p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости linux-azure-fips · Страница 167

За последние 30 дней в linux-azure-fips опубликовано уязвимостей: 396; в каталоге KEV: 0.

Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 6791

  1. CVE-2022-50415

    Средний · CVSS 5.5EPSS 0,17%Нет опубликованного исправления

    parisc: led: Fix potential null-ptr-deref in start_task()

    In the Linux kernel, the following vulnerability has been resolved: parisc: led: Fix potential null-ptr-deref in start_task() start_task() calls create_singlethread_workqueue() and not checked the ret value, which may return NULL. And a null-ptr-deref may happen: start_task() create_singlethread_workqueue() # failed, led_wq is NULL queue_delayed_work() queue_delayed_work_on() __queue_delayed_work() # warning here, but continue __queue_work() # access wq->flags, null-ptr-deref Check the ret value and return -ENOMEM if it is NULL.

    Опубликовано Обновлено
  2. CVE-2022-50414

    Средний · CVSS 5.5EPSS 0,16%Нет опубликованного исправления

    scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails

    In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport), but when fcoe_if_init() fails, &fcoe_sw_transport is not detached and leaves freed &fcoe_sw_transport on fcoe_transports list. This causes panic when reinserting module. BUG: unable to handle page fault for address: fffffbfff82e2213 RIP: 0010:fcoe_transport_attach+0xe1/0x230 [libfcoe] Call Trace: <TASK> do_one_initcall+0xd0/0x4e0 load_module+0x5eee/0x7210 ...

    Опубликовано Обновлено
  3. CVE-2022-50412

    Высокий · CVSS 7.8EPSS 0,18%Нет опубликованного исправления

    drm: bridge: adv7511: unregister cec i2c device after cec adapter

    In the Linux kernel, the following vulnerability has been resolved: drm: bridge: adv7511: unregister cec i2c device after cec adapter cec_unregister_adapter() assumes that the underlying adapter ops are callable. For example, if the CEC adapter currently has a valid physical address, then the unregistration procedure will invalidate the physical address by setting it to f.f.f.f. Whence the following kernel oops observed after removing the adv7511 module: Unable to handle kernel execution of user memory at virtual address 0000000000000000 Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP Call trace: 0x0 adv7511_cec_ad

    Опубликовано Обновлено
  4. CVE-2022-50411

    Высокий · CVSS 7.8EPSS 0,17%Нет опубликованного исправления

    ACPICA: Fix error code path in acpi_ds_call_control_method()

    In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop

    Опубликовано Обновлено
  5. CVE-2022-50410

    Критический · CVSS 9.8EPSS 0,43%Нет опубликованного исправления

    NFSD: Protect against send buffer overflow in NFSv2 READ

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC reco

    Опубликовано Обновлено
  6. CVE-2022-50408

    Высокий · CVSS 7.8EPSS 0,16%Нет опубликованного исправления

    wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.tx_bytes += skb->len; [ 46.912801] ================================================================== [ 46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328 [ 46.935991] [ 46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G O 5.4.199-[RE

    Опубликовано Обновлено
  7. CVE-2022-50406

    Высокий · CVSS 7.8EPSS 0,17%Нет опубликованного исправления

    iomap: iomap: fix memory corruption when recording errors during writeback

    In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev dm-0, logical block 8733687, async page read Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000 [00000000000000

    Опубликовано Обновлено
  8. CVE-2022-50405

    Высокий · CVSS 7.8EPSS 0,18%Нет опубликованного исправления

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock

    In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all sk_user_data reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after getting vxlan_sock vs from sk_user_data. Then in later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got NULL pointer dereference. e.g. #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757 #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48 #3 [ffffa25ec6978b60] oops

    Опубликовано Обновлено
  9. CVE-2022-50402

    Средний · CVSS 5.5EPSS 0,16%Нет опубликованного исправления

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()

    In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() Check the return value of md_bitmap_get_counter() in case it returns NULL pointer, which will result in a null pointer dereference. v2: update the check to include other dereference

    Опубликовано Обновлено
  10. CVE-2023-53400

    Средний · CVSS 5.5EPSS 0,15%Нет опубликованного исправления

    ALSA: hda: Fix Oops by 9.1 surround channel names

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec. As a workaround, extend for the 9.1 channels and also fix the potential Oops by unifying the code paths accessing the same array with the proper size check.

    Опубликовано Обновлено
  11. CVE-2023-53397

    Средний · CVSS 5.5EPSS 0,15%Нет опубликованного исправления

    modpost: fix off by one in is_executable_section()

    In the Linux kernel, the following vulnerability has been resolved: modpost: fix off by one in is_executable_section() The > comparison should be >= to prevent an out of bounds array access.

    Опубликовано Обновлено
  12. CVE-2023-53395

    Высокий · CVSS 7.8EPSS 0,16%Нет опубликованного исправления

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer

    In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5 According to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AML_NO_OPERAND_RESOLVE flag is added to ASL Timer instruction opcode. When ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AML_NO_OPERAND_RESOLVE flag to ASL Timer instruction opcode, issue is not observed. ============================================================= UBSAN: array-index-out-of-b

    Опубликовано Обновлено
  13. CVE-2023-53391

    Средний · CVSS 5.5EPSS 0,15%Нет опубликованного исправления

    shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs

    In the Linux kernel, the following vulnerability has been resolved: shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs As the ramfs-based tmpfs uses ramfs_init_fs_context() for the init_fs_context method, which allocates fc->s_fs_info, use ramfs_kill_sb() to free it and avoid a memory leak.

    Опубликовано Обновлено
  14. CVE-2023-53388

    Высокий · CVSS 7.8EPSS 0,16%Нет опубликованного исправления

    drm/mediatek: Clean dangling pointer on bind error path

    In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Clean dangling pointer on bind error path mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that point, resulting in a panic. Clean the pointer when destroying the object in the error path to prevent this from happening.

    Опубликовано Обновлено
  15. CVE-2023-53384

    Средний · CVSS 5.5EPSS 0,15%Нет опубликованного исправления

    wifi: mwifiex: avoid possible NULL skb pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: avoid possible NULL skb pointer dereference In 'mwifiex_handle_uap_rx_forward()', always check the value returned by 'skb_copy()' to avoid potential NULL pointer dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop original skb in case of copying failure. Found by Linux Verification Center (linuxtesting.org) with SVACE.

    Опубликовано Обновлено
  16. CVE-2023-53383

    Средний · CVSS 5.5EPSS 0,15%Нет опубликованного исправления

    irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4

    In the Linux kernel, the following vulnerability has been resolved: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 The T241 platform suffers from the T241-FABRIC-4 erratum which causes unexpected behavior in the GIC when multiple transactions are received simultaneously from different sources. This hardware issue impacts NVIDIA server platforms that use more than two T241 chips interconnected. Each chip has support for 320 {E}SPIs. This issue occurs when multiple packets from different GICs are incorrectly interleaved at the target chip. The erratum text below specifies exactly what can cause multiple transfer packets susceptib

    Опубликовано Обновлено
  17. CVE-2023-53373

    Высокий · CVSS 7.8EPSS 0,17%Нет опубликованного исправления

    crypto: seqiv - Handle EBUSY correctly

    In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.

    Опубликовано Обновлено
  18. CVE-2023-53370

    Средний · CVSS 5.5EPSS 0,16%Нет опубликованного исправления

    drm/amdgpu: fix memory leak in mes self test

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix memory leak in mes self test The fences associated with mes queue have to be freed up during amdgpu_ring_fini.

    Опубликовано Обновлено
  19. CVE-2023-53369

    Средний · CVSS 5.5EPSS 0,18%Нет опубликованного исправления

    net: dcb: choose correct policy to parse DCB_ATTR_BCN

    In the Linux kernel, the following vulnerability has been resolved: net: dcb: choose correct policy to parse DCB_ATTR_BCN The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN], which is introduced in commit 859ee3c43812 ("DCB: Add support for DCB BCN"). Please see the comment in below code static int dcbnl_bcn_setcfg(...) { ... ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. ) // !!! dcbnl_pfc_up_nest for attributes // DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs ... for (i = DCB_BCN_ATTR_RP_0; i <= DCB_BCN_ATTR_RP_7; i++) { // !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in e

    Опубликовано Обновлено
  20. CVE-2022-50399

    Высокий · CVSS 7.8EPSS 0,17%Нет опубликованного исправления

    media: atomisp: prevent integer overflow in sh_css_set_black_frame()

    In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in sh_css_set_black_frame() The "height" and "width" values come from the user so the "height * width" multiplication can overflow.

    Опубликовано Обновлено

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →