VARIoT IoT vulnerabilities database

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly. Linux of Linux Kernel Exists in unspecified vulnerabilities.Service operation interruption (DoS) It may be in a state. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server

In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Linux of Linux Kernel Products from multiple vendors, such as the following, contain vulnerabilities related to double frees.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server. ========================================================================== Ubuntu Security Notice USN-6972-1 August 21, 2024 linux, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-kvm: Linux kernel for cloud environments - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-hwe: Linux hardware enablement (HWE) kernel Details: Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099) It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SuperH RISC architecture; - User-Mode Linux (UML); - GPU drivers; - MMC subsystem; - Network drivers; - PHY drivers; - Pin controllers subsystem; - Xen hypervisor drivers; - GFS2 file system; - Core kernel; - Bluetooth subsystem; - IPv4 networking; - IPv6 networking; - HD-audio driver; - ALSA SH drivers; (CVE-2024-26903, CVE-2024-35835, CVE-2023-52644, CVE-2024-39292, CVE-2024-36940, CVE-2024-26600, CVE-2023-52629, CVE-2024-35955, CVE-2023-52760, CVE-2023-52806, CVE-2024-39484, CVE-2024-26679, CVE-2024-26654, CVE-2024-36901, CVE-2024-26687, CVE-2023-52470) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS linux-image-4.15.0-1155-kvm 4.15.0-1155.160 Available with Ubuntu Pro linux-image-4.15.0-1165-gcp 4.15.0-1165.182 Available with Ubuntu Pro linux-image-4.15.0-228-generic 4.15.0-228.240 Available with Ubuntu Pro linux-image-4.15.0-228-lowlatency 4.15.0-228.240 Available with Ubuntu Pro linux-image-gcp-lts-18.04 4.15.0.1165.178 Available with Ubuntu Pro linux-image-generic 4.15.0.228.212 Available with Ubuntu Pro linux-image-kvm 4.15.0.1155.146 Available with Ubuntu Pro linux-image-lowlatency 4.15.0.228.212 Available with Ubuntu Pro linux-image-virtual 4.15.0.228.212 Available with Ubuntu Pro Ubuntu 16.04 LTS linux-image-4.15.0-1165-gcp 4.15.0-1165.182~16.04.1 Available with Ubuntu Pro linux-image-4.15.0-228-generic 4.15.0-228.240~16.04.1 Available with Ubuntu Pro linux-image-4.15.0-228-lowlatency 4.15.0-228.240~16.04.1 Available with Ubuntu Pro linux-image-gcp 4.15.0.1165.182~16.04.1 Available with Ubuntu Pro linux-image-generic-hwe-16.04 4.15.0.228.240~16.04.1 Available with Ubuntu Pro linux-image-gke 4.15.0.1165.182~16.04.1 Available with Ubuntu Pro linux-image-lowlatency-hwe-16.04 4.15.0.228.240~16.04.1 Available with Ubuntu Pro linux-image-oem 4.15.0.228.240~16.04.1 Available with Ubuntu Pro linux-image-virtual-hwe-16.04 4.15.0.228.240~16.04.1 Available with Ubuntu Pro After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6972-1 CVE-2023-52470, CVE-2023-52629, CVE-2023-52644, CVE-2023-52760, CVE-2023-52806, CVE-2024-22099, CVE-2024-24860, CVE-2024-26600, CVE-2024-26654, CVE-2024-26679, CVE-2024-26687, CVE-2024-26903, CVE-2024-35835, CVE-2024-35955, CVE-2024-36901, CVE-2024-36940, CVE-2024-39292, CVE-2024-39484

In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_copy_expand, in order to prevent a crash on a potential later call to skb_gso_segment. Information handled by the software will not be rewritten. In addition, the software may stop functioning completely. Furthermore, attacks that exploit this vulnerability will not affect other software. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server. ========================================================================== Ubuntu Security Notice USN-6950-1 August 08, 2024 linux, linux-aws, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-gke: Linux kernel for Google Container Engine (GKE) systems - linux-gkeop: Linux kernel for Google Container Engine (GKE) systems - linux-intel-iotg: Linux kernel for Intel IoT platforms - linux-kvm: Linux kernel for cloud environments - linux-lowlatency: Linux low latency kernel - linux-nvidia: Linux kernel for NVIDIA systems - linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-intel-iotg-5.15: Linux kernel for Intel IoT platforms - linux-lowlatency-hwe-5.15: Linux low latency kernel Details: Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - Block layer subsystem; - Bluetooth drivers; - Clock framework and drivers; - FireWire subsystem; - GPU drivers; - InfiniBand drivers; - Multiple devices driver; - EEPROM drivers; - Network drivers; - Pin controllers subsystem; - Remote Processor subsystem; - S/390 drivers; - SCSI drivers; - 9P distributed file system; - Network file system client; - SMB network file system; - Socket messages infrastructure; - Dynamic debug library; - Bluetooth subsystem; - Networking core; - IPv4 networking; - IPv6 networking; - Multipath TCP; - NSH protocol; - Phonet protocol; - TIPC protocol; - Wireless networking; - Key management; - ALSA framework; - HD-audio driver; (CVE-2024-36883, CVE-2024-36940, CVE-2024-36902, CVE-2024-36975, CVE-2024-36964, CVE-2024-36938, CVE-2024-36931, CVE-2024-35848, CVE-2024-26900, CVE-2024-36967, CVE-2024-36904, CVE-2024-27398, CVE-2024-36031, CVE-2023-52585, CVE-2024-36886, CVE-2024-36937, CVE-2024-36954, CVE-2024-36916, CVE-2024-36905, CVE-2024-36959, CVE-2024-26980, CVE-2024-26936, CVE-2024-36928, CVE-2024-36889, CVE-2024-36929, CVE-2024-36933, CVE-2024-27399, CVE-2024-36946, CVE-2024-36906, CVE-2024-36965, CVE-2024-36957, CVE-2024-36941, CVE-2024-36897, CVE-2024-36952, CVE-2024-36947, CVE-2024-36950, CVE-2024-36880, CVE-2024-36017, CVE-2023-52882, CVE-2024-36969, CVE-2024-38600, CVE-2024-36955, CVE-2024-36960, CVE-2024-27401, CVE-2024-36919, CVE-2024-36934, CVE-2024-35947, CVE-2024-36953, CVE-2024-36944, CVE-2024-36939) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS linux-image-5.15.0-1050-gkeop 5.15.0-1050.57 linux-image-5.15.0-1062-intel-iotg 5.15.0-1062.68 linux-image-5.15.0-1062-nvidia 5.15.0-1062.63 linux-image-5.15.0-1062-nvidia-lowlatency 5.15.0-1062.63 linux-image-5.15.0-1064-gke 5.15.0-1064.70 linux-image-5.15.0-1064-kvm 5.15.0-1064.69 linux-image-5.15.0-1066-gcp 5.15.0-1066.74 linux-image-5.15.0-1067-aws 5.15.0-1067.73 linux-image-5.15.0-118-generic 5.15.0-118.128 linux-image-5.15.0-118-generic-64k 5.15.0-118.128 linux-image-5.15.0-118-generic-lpae 5.15.0-118.128 linux-image-5.15.0-118-lowlatency 5.15.0-118.128 linux-image-5.15.0-118-lowlatency-64k 5.15.0-118.128 linux-image-aws-lts-22.04 5.15.0.1067.67 linux-image-gcp-lts-22.04 5.15.0.1066.62 linux-image-generic 5.15.0.118.118 linux-image-generic-64k 5.15.0.118.118 linux-image-generic-lpae 5.15.0.118.118 linux-image-gke 5.15.0.1064.63 linux-image-gke-5.15 5.15.0.1064.63 linux-image-gkeop 5.15.0.1050.49 linux-image-gkeop-5.15 5.15.0.1050.49 linux-image-intel-iotg 5.15.0.1062.62 linux-image-kvm 5.15.0.1064.60 linux-image-lowlatency 5.15.0.118.108 linux-image-lowlatency-64k 5.15.0.118.108 linux-image-nvidia 5.15.0.1062.62 linux-image-nvidia-lowlatency 5.15.0.1062.62 linux-image-virtual 5.15.0.118.118 Ubuntu 20.04 LTS linux-image-5.15.0-1062-intel-iotg 5.15.0-1062.68~20.04.1 linux-image-5.15.0-1066-gcp 5.15.0-1066.74~20.04.1 linux-image-5.15.0-118-lowlatency 5.15.0-118.128~20.04.1 linux-image-5.15.0-118-lowlatency-64k 5.15.0-118.128~20.04.1 linux-image-gcp 5.15.0.1066.74~20.04.1 linux-image-intel 5.15.0.1062.68~20.04.1 linux-image-intel-iotg 5.15.0.1062.68~20.04.1 linux-image-lowlatency-64k-hwe-20.04 5.15.0.118.128~20.04.1 linux-image-lowlatency-hwe-20.04 5.15.0.118.128~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6950-1 CVE-2023-52585, CVE-2023-52882, CVE-2024-26900, CVE-2024-26936, CVE-2024-26980, CVE-2024-27398, CVE-2024-27399, CVE-2024-27401, CVE-2024-35848, CVE-2024-35947, CVE-2024-36017, CVE-2024-36031, CVE-2024-36880, CVE-2024-36883, CVE-2024-36886, CVE-2024-36889, CVE-2024-36897, CVE-2024-36902, CVE-2024-36904, CVE-2024-36905, CVE-2024-36906, CVE-2024-36916, CVE-2024-36919, CVE-2024-36928, CVE-2024-36929, CVE-2024-36931, CVE-2024-36933, CVE-2024-36934, CVE-2024-36937, CVE-2024-36938, CVE-2024-36939, CVE-2024-36940, CVE-2024-36941, CVE-2024-36944, CVE-2024-36946, CVE-2024-36947, CVE-2024-36950, CVE-2024-36952, CVE-2024-36953, CVE-2024-36954, CVE-2024-36955, CVE-2024-36957, CVE-2024-36959, CVE-2024-36960, CVE-2024-36964, CVE-2024-36965, CVE-2024-36967, CVE-2024-36969, CVE-2024-36975, CVE-2024-38600 Package Information: https://launchpad.net/ubuntu/+source/linux/5.15.0-118.128 https://launchpad.net/ubuntu/+source/linux-aws/5.15.0-1067.73 https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1066.74 https://launchpad.net/ubuntu/+source/linux-gke/5.15.0-1064.70 https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1050.57 https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1062.68 https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1064.69 https://launchpad.net/ubuntu/+source/linux-lowlatency/5.15.0-118.128 https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1062.63 https://launchpad.net/ubuntu/+source/linux-gcp-5.15/5.15.0-1066.74~20.04.1 https://launchpad.net/ubuntu/+source/linux-intel-iotg-5.15/5.15.0-1062.68~20.04.1 https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-5.15/5.15.0-118.128~20.04.1

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: avoid out of bounds shift UBSAN catches undefined behavior in blk-iocost, where sometimes iocg->delay is shifted right by a number that is too large, resulting in undefined behavior on some architectures. [ 186.556576] ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') CPU: 16 PID: 0 Comm: swapper/16 Tainted: G S E N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1 Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020 Call Trace: <IRQ> dump_stack_lvl+0x8f/0xe0 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 iocg_kick_delay+0x30b/0x310 ioc_timer_fn+0x2fb/0x1f80 __run_timer_base+0x1b6/0x250 ... Avoid that undefined behavior by simply taking the "delay = 0" branch if the shift is too large. I am not sure what the symptoms of an undefined value delay will be, but I suspect it could be more than a little annoying to debug. [ 186.556576] ------------[ cut here ]------------ UBSAN: block/blk-iocost.c:1366:23 Out of shift range. shift index 64 teeth 64 Bit type 'u64'( alias 'unsigned long long') It's too big for that. delay The exact symptoms this causes are unknown, but we believe it can cause some pretty nasty debugging issues.All information handled by the software may be leaked to the outside. Furthermore, information handled by the software will not be rewritten. Furthermore, the software may stop functioning completely. Furthermore, attacks exploiting this vulnerability will not affect other software. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server. ========================================================================== Ubuntu Security Notice USN-6950-1 August 08, 2024 linux, linux-aws, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-gke: Linux kernel for Google Container Engine (GKE) systems - linux-gkeop: Linux kernel for Google Container Engine (GKE) systems - linux-intel-iotg: Linux kernel for Intel IoT platforms - linux-kvm: Linux kernel for cloud environments - linux-lowlatency: Linux low latency kernel - linux-nvidia: Linux kernel for NVIDIA systems - linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-intel-iotg-5.15: Linux kernel for Intel IoT platforms - linux-lowlatency-hwe-5.15: Linux low latency kernel Details: Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - Block layer subsystem; - Bluetooth drivers; - Clock framework and drivers; - FireWire subsystem; - GPU drivers; - InfiniBand drivers; - Multiple devices driver; - EEPROM drivers; - Network drivers; - Pin controllers subsystem; - Remote Processor subsystem; - S/390 drivers; - SCSI drivers; - 9P distributed file system; - Network file system client; - SMB network file system; - Socket messages infrastructure; - Dynamic debug library; - Bluetooth subsystem; - Networking core; - IPv4 networking; - IPv6 networking; - Multipath TCP; - NSH protocol; - Phonet protocol; - TIPC protocol; - Wireless networking; - Key management; - ALSA framework; - HD-audio driver; (CVE-2024-36883, CVE-2024-36940, CVE-2024-36902, CVE-2024-36975, CVE-2024-36964, CVE-2024-36938, CVE-2024-36931, CVE-2024-35848, CVE-2024-26900, CVE-2024-36967, CVE-2024-36904, CVE-2024-27398, CVE-2024-36031, CVE-2023-52585, CVE-2024-36886, CVE-2024-36937, CVE-2024-36954, CVE-2024-36916, CVE-2024-36905, CVE-2024-36959, CVE-2024-26980, CVE-2024-26936, CVE-2024-36928, CVE-2024-36889, CVE-2024-36929, CVE-2024-36933, CVE-2024-27399, CVE-2024-36946, CVE-2024-36906, CVE-2024-36965, CVE-2024-36957, CVE-2024-36941, CVE-2024-36897, CVE-2024-36952, CVE-2024-36947, CVE-2024-36950, CVE-2024-36880, CVE-2024-36017, CVE-2023-52882, CVE-2024-36969, CVE-2024-38600, CVE-2024-36955, CVE-2024-36960, CVE-2024-27401, CVE-2024-36919, CVE-2024-36934, CVE-2024-35947, CVE-2024-36953, CVE-2024-36944, CVE-2024-36939) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS linux-image-5.15.0-1050-gkeop 5.15.0-1050.57 linux-image-5.15.0-1062-intel-iotg 5.15.0-1062.68 linux-image-5.15.0-1062-nvidia 5.15.0-1062.63 linux-image-5.15.0-1062-nvidia-lowlatency 5.15.0-1062.63 linux-image-5.15.0-1064-gke 5.15.0-1064.70 linux-image-5.15.0-1064-kvm 5.15.0-1064.69 linux-image-5.15.0-1066-gcp 5.15.0-1066.74 linux-image-5.15.0-1067-aws 5.15.0-1067.73 linux-image-5.15.0-118-generic 5.15.0-118.128 linux-image-5.15.0-118-generic-64k 5.15.0-118.128 linux-image-5.15.0-118-generic-lpae 5.15.0-118.128 linux-image-5.15.0-118-lowlatency 5.15.0-118.128 linux-image-5.15.0-118-lowlatency-64k 5.15.0-118.128 linux-image-aws-lts-22.04 5.15.0.1067.67 linux-image-gcp-lts-22.04 5.15.0.1066.62 linux-image-generic 5.15.0.118.118 linux-image-generic-64k 5.15.0.118.118 linux-image-generic-lpae 5.15.0.118.118 linux-image-gke 5.15.0.1064.63 linux-image-gke-5.15 5.15.0.1064.63 linux-image-gkeop 5.15.0.1050.49 linux-image-gkeop-5.15 5.15.0.1050.49 linux-image-intel-iotg 5.15.0.1062.62 linux-image-kvm 5.15.0.1064.60 linux-image-lowlatency 5.15.0.118.108 linux-image-lowlatency-64k 5.15.0.118.108 linux-image-nvidia 5.15.0.1062.62 linux-image-nvidia-lowlatency 5.15.0.1062.62 linux-image-virtual 5.15.0.118.118 Ubuntu 20.04 LTS linux-image-5.15.0-1062-intel-iotg 5.15.0-1062.68~20.04.1 linux-image-5.15.0-1066-gcp 5.15.0-1066.74~20.04.1 linux-image-5.15.0-118-lowlatency 5.15.0-118.128~20.04.1 linux-image-5.15.0-118-lowlatency-64k 5.15.0-118.128~20.04.1 linux-image-gcp 5.15.0.1066.74~20.04.1 linux-image-intel 5.15.0.1062.68~20.04.1 linux-image-intel-iotg 5.15.0.1062.68~20.04.1 linux-image-lowlatency-64k-hwe-20.04 5.15.0.118.128~20.04.1 linux-image-lowlatency-hwe-20.04 5.15.0.118.128~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6950-1 CVE-2023-52585, CVE-2023-52882, CVE-2024-26900, CVE-2024-26936, CVE-2024-26980, CVE-2024-27398, CVE-2024-27399, CVE-2024-27401, CVE-2024-35848, CVE-2024-35947, CVE-2024-36017, CVE-2024-36031, CVE-2024-36880, CVE-2024-36883, CVE-2024-36886, CVE-2024-36889, CVE-2024-36897, CVE-2024-36902, CVE-2024-36904, CVE-2024-36905, CVE-2024-36906, CVE-2024-36916, CVE-2024-36919, CVE-2024-36928, CVE-2024-36929, CVE-2024-36931, CVE-2024-36933, CVE-2024-36934, CVE-2024-36937, CVE-2024-36938, CVE-2024-36939, CVE-2024-36940, CVE-2024-36941, CVE-2024-36944, CVE-2024-36946, CVE-2024-36947, CVE-2024-36950, CVE-2024-36952, CVE-2024-36953, CVE-2024-36954, CVE-2024-36955, CVE-2024-36957, CVE-2024-36959, CVE-2024-36960, CVE-2024-36964, CVE-2024-36965, CVE-2024-36967, CVE-2024-36969, CVE-2024-36975, CVE-2024-38600 Package Information: https://launchpad.net/ubuntu/+source/linux/5.15.0-118.128 https://launchpad.net/ubuntu/+source/linux-aws/5.15.0-1067.73 https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1066.74 https://launchpad.net/ubuntu/+source/linux-gke/5.15.0-1064.70 https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1050.57 https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1062.68 https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1064.69 https://launchpad.net/ubuntu/+source/linux-lowlatency/5.15.0-118.128 https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1062.63 https://launchpad.net/ubuntu/+source/linux-gcp-5.15/5.15.0-1066.74~20.04.1 https://launchpad.net/ubuntu/+source/linux-intel-iotg-5.15/5.15.0-1062.68~20.04.1 https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-5.15/5.15.0-118.128~20.04.1

In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1], syzbot managed to trigger a divide by zero in tcp_rcv_space_adjust() A socket makes the following state transitions, without ever calling tcp_init_transfer(), meaning tcp_init_buffer_space() is also not called. TCP_CLOSE connect() TCP_SYN_SENT TCP_SYN_RECV shutdown() -> tcp_shutdown(sk, SEND_SHUTDOWN) TCP_FIN_WAIT1 To fix this issue, change tcp_shutdown() to not perform a TCP_SYN_RECV -> TCP_FIN_WAIT1 transition, which makes no sense anyway. When tcp_rcv_state_process() later changes socket state from TCP_SYN_RECV to TCP_ESTABLISH, then look at sk->sk_shutdown to finally enter TCP_FIN_WAIT1 state, and send a FIN packet from a sane socket state. This means tcp_send_fin() can now be called from BH context, and must use GFP_ATOMIC allocations. [1] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 PID: 5084 Comm: syz-executor358 Not tainted 6.9.0-rc6-syzkaller-00022-g98369dccd2f8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:tcp_rcv_space_adjust+0x2df/0x890 net/ipv4/tcp_input.c:767 Code: e3 04 4c 01 eb 48 8b 44 24 38 0f b6 04 10 84 c0 49 89 d5 0f 85 a5 03 00 00 41 8b 8e c8 09 00 00 89 e8 29 c8 48 0f af c3 31 d2 <48> f7 f1 48 8d 1c 43 49 8d 96 76 08 00 00 48 89 d0 48 c1 e8 03 48 RSP: 0018:ffffc900031ef3f0 EFLAGS: 00010246 RAX: 0c677a10441f8f42 RBX: 000000004fb95e7e RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000027d4b11f R08: ffffffff89e535a4 R09: 1ffffffff25e6ab7 R10: dffffc0000000000 R11: ffffffff8135e920 R12: ffff88802a9f8d30 R13: dffffc0000000000 R14: ffff88802a9f8d00 R15: 1ffff1100553f2da FS: 00005555775c0380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1155bf2304 CR3: 000000002b9f2000 CR4: 0000000000350ef0 Call Trace: <TASK> tcp_recvmsg_locked+0x106d/0x25a0 net/ipv4/tcp.c:2513 tcp_recvmsg+0x25d/0x920 net/ipv4/tcp.c:2578 inet6_recvmsg+0x16a/0x730 net/ipv6/af_inet6.c:680 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1068 ____sys_recvmsg+0x1db/0x470 net/socket.c:2803 ___sys_recvmsg net/socket.c:2845 [inline] do_recvmmsg+0x474/0xae0 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faeb6363db9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcc1997168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faeb6363db9 RDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000001c R10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001. TCP_SYN_RECV Incorrect shutdown processing for a socket in the SEND_SHUTDOWN ) is delayed, causing the socket in this state to transition without being properly initialized, ultimately resulting in a division-by-zero crash. tcp_shutdown() The function TCP_SYN_RECV from TCP_FIN_WAIT1 This fix corrects the socket state management and prevents an attacker from causing a denial of service ( DoS ) reduces the risk of attack.Information handled by the software will not be leaked to the outside. Information handled by the software will not be rewritten. In addition, the software may stop functioning completely. Furthermore, attacks that exploit this vulnerability will not affect other software. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server

In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's sk_refcnt after putting it into ehash and releasing the bucket lock. Thus, there is a small race window where other threads could try to reuse the port during connect() and call sock_hold() in tcp_twsk_unique() for the TIME-WAIT socket with zero refcnt. If that happens, the refcnt taken by tcp_twsk_unique() is overwritten and sock_put() will cause underflow, triggering a real use-after-free somewhere else. To avoid the use-after-free, we need to use refcount_inc_not_zero() in tcp_twsk_unique() and give up on reusing the port if it returns false. [0]: refcount_t: addition on 0; use-after-free. WARNING: CPU: 0 PID: 1039313 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110 CPU: 0 PID: 1039313 Comm: trigger Not tainted 6.8.6-200.fc39.x86_64 #1 Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.21805430.B64.2305221830 05/22/2023 RIP: 0010:refcount_warn_saturate+0xe5/0x110 Code: 42 8e ff 0f 0b c3 cc cc cc cc 80 3d aa 13 ea 01 00 0f 85 5e ff ff ff 48 c7 c7 f8 8e b7 82 c6 05 96 13 ea 01 01 e8 7b 42 8e ff <0f> 0b c3 cc cc cc cc 48 c7 c7 50 8f b7 82 c6 05 7a 13 ea 01 01 e8 RSP: 0018:ffffc90006b43b60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888009bb3ef0 RCX: 0000000000000027 RDX: ffff88807be218c8 RSI: 0000000000000001 RDI: ffff88807be218c0 RBP: 0000000000069d70 R08: 0000000000000000 R09: ffffc90006b439f0 R10: ffffc90006b439e8 R11: 0000000000000003 R12: ffff8880029ede84 R13: 0000000000004e20 R14: ffffffff84356dc0 R15: ffff888009bb3ef0 FS: 00007f62c10926c0(0000) GS:ffff88807be00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020ccb000 CR3: 000000004628c005 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <TASK> ? refcount_warn_saturate+0xe5/0x110 ? __warn+0x81/0x130 ? refcount_warn_saturate+0xe5/0x110 ? report_bug+0x171/0x1a0 ? refcount_warn_saturate+0xe5/0x110 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? refcount_warn_saturate+0xe5/0x110 tcp_twsk_unique+0x186/0x190 __inet_check_established+0x176/0x2d0 __inet_hash_connect+0x74/0x7d0 ? __pfx___inet_check_established+0x10/0x10 tcp_v4_connect+0x278/0x530 __inet_stream_connect+0x10f/0x3d0 inet_stream_connect+0x3a/0x60 __sys_connect+0xa8/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0x83/0x170 entry_SYSCALL_64_after_hwframe+0x78/0x80 RIP: 0033:0x7f62c11a885d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a3 45 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007f62c1091e58 EFLAGS: 00000296 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000020ccb004 RCX: 00007f62c11a885d RDX: 0000000000000010 RSI: 0000000020ccb000 RDI: 0000000000000003 RBP: 00007f62c1091e90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 00007f62c10926c0 R13: ffffffffffffff88 R14: 0000000000000000 R15: 00007ffe237885b0 </TASK>. ec94c2696f0b (( "tcp/dccp: timewait for hash dance 1 Avoid atomic operations " )onwards, inet_twsk_hashdance() teeth TIME-WAIT Socket ehash After releasing the bucket lock sk_refcnt Therefore, connect() Another thread tries to reuse the port during refcnt But 0 of TIME-WAIT For sockets tcp_twsk_unique() Within sock_hold() There is a small race condition that can call tcp_twsk_unique() Obtained at refcnt is overwritten, sock_put() causes underflow, and elsewhere the actual Use-after-free induces. [0]: refcount_t: 0 By adding to use-after-free occurs. The version is 6.8.6-200.fc39.x86_64 #1 The hardware name is VMware, Inc. VMware20,1/440BX Desktop Reference Platform in, BIOS teeth VMW201.00V.21805430.B64.2305221830 (( 2023 Year 5 Moon 22 (Sun). RIP teeth 0010:refcount_warn_saturate+0xe5/0x110 The following is omitted, but there is a detailed call trace etc.All information handled by the software may be leaked to the outside. All information handled by the software may be rewritten. Furthermore, the software may stop working completely. Furthermore, attacks that exploit this vulnerability will not affect other software. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() syzbot is able to trigger the following crash [1], caused by unsafe ip6_dst_idev() use. Indeed ip6_dst_idev() can return NULL, and must always be checked. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline] RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267 Code: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c RSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700 RDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760 RBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd R10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000 R13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00 FS: 00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317 fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108 ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline] ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649 ip6_route_output include/net/ip6_route.h:93 [inline] ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120 ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250 sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326 sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455 sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662 sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099 __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197 sctp_connect net/sctp/socket.c:4819 [inline] sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834 __sys_connect_file net/socket.c:2048 [inline] __sys_connect+0x2df/0x310 net/socket.c:2065 __do_sys_connect net/socket.c:2075 [inline] __se_sys_connect net/socket.c:2072 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2072 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f. Linux of Linux Kernel for, NULL There is a vulnerability in pointer dereference.Service operation interruption (DoS) It may be in a state. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server. ========================================================================== Ubuntu Security Notice USN-6950-4 August 21, 2024 linux-hwe-5.15 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-hwe-5.15: Linux hardware enablement (HWE) kernel Details: Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - Block layer subsystem; - Bluetooth drivers; - Clock framework and drivers; - FireWire subsystem; - GPU drivers; - InfiniBand drivers; - Multiple devices driver; - EEPROM drivers; - Network drivers; - Pin controllers subsystem; - Remote Processor subsystem; - S/390 drivers; - SCSI drivers; - 9P distributed file system; - Network file system client; - SMB network file system; - Socket messages infrastructure; - Dynamic debug library; - Bluetooth subsystem; - Networking core; - IPv4 networking; - IPv6 networking; - Multipath TCP; - NSH protocol; - Phonet protocol; - TIPC protocol; - Wireless networking; - Key management; - ALSA framework; - HD-audio driver; (CVE-2024-36883, CVE-2024-36940, CVE-2024-36902, CVE-2024-36975, CVE-2024-36964, CVE-2024-36938, CVE-2024-36931, CVE-2024-35848, CVE-2024-26900, CVE-2024-36967, CVE-2024-36904, CVE-2024-27398, CVE-2024-36031, CVE-2023-52585, CVE-2024-36886, CVE-2024-36937, CVE-2024-36954, CVE-2024-36916, CVE-2024-36905, CVE-2024-36959, CVE-2024-26980, CVE-2024-26936, CVE-2024-36928, CVE-2024-36889, CVE-2024-36929, CVE-2024-36933, CVE-2024-27399, CVE-2024-36946, CVE-2024-36906, CVE-2024-36965, CVE-2024-36957, CVE-2024-36941, CVE-2024-36897, CVE-2024-36952, CVE-2024-36947, CVE-2024-36950, CVE-2024-36880, CVE-2024-36017, CVE-2023-52882, CVE-2024-36969, CVE-2024-38600, CVE-2024-36955, CVE-2024-36960, CVE-2024-27401, CVE-2024-36919, CVE-2024-36934, CVE-2024-35947, CVE-2024-36953, CVE-2024-36944, CVE-2024-36939) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS linux-image-5.15.0-118-generic 5.15.0-118.128~20.04.1 linux-image-5.15.0-118-generic-64k 5.15.0-118.128~20.04.1 linux-image-5.15.0-118-generic-lpae 5.15.0-118.128~20.04.1 linux-image-generic-64k-hwe-20.04 5.15.0.118.128~20.04.1 linux-image-generic-hwe-20.04 5.15.0.118.128~20.04.1 linux-image-generic-lpae-hwe-20.04 5.15.0.118.128~20.04.1 linux-image-oem-20.04 5.15.0.118.128~20.04.1 linux-image-oem-20.04b 5.15.0.118.128~20.04.1 linux-image-oem-20.04c 5.15.0.118.128~20.04.1 linux-image-oem-20.04d 5.15.0.118.128~20.04.1 linux-image-virtual-hwe-20.04 5.15.0.118.128~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6950-4 https://ubuntu.com/security/notices/USN-6950-3 https://ubuntu.com/security/notices/USN-6950-2 https://ubuntu.com/security/notices/USN-6950-1 CVE-2023-52585, CVE-2023-52882, CVE-2024-26900, CVE-2024-26936, CVE-2024-26980, CVE-2024-27398, CVE-2024-27399, CVE-2024-27401, CVE-2024-35848, CVE-2024-35947, CVE-2024-36017, CVE-2024-36031, CVE-2024-36880, CVE-2024-36883, CVE-2024-36886, CVE-2024-36889, CVE-2024-36902, CVE-2024-36904, CVE-2024-36905, CVE-2024-36906, CVE-2024-36916, CVE-2024-36919, CVE-2024-36928, CVE-2024-36929, CVE-2024-36931, CVE-2024-36933, CVE-2024-36934, CVE-2024-36937, CVE-2024-36938, CVE-2024-36939, CVE-2024-36940, CVE-2024-36941, CVE-2024-36944, CVE-2024-36946, CVE-2024-36947, CVE-2024-36950, CVE-2024-36952, CVE-2024-36953, CVE-2024-36954, CVE-2024-36955, CVE-2024-36957, CVE-2024-36959, CVE-2024-36960, CVE-2024-36964, CVE-2024-36965, CVE-2024-36967, CVE-2024-36969, CVE-2024-36975, CVE-2024-38600 Package Information: https://launchpad.net/ubuntu/+source/linux-hwe-5.15/5.15.0-118.128~20.04.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application issues an AIO cancel call, while the UDC is handling a soft disconnect. For a DWC3 based implementation, the callstack looks like the following: DWC3 Gadget FFS Application dwc3_gadget_soft_disconnect() ... --> dwc3_stop_active_transfers() --> dwc3_gadget_giveback(-ESHUTDOWN) --> ffs_epfile_async_io_complete() ffs_aio_cancel() --> usb_ep_free_request() --> usb_ep_dequeue() There is currently no locking implemented between the AIO completion handler and AIO cancel, so the issue occurs if the completion routine is running in parallel to an AIO cancel call coming from the FFS application. As the completion call frees the USB request (io_data->req) the FFS application is also referencing it for the usb_ep_dequeue() call. This can lead to accessing a stale/hanging pointer. commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") relocated the usb_ep_free_request() into ffs_epfile_async_io_complete(). However, in order to properly implement locking to mitigate this issue, the spinlock can't be added to ffs_epfile_async_io_complete(), as usb_ep_dequeue() (if successfully dequeuing a USB request) will call the function driver's completion handler in the same context. Hence, leading into a deadlock. Fix this issue by moving the usb_ep_free_request() back to ffs_user_copy_worker(), and ensuring that it explicitly sets io_data->req to NULL after freeing it within the ffs->eps_lock. This resolves the race condition above, as the ffs_aio_cancel() routine will not continue attempting to dequeue a request that has already been freed, or the ffs_user_copy_work() not freeing the USB request until the AIO cancel is done referencing it. This fix depends on commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently"). Linux of Linux Kernel There is a race condition vulnerability in.Information is obtained and service operation is interrupted (DoS) It may be in a state. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on SINEC OS with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) and human-machine interfaces (HMIs). Multiple vulnerabilities exist in third-party components prior to SIEMENS SINEC OS V3.2. These vulnerabilities could be exploited to corrupt values, leading to undefined behavior or security issues. ========================================================================== Ubuntu Security Notice USN-7007-1 September 13, 2024 linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-oracle, linux-raspi vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-gke: Linux kernel for Google Container Engine (GKE) systems - linux-gkeop: Linux kernel for Google Container Engine (GKE) systems - linux-ibm: Linux kernel for IBM cloud systems - linux-intel-iotg: Linux kernel for Intel IoT platforms - linux-kvm: Linux kernel for cloud environments - linux-nvidia: Linux kernel for NVIDIA systems - linux-oracle: Linux kernel for Oracle Cloud systems - linux-raspi: Linux kernel for Raspberry Pi systems - linux-aws-5.15: Linux kernel for Amazon Web Services (AWS) systems - linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-gkeop-5.15: Linux kernel for Google Container Engine (GKE) systems - linux-hwe-5.15: Linux hardware enablement (HWE) kernel - linux-intel-iotg-5.15: Linux kernel for Intel IoT platforms Details: Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848) Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741) It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - M68K architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Accessibility subsystem; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - Bluetooth drivers; - Character device driver; - CPU frequency scaling framework; - Hardware crypto device drivers; - Buffer Sharing and Synchronization framework; - DMA engine subsystem; - FPGA Framework; - GPIO subsystem; - GPU drivers; - Greybus drivers; - HID subsystem; - HW tracing; - I2C subsystem; - IIO subsystem; - InfiniBand drivers; - Input Device (Mouse) drivers; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - VMware VMCI Driver; - Network drivers; - Near Field Communication (NFC) drivers; - NVME drivers; - Pin controllers subsystem; - PTP clock framework; - S/390 drivers; - SCSI drivers; - SoundWire subsystem; - Greybus lights staging drivers; - Media staging drivers; - Thermal drivers; - TTY drivers; - USB subsystem; - DesignWare USB3 driver; - Framebuffer layer; - ACRN Hypervisor Service Module driver; - eCrypt file system; - File systems infrastructure; - Ext4 file system; - F2FS file system; - JFFS2 file system; - JFS file system; - NILFS2 file system; - NTFS3 file system; - SMB network file system; - IOMMU subsystem; - Memory management; - Netfilter; - BPF subsystem; - Kernel debugger infrastructure; - DMA mapping infrastructure; - IRQ subsystem; - Tracing infrastructure; - 9P file system network protocol; - B.A.T.M.A.N. meshing protocol; - CAN network layer; - Ceph Core library; - Networking core; - IPv4 networking; - IPv6 networking; - IUCV driver; - MAC80211 subsystem; - Multipath TCP; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - Network traffic control; - TIPC protocol; - TLS protocol; - Unix domain sockets; - Wireless networking; - XFRM subsystem; - ALSA framework; - SoC Audio for Freescale CPUs drivers; - Kirkwood ASoC drivers; (CVE-2024-40961, CVE-2024-38597, CVE-2024-39468, CVE-2024-36978, CVE-2024-42161, CVE-2024-38573, CVE-2024-40905, CVE-2024-42094, CVE-2024-36894, CVE-2024-40914, CVE-2024-40956, CVE-2024-42106, CVE-2024-38610, CVE-2024-39506, CVE-2024-42098, CVE-2024-42232, CVE-2024-38590, CVE-2024-39488, CVE-2024-42127, CVE-2024-41006, CVE-2024-42131, CVE-2024-41005, CVE-2024-40963, CVE-2024-38559, CVE-2024-42130, CVE-2024-37078, CVE-2024-42082, CVE-2024-40984, CVE-2024-38560, CVE-2024-42090, CVE-2024-33621, CVE-2024-40974, CVE-2024-42115, CVE-2024-40971, CVE-2024-40943, CVE-2024-38627, CVE-2024-38548, CVE-2024-40934, CVE-2024-38579, CVE-2024-38558, CVE-2024-39495, CVE-2023-52884, CVE-2024-42225, CVE-2024-38659, CVE-2024-40927, CVE-2024-40967, CVE-2024-38624, CVE-2024-38583, CVE-2024-41047, CVE-2024-38623, CVE-2024-39509, CVE-2024-36971, CVE-2024-42120, CVE-2024-38589, CVE-2024-36270, CVE-2024-42105, CVE-2024-36032, CVE-2024-42101, CVE-2024-40908, CVE-2024-42089, CVE-2024-39482, CVE-2024-38662, CVE-2024-41007, CVE-2024-38635, CVE-2023-52887, CVE-2024-40912, CVE-2024-41027, CVE-2024-38598, CVE-2024-38381, CVE-2024-39503, CVE-2024-39301, CVE-2024-40988, CVE-2024-41000, CVE-2024-39507, CVE-2024-35247, CVE-2024-39277, CVE-2024-42229, CVE-2024-42085, CVE-2024-35927, CVE-2024-42224, CVE-2024-38567, CVE-2024-42097, CVE-2024-41049, CVE-2024-39466, CVE-2024-40957, CVE-2024-40978, CVE-2024-42093, CVE-2024-40937, CVE-2024-41034, CVE-2024-41048, CVE-2024-39471, CVE-2024-39502, CVE-2024-38555, CVE-2024-40970, CVE-2024-36972, CVE-2024-40995, CVE-2024-42154, CVE-2024-40916, CVE-2024-39505, CVE-2024-39475, CVE-2024-38599, CVE-2024-38596, CVE-2024-39493, CVE-2024-42124, CVE-2024-38549, CVE-2024-42084, CVE-2024-40942, CVE-2024-42077, CVE-2024-42152, CVE-2024-40904, CVE-2024-31076, CVE-2024-40960, CVE-2024-41035, CVE-2024-40945, CVE-2024-38605, CVE-2024-42140, CVE-2024-41041, CVE-2024-36014, CVE-2024-38612, CVE-2024-41092, CVE-2024-38546, CVE-2024-40902, CVE-2024-42068, CVE-2024-42121, CVE-2024-42236, CVE-2024-34777, CVE-2024-39467, CVE-2024-42087, CVE-2024-39501, CVE-2024-40980, CVE-2024-38550, CVE-2024-42223, CVE-2024-38607, CVE-2024-42247, CVE-2024-41046, CVE-2024-42080, CVE-2024-40901, CVE-2024-38571, CVE-2024-39480, CVE-2024-42070, CVE-2024-41093, CVE-2024-42148, CVE-2024-38601, CVE-2024-39500, CVE-2024-41097, CVE-2024-38565, CVE-2024-38661, CVE-2024-38615, CVE-2024-41040, CVE-2024-34027, CVE-2024-37356, CVE-2024-42157, CVE-2024-40941, CVE-2024-38634, CVE-2024-41004, CVE-2024-38780, CVE-2024-38552, CVE-2024-39276, CVE-2024-38618, CVE-2024-38588, CVE-2024-42086, CVE-2024-41087, CVE-2024-38582, CVE-2024-40932, CVE-2024-39489, CVE-2024-40968, CVE-2024-42119, CVE-2024-42137, CVE-2024-40929, CVE-2024-38591, CVE-2024-36489, CVE-2022-48772, CVE-2024-42153, CVE-2024-40959, CVE-2024-40987, CVE-2024-36015, CVE-2024-41044, CVE-2024-41002, CVE-2024-42109, CVE-2024-38587, CVE-2024-36286, CVE-2024-41055, CVE-2024-39469, CVE-2024-39487, CVE-2024-38580, CVE-2024-38619, CVE-2024-38613, CVE-2024-42145, CVE-2024-41095, CVE-2024-40958, CVE-2024-40911, CVE-2024-42102, CVE-2024-33847, CVE-2024-36974, CVE-2024-40994, CVE-2024-38633, CVE-2024-40981, CVE-2024-40983, CVE-2024-42096, CVE-2024-42104, CVE-2024-42092, CVE-2024-40954, CVE-2024-38637, CVE-2024-42240, CVE-2024-38621, CVE-2024-38578, CVE-2024-38547, CVE-2024-39490, CVE-2024-42076, CVE-2024-42244, CVE-2024-39499, CVE-2024-38586, CVE-2024-41089, CVE-2024-40976, CVE-2024-42095, CVE-2024-40931, CVE-2024-40990) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS linux-image-5.15.0-1052-gkeop 5.15.0-1052.59 linux-image-5.15.0-1062-ibm 5.15.0-1062.65 linux-image-5.15.0-1062-raspi 5.15.0-1062.65 linux-image-5.15.0-1064-intel-iotg 5.15.0-1064.70 linux-image-5.15.0-1064-nvidia 5.15.0-1064.65 linux-image-5.15.0-1064-nvidia-lowlatency 5.15.0-1064.65 linux-image-5.15.0-1066-gke 5.15.0-1066.72 linux-image-5.15.0-1066-kvm 5.15.0-1066.71 linux-image-5.15.0-1067-oracle 5.15.0-1067.73 linux-image-5.15.0-1068-gcp 5.15.0-1068.76 linux-image-5.15.0-1069-aws 5.15.0-1069.75 linux-image-5.15.0-121-generic 5.15.0-121.131 linux-image-5.15.0-121-generic-64k 5.15.0-121.131 linux-image-5.15.0-121-generic-lpae 5.15.0-121.131 linux-image-aws-lts-22.04 5.15.0.1069.69 linux-image-gcp-lts-22.04 5.15.0.1068.64 linux-image-generic 5.15.0.121.121 linux-image-generic-64k 5.15.0.121.121 linux-image-generic-lpae 5.15.0.121.121 linux-image-gke 5.15.0.1066.65 linux-image-gke-5.15 5.15.0.1066.65 linux-image-gkeop 5.15.0.1052.51 linux-image-gkeop-5.15 5.15.0.1052.51 linux-image-ibm 5.15.0.1062.58 linux-image-intel-iotg 5.15.0.1064.64 linux-image-kvm 5.15.0.1066.62 linux-image-nvidia 5.15.0.1064.64 linux-image-nvidia-lowlatency 5.15.0.1064.64 linux-image-oracle-lts-22.04 5.15.0.1067.63 linux-image-raspi 5.15.0.1062.60 linux-image-raspi-nolpae 5.15.0.1062.60 linux-image-virtual 5.15.0.121.121 Ubuntu 20.04 LTS linux-image-5.15.0-1052-gkeop 5.15.0-1052.59~20.04.1 linux-image-5.15.0-1064-intel-iotg 5.15.0-1064.70~20.04.1+1 linux-image-5.15.0-1068-gcp 5.15.0-1068.76~20.04.1 linux-image-5.15.0-1069-aws 5.15.0-1069.75~20.04.1 linux-image-5.15.0-121-generic 5.15.0-121.131~20.04.1 linux-image-5.15.0-121-generic-64k 5.15.0-121.131~20.04.1 linux-image-5.15.0-121-generic-lpae 5.15.0-121.131~20.04.1 linux-image-aws 5.15.0.1069.75~20.04.1 linux-image-gcp 5.15.0.1068.76~20.04.1 linux-image-generic-64k-hwe-20.04 5.15.0.121.131~20.04.1 linux-image-generic-hwe-20.04 5.15.0.121.131~20.04.1 linux-image-generic-lpae-hwe-20.04 5.15.0.121.131~20.04.1 linux-image-gkeop-5.15 5.15.0.1052.59~20.04.1 linux-image-intel 5.15.0.1064.70~20.04.1 linux-image-intel-iotg 5.15.0.1064.70~20.04.1 linux-image-oem-20.04 5.15.0.121.131~20.04.1 linux-image-oem-20.04b 5.15.0.121.131~20.04.1 linux-image-oem-20.04c 5.15.0.121.131~20.04.1 linux-image-oem-20.04d 5.15.0.121.131~20.04.1 linux-image-virtual-hwe-20.04 5.15.0.121.131~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-7007-1 CVE-2022-48772, CVE-2023-52884, CVE-2023-52887, CVE-2024-23848, CVE-2024-25741, CVE-2024-31076, CVE-2024-33621, CVE-2024-33847, CVE-2024-34027, CVE-2024-34777, CVE-2024-35247, CVE-2024-35927, CVE-2024-36014, CVE-2024-36015, CVE-2024-36032, CVE-2024-36270, CVE-2024-36286, CVE-2024-36489, CVE-2024-36894, CVE-2024-36971, CVE-2024-36972, CVE-2024-36974, CVE-2024-36978, CVE-2024-37078, CVE-2024-37356, CVE-2024-38381, CVE-2024-38546, CVE-2024-38547, CVE-2024-38548, CVE-2024-38549, CVE-2024-38550, CVE-2024-38552, CVE-2024-38555, CVE-2024-38558, CVE-2024-38559, CVE-2024-38560, CVE-2024-38565, CVE-2024-38567, CVE-2024-38571, CVE-2024-38573, CVE-2024-38578, CVE-2024-38579, CVE-2024-38580, CVE-2024-38582, CVE-2024-38583, CVE-2024-38586, CVE-2024-38587, CVE-2024-38588, CVE-2024-38589, CVE-2024-38590, CVE-2024-38591, CVE-2024-38596, CVE-2024-38597, CVE-2024-38598, CVE-2024-38599, CVE-2024-38601, CVE-2024-38605, CVE-2024-38607, CVE-2024-38610, CVE-2024-38612, CVE-2024-38613, CVE-2024-38615, CVE-2024-38618, CVE-2024-38619, CVE-2024-38621, CVE-2024-38623, CVE-2024-38624, CVE-2024-38627, CVE-2024-38633, CVE-2024-38634, CVE-2024-38635, CVE-2024-38637, CVE-2024-38659, CVE-2024-38661, CVE-2024-38662, CVE-2024-38780, CVE-2024-39276, CVE-2024-39277, CVE-2024-39301, CVE-2024-39466, CVE-2024-39467, CVE-2024-39468, CVE-2024-39469, CVE-2024-39471, CVE-2024-39475, CVE-2024-39480, CVE-2024-39482, CVE-2024-39487, CVE-2024-39488, CVE-2024-39489, CVE-2024-39490, CVE-2024-39493, CVE-2024-39495, CVE-2024-39499, CVE-2024-39500, CVE-2024-39501, CVE-2024-39502, CVE-2024-39503, CVE-2024-39505, CVE-2024-39506, CVE-2024-39507, CVE-2024-39509, CVE-2024-40901, CVE-2024-40902, CVE-2024-40904, CVE-2024-40905, CVE-2024-40908, CVE-2024-40911, CVE-2024-40912, CVE-2024-40914, CVE-2024-40916, CVE-2024-40927, CVE-2024-40929, CVE-2024-40931, CVE-2024-40932, CVE-2024-40934, CVE-2024-40937, CVE-2024-40941, CVE-2024-40942, CVE-2024-40943, CVE-2024-40945, CVE-2024-40954, CVE-2024-40956, CVE-2024-40957, CVE-2024-40958, CVE-2024-40959, CVE-2024-40960, CVE-2024-40961, CVE-2024-40963, CVE-2024-40967, CVE-2024-40968, CVE-2024-40970, CVE-2024-40971, CVE-2024-40974, CVE-2024-40976, CVE-2024-40978, CVE-2024-40980, CVE-2024-40981, CVE-2024-40983, CVE-2024-40984, CVE-2024-40987, CVE-2024-40988, CVE-2024-40990, CVE-2024-40994, CVE-2024-40995, CVE-2024-41000, CVE-2024-41002, CVE-2024-41004, CVE-2024-41005, CVE-2024-41006, CVE-2024-41007, CVE-2024-41027, CVE-2024-41034, CVE-2024-41035, CVE-2024-41040, CVE-2024-41041, CVE-2024-41044, CVE-2024-41046, CVE-2024-41047, CVE-2024-41048, CVE-2024-41049, CVE-2024-41055, CVE-2024-41087, CVE-2024-41089, CVE-2024-41092, CVE-2024-41093, CVE-2024-41095, CVE-2024-41097, CVE-2024-42068, CVE-2024-42070, CVE-2024-42076, CVE-2024-42077, CVE-2024-42080, CVE-2024-42082, CVE-2024-42084, CVE-2024-42085, CVE-2024-42086, CVE-2024-42087, CVE-2024-42089, CVE-2024-42090, CVE-2024-42092, CVE-2024-42093, CVE-2024-42094, CVE-2024-42095, CVE-2024-42096, CVE-2024-42097, CVE-2024-42098, CVE-2024-42101, CVE-2024-42102, CVE-2024-42104, CVE-2024-42105, CVE-2024-42106, CVE-2024-42109, CVE-2024-42115, CVE-2024-42119, CVE-2024-42120, CVE-2024-42121, CVE-2024-42124, CVE-2024-42127, CVE-2024-42130, CVE-2024-42131, CVE-2024-42137, CVE-2024-42140, CVE-2024-42145, CVE-2024-42148, CVE-2024-42152, CVE-2024-42153, CVE-2024-42154, CVE-2024-42157, CVE-2024-42161, CVE-2024-42223, CVE-2024-42224, CVE-2024-42225, CVE-2024-42229, CVE-2024-42232, CVE-2024-42236, CVE-2024-42240, CVE-2024-42244, CVE-2024-42247 Package Information: https://launchpad.net/ubuntu/+source/linux/5.15.0-121.131 https://launchpad.net/ubuntu/+source/linux-aws/5.15.0-1069.75 https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1068.76 https://launchpad.net/ubuntu/+source/linux-gke/5.15.0-1066.72 https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1052.59 https://launchpad.net/ubuntu/+source/linux-ibm/5.15.0-1062.65 https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1064.70 https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1066.71 https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1064.65 https://launchpad.net/ubuntu/+source/linux-oracle/5.15.0-1067.73 https://launchpad.net/ubuntu/+source/linux-raspi/5.15.0-1062.65 https://launchpad.net/ubuntu/+source/linux-aws-5.15/5.15.0-1069.75~20.04.1 https://launchpad.net/ubuntu/+source/linux-gcp-5.15/5.15.0-1068.76~20.04.1 https://launchpad.net/ubuntu/+source/linux-gkeop-5.15/5.15.0-1052.59~20.04.1 https://launchpad.net/ubuntu/+source/linux-hwe-5.15/5.15.0-121.131~20.04.1 https://launchpad.net/ubuntu/+source/linux-intel-iotg-5.15/5.15.0-1064.70~20.04.1 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5731-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 16, 2024 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : linux CVE ID : CVE-2023-52760 CVE-2024-25741 CVE-2024-27397 CVE-2024-36894 CVE-2024-36973 CVE-2024-36978 CVE-2024-37078 CVE-2024-38619 CVE-2024-39298 CVE-2024-39371 CVE-2024-39469 CVE-2024-39474 CVE-2024-39484 CVE-2024-39487 CVE-2024-39494 CVE-2024-39495 CVE-2024-39496 CVE-2024-39499 CVE-2024-39500 CVE-2024-39501 CVE-2024-39502 CVE-2024-39503 CVE-2024-39505 CVE-2024-39506 CVE-2024-39507 CVE-2024-39509 CVE-2024-39510 CVE-2024-40899 CVE-2024-40900 CVE-2024-40901 CVE-2024-40902 CVE-2024-40903 CVE-2024-40904 CVE-2024-40905 CVE-2024-40906 CVE-2024-40908 CVE-2024-40910 CVE-2024-40911 CVE-2024-40912 CVE-2024-40913 CVE-2024-40914 CVE-2024-40915 CVE-2024-40916 CVE-2024-40919 CVE-2024-40920 CVE-2024-40921 CVE-2024-40924 CVE-2024-40927 CVE-2024-40929 CVE-2024-40931 CVE-2024-40932 CVE-2024-40934 CVE-2024-40935 CVE-2024-40937 CVE-2024-40938 CVE-2024-40939 CVE-2024-40940 CVE-2024-40941 CVE-2024-40942 CVE-2024-40943 CVE-2024-40947 CVE-2024-40948 CVE-2024-40953 CVE-2024-40954 CVE-2024-40956 CVE-2024-40957 CVE-2024-40958 CVE-2024-40959 CVE-2024-40960 CVE-2024-40961 CVE-2024-40963 CVE-2024-40966 CVE-2024-40967 CVE-2024-40968 CVE-2024-40970 CVE-2024-40971 CVE-2024-40974 CVE-2024-40976 CVE-2024-40977 CVE-2024-40978 CVE-2024-40980 CVE-2024-40981 CVE-2024-40983 CVE-2024-40984 CVE-2024-40987 CVE-2024-40988 CVE-2024-40989 CVE-2024-40990 CVE-2024-40993 CVE-2024-40994 CVE-2024-40995 CVE-2024-40996 CVE-2024-41000 CVE-2024-41001 CVE-2024-41002 CVE-2024-41004 CVE-2024-41005 CVE-2024-41006 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the stable distribution (bookworm), these problems have been fixed in version 6.1.99-1. We recommend that you upgrade your linux packages. For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmaWylhfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SMThAAiAanrQH+A4sTcRMZgwj521PKppx6+06c3jbqktG8XwQeOmaRrA1tgeyV ABahFSib/84PJtdqpW8+EHSJvGvxm9TKND98pPV6SjId2Ly7D+ARnfm6vIZzW/Sv WOZx0IU/So8qbZ7OjvKTfT+869yJ+MfRnYhdfuFTSJaZYehMyeizUMM5fjBX3dSf BBKcxR9w/RI2OgxiN45Q9+FrCCMS26RBTzRcb3pskw8741gzDyEostjjG+k5B8XJ /gEu10O3dGKtRV/1Uhkd5R4ACkcXHovox9EmA2vizGNfhf981cTeBT2ZIPIzstIY +/vkd4uUPi/OgIEBlkvcQx0UUaYctqDOnpvRqrLU9hwBkhlk0ueHxaHiBl9tf6L2 CDYb1BROY2A0eDSqCFugYMjzZDIbihFUS1Ly1TKDqea5xDTfiZcWa1u7bFp/LR2C 075lTh79e3GMdFceWfJk9SiPrFZnpCiokTmvbg4c0U7ac8ruXbAcV4i79exMTgwe VtUBFRufnLesmMmolGnqWSDA4Mf+w04MXJj3tU9N4MfC0bG0Y46IlNrabDOhUlns VdHvDLQOIMcFOl8rfKjFs+wTuUkRZUSFNQotG1WDiTezcQqbMS2eodVCB6Cq/51W L6oukVbbmncmYgYY3BGLTfn7ZxHUK3nhu/WmxtmwI4KsViLd8+Q= =KPq+ -----END PGP SIGNATURE-----

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRules. TOTOLINK of CP900L A stack-based buffer overflow vulnerability exists in the firmware.Service operation interruption (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. The vulnerability is caused by the desc parameter of the setIpPortFilterRules function failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. TOTOLINK of CP900L Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. No detailed vulnerability details are currently provided

A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb686c` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations. P3-550E firmware, P3-550 firmware, P3-530 firmware etc. AutomationDirect The product contains a vulnerability related to out-of-bounds writes.Information is tampered with and service operation is interrupted (DoS) It may be in a state. AutomationDirect P3-550E is a programmable control system (PLC) of AutomationDirect, Inc., USA

A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can send an unauthenticated packet to trigger this vulnerability. P3-550E firmware, P3-550 firmware, P3-530 firmware etc. AutomationDirect There are unspecified vulnerabilities in the product.Information may be obtained. AutomationDirect P3-550E is a programmable control system (PLC) of AutomationDirect, Inc. of the United States

A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to an arbitrary write. An attacker can send an unauthenticated packet to trigger this vulnerability. P3-550E firmware, P3-550 firmware, P3-530 firmware etc. AutomationDirect There are unspecified vulnerabilities in the product.Information is tampered with and service operation is interrupted (DoS) It may be in a state. AutomationDirect P3-550E is a programmable control system (PLC) of AutomationDirect, Inc. of the United States

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function SetPortForwardRules. TOTOLINK of CP900L Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. TOTOLINK CP900L has a stack buffer overflow vulnerability. The vulnerability is caused by the desc parameter of the SetPortForwardRules function failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the password parameter in the function loginAuth. TOTOLINK of CP900L A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. There is a buffer overflow vulnerability in the TOTOLINK CP900L v4.1.5cu.798_B20221228 version. The vulnerability is caused by the password parameter of the loginAuth function failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setMacFilterRules. TOTOLINK of CP900L Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. TOTOLINK CP900L v4.1.5cu.798_B20221228 has a stack overflow vulnerability. The vulnerability is caused by the failure of the desc parameter in the function setMacFilterRules to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. TOTOLINK of CP900L Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics

HP DesignJet T730 is a printer. HP DesignJet T730 of HP Trading (Shanghai) Co., Ltd. has an unauthorized access vulnerability, which can be exploited by attackers to obtain sensitive information.

TOTOLINK NR1800X v9.1.0u.6681_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecode. TOTOLINK of nr1800x A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK NR1800X is a 5G NR indoor Wi-Fi and SIP CPE from China's TOTOLINK Electronics. It is designed to provide fast and convenient NR fixed data service deployment for homes and offices. TOTOLINK NR1800X v9.1.0u.6681_B20230703 version has a buffer overflow vulnerability. The vulnerability is caused by the password parameter in the urldecode function failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth. TOTOLINK of lr350 A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK LR350 is a wireless router produced by China's TOTOLINK Electronics. TOTOLINK LR350 has a buffer overflow vulnerability. The vulnerability is caused by the http_host parameter in the loginAuth function failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service