kernel

Vulnerabilities (14,119)

• CVE-2023-52445HigFeb 22, 2024
  affected >= 2.6.26, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on t

• CVE-2023-52444HigFeb 22, 2024
  affected >= 4.2.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_p

• CVE-2023-52443MedFeb 22, 2024
  affected >= 4.11.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string

• CVE-2024-26585CriFeb 21, 2024
  affected >= 4.20.0, < 5.15.165fixed 5.15.165

  In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling

• CVE-2024-26584CriFeb 21, 2024
  affected >= 4.16.0, < 5.15.160fixed 5.15.160

  In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRES

• CVE-2024-26583CriFeb 21, 2024
  affected >= 5.7.0, < 5.15.160fixed 5.15.160

  In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touch

• CVE-2024-26582CriFeb 21, 2024
  affected >= 6.0.0, < 6.1.79fixed 6.1.79

  In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and we trigger a use-a

• CVE-2023-52442CriFeb 21, 2024
  affected >= 5.15.0, < 5.15.145fixed 5.15.145

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB

• CVE-2023-52441CriFeb 21, 2024
  affected < 5.15.145fixed 5.15.145

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false.

• CVE-2023-52440CriFeb 21, 2024
  affected >= 5.17.0, < 6.1.52fixed 6.1.52

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy t

• CVE-2023-52439HigFeb 20, 2024
  affected >= 4.18.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev-

• CVE-2023-52438HigFeb 20, 2024
  affected >= 4.20.0, < 5.4.268fixed 5.4.268

  In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283

• CVE-2023-52436HigFeb 20, 2024
  affected >= 3.8.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed.

• CVE-2023-52435MedFeb 20, 2024
  affected >= 4.8.0, < 4.19.321fixed 4.19.321

  In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a forbidden value, but unfortunately the following computation in skb_segment() can

• CVE-2023-52434HigFeb 20, 2024
  affected >= 3.7.0, < 5.4.277fixed 5.4.277

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create cont

• CVE-2024-26581HigFeb 20, 2024
  affected < 5.4.269fixed 5.4.269

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip end interval element from gc rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval elements that are not

• CVE-2023-52433HigFeb 20, 2024
  affected >= 6.5.0, < 6.5.4fixed 6.5.4

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path mig

• CVE-2022-3786HigNov 1, 2022
  affected >= b653db77350c7307a513b81856fe53e94cf42446

  A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue ce

• CVE-2022-3602HigNov 1, 2022
  affected >= b653db77350c7307a513b81856fe53e94cf42446

  A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue