. CVE-2024-42148

    Высокий · CVSS 7.8EPSS 0,26%Есть исправление

    bnx2x: Fix multiple UBSAN array-index-out-of-bounds

    In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. Currently there is a read/write out of bounds that occurs on the array "struct stats_query_entry query" present inside the "bnx2x_fw_stats_req" struct in "drivers/net/ethernet/broadcom/bnx2x/bnx2x.h". Looking at the definition of the "struct stats_query_entry query" array: struct stats_query_entry query[FP_S

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  20. CVE-2024-42145

    Высокий · CVSS 7.5EPSS 0,87%Есть исправление

    IB/core: Implement a limit on UMAD receive List

    In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List The existing behavior of ib_umad, which maintains received MAD packets in an unbounded list, poses a risk of uncontrolled growth. As user-space applications extract packets from this list, the rate of extraction may not match the rate of incoming packets, leading to potential list overflow. To address this, we introduce a limit to the size of the list. After considering typical scenarios, such as OpenSM processing, which can handle approximately 100k packets per second, and the 1-second retry timeout for most packets, we set

    linux-azure-5.15Операционные системы
    • Обновитесь до 5.15.0-1072.81~20.04.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →