almalinux/bpftool

Vulnerabilities (901)

• CVE-2024-42283MedAug 17, 2024
  affected < 7.4.0-503.14.1.el9_5fixed 7.4.0-503.14.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed e.g. with strace (e

• CVE-2024-42272MedAug 17, 2024
  affected < 7.3.0-427.40.1.el9_4fixed 7.3.0-427.40.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointer. Make sure rhashtable_lookup() is not

• CVE-2024-42322Aug 17, 2024
  affected < 4.18.0-553.22.1.el8_10fixed 4.18.0-553.22.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: ipvs: properly dereference pe in ip_vs_add_service Use pe directly to resolve sparse warning: net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression

• CVE-2024-42301Aug 17, 2024
  affected < 4.18.0-553.27.1.el8_10fixed 4.18.0-553.27.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: dev/parport: fix the array out-of-bounds risk Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not overflowed. Below i

• CVE-2024-42284Aug 17, 2024
  affected < 7.3.0-427.40.1.el9_4fixed 7.3.0-427.40.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_ad

• CVE-2024-42246Aug 7, 2024
  affected < 7.3.0-427.37.1.el9_4fixed 7.3.0-427.37.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to loop forever, filling

• CVE-2024-42244Aug 7, 2024
  affected < 7.4.0-503.15.1.el9_5fixed 7.4.0-503.15.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation

• CVE-2024-42240Aug 7, 2024
  affected < 4.18.0-553.22.1.el8_10fixed 4.18.0-553.22.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY and calls the clear

• CVE-2024-42238Aug 7, 2024
  affected < 4.18.0-553.22.1.el8_10fixed 4.18.0-553.22.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Return error if block header overflows file Return an error from cs_dsp_power_up() if a block header is longer than the amount of data left in the file. The previous code in cs_dsp_load() and

• CVE-2024-42237Aug 7, 2024
  affected < 4.18.0-553.22.1.el8_10fixed 4.18.0-553.22.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Validate payload length before processing block Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load() to be done before the block is processed. The check that the length of a

• CVE-2024-42114MedJul 30, 2024
  affected < 4.18.0-553.22.1.el8_10fixed 4.18.0-553.22.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit d9e15a273306 ("pkt_

• CVE-2024-42228Jul 30, 2024
  affected < 4.18.0-553.22.1.el8_10fixed 4.18.0-553.22.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually

• CVE-2024-42225Jul 30, 2024
  affected < 7.3.0-427.37.1.el9_4fixed 7.3.0-427.37.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data

• CVE-2024-42154Jul 30, 2024
  affected < 4.18.0-553.22.1.el8_10fixed 4.18.0-553.22.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it

• CVE-2024-42152Jul 30, 2024
  affected < 7.3.0-427.33.1.el9_4fixed 7.3.0-427.33.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we know that a ctrl was allocated (in the admin connect request handler

• CVE-2024-42131Jul 30, 2024
  affected < 7.3.0-427.35.1.el9_4fixed 7.3.0-427.35.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications fit into 64-bits).

• CVE-2024-42124Jul 30, 2024
  affected < 4.18.0-553.22.1.el8_10fixed 4.18.0-553.22.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Make qedf_execute_tmf() non-preemptible Stop calling smp_processor_id() from preemptible code in qedf_execute_tmf90. This results in BUG_ON() when running an RT kernel. [ 659.343280] BUG: using sm

• CVE-2024-42110Jul 30, 2024
  affected < 7.3.0-427.33.1.el9_4fixed 7.3.0-427.33.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() The following is emitted when using idxd (DSA) dmanegine as the data mover for ntb_transport that ntb_netdev uses. [74412.5469

• CVE-2024-42102Jul 30, 2024
  affected < 7.3.0-427.35.1.el9_4fixed 7.3.0-427.35.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in page units fit int

• CVE-2024-42096MedJul 29, 2024
  affected < 7.3.0-427.35.1.el9_4fixed 7.3.0-427.35.1.el9_4

  In the Linux kernel, the following vulnerability has been resolved: x86: stop playing stack games in profile_pc() The 'profile_pc()' function is used for timer-based profiling, which isn't really all that relevant any more to begin with, but it also ends up making assumptions b