ALT-BU-2022-5094-3
Branch p10 update bulletin.
Package kernel-image-un-def updated to version 5.15.43-alt1 for branch p10 in task 300632.
Closed vulnerabilities
Modified: 2024-11-07
BDU:2022-04244
Уязвимость функции bad_flp_intr ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код
Modified: 2025-08-19
BDU:2023-01957
Уязвимость функции vhost_net_set_backend (drivers/vhost/net.c) подкомпонента virtio ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании и раскрыть защищаемую информацию
Modified: 2024-09-30
BDU:2023-04900
Уязвимость функции vmxnet3_rq_alloc_rx_buf() в модуле drivers/net/vmxnet3/vmxnet3_drv.c драйвера vmxnet3 ядра операционной системы Linux, позволяющая нарушителю получить доступ к защищаемой информации или вызвать отказ в обслуживании
Modified: 2024-06-18
BDU:2024-02026
Уязвимость функции qcom_rng_read() компонента qcom-rng.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2022-1652
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
- https://bugzilla.redhat.com/show_bug.cgi?id=1832397
- https://francozappa.github.io/about-bias/
- https://kb.cert.org/vuls/id/647177/
- https://security.netapp.com/advisory/ntap-20220722-0002/
- https://www.debian.org/security/2022/dsa-5173
- https://bugzilla.redhat.com/show_bug.cgi?id=1832397
- https://francozappa.github.io/about-bias/
- https://kb.cert.org/vuls/id/647177/
- https://security.netapp.com/advisory/ntap-20220722-0002/
- https://www.debian.org/security/2022/dsa-5173
Modified: 2024-11-21
CVE-2022-1729
A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ac6487e584a1eb54071dbe1212e05b884136704
- https://security.netapp.com/advisory/ntap-20230214-0006/
- https://www.openwall.com/lists/oss-security/2022/05/20/2
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ac6487e584a1eb54071dbe1212e05b884136704
- https://security.netapp.com/advisory/ntap-20230214-0006/
- https://www.openwall.com/lists/oss-security/2022/05/20/2
Modified: 2025-02-03
CVE-2022-48630
In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ The commit referenced in the Fixes tag removed the 'break' from the else branch in qcom_rng_read(), causing an infinite loop whenever 'max' is not a multiple of WORD_SZ. This can be reproduced e.g. by running: kcapi-rng -b 67 >/dev/null There are many ways to fix this without adding back the 'break', but they all seem more awkward than simply adding it back, so do just that. Tested on a machine with Qualcomm Amberwing processor.
- https://git.kernel.org/stable/c/05d4d17475d8d094c519bb51658bc47899c175e3
- https://git.kernel.org/stable/c/16287397ec5c08aa58db6acf7dbc55470d78087d
- https://git.kernel.org/stable/c/233a3cc60e7a8fe0be8cf9934ae7b67ba25a866c
- https://git.kernel.org/stable/c/71a89789552b7faf3ef27969b9bc783fa0df3550
- https://git.kernel.org/stable/c/8a06f25f5941c145773204f2f7abef95b4ffb8ce
- https://git.kernel.org/stable/c/8be06f62b426801dba43ddf8893952a0e62ab6ae
- https://git.kernel.org/stable/c/05d4d17475d8d094c519bb51658bc47899c175e3
- https://git.kernel.org/stable/c/16287397ec5c08aa58db6acf7dbc55470d78087d
- https://git.kernel.org/stable/c/233a3cc60e7a8fe0be8cf9934ae7b67ba25a866c
- https://git.kernel.org/stable/c/71a89789552b7faf3ef27969b9bc783fa0df3550
- https://git.kernel.org/stable/c/8a06f25f5941c145773204f2f7abef95b4ffb8ce
- https://git.kernel.org/stable/c/8be06f62b426801dba43ddf8893952a0e62ab6ae
Modified: 2024-11-21
CVE-2023-1838
A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.
Modified: 2025-06-03
CVE-2023-4387
A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.
- https://access.redhat.com/errata/RHSA-2022:7683
- https://access.redhat.com/errata/RHSA-2022:8267
- https://access.redhat.com/security/cve/CVE-2023-4387
- https://bugzilla.redhat.com/show_bug.cgi?id=2219270
- https://github.com/torvalds/linux/commit/9e7fef9521e73ca8afd7da9e58c14654b02dfad8
- https://access.redhat.com/security/cve/CVE-2023-4387
- https://bugzilla.redhat.com/show_bug.cgi?id=2219270
- https://github.com/torvalds/linux/commit/9e7fef9521e73ca8afd7da9e58c14654b02dfad8
Closed bugs
Некорректная работа kitten panel в kitty.
Функция kitten icat в kitty не работает без ImageMagick.
Package kernel-image-std-def updated to version 5.10.118-alt1 for branch p10 in task 300613.
Closed vulnerabilities
Modified: 2024-09-13
BDU:2022-02443
Уязвимость подсистемы прямого доступа к памяти DMA (Direct memory access) ядра операционных систем Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Modified: 2024-11-07
BDU:2022-04244
Уязвимость функции bad_flp_intr ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код
Modified: 2025-08-19
BDU:2023-01957
Уязвимость функции vhost_net_set_backend (drivers/vhost/net.c) подкомпонента virtio ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании и раскрыть защищаемую информацию
Modified: 2024-09-30
BDU:2023-04900
Уязвимость функции vmxnet3_rq_alloc_rx_buf() в модуле drivers/net/vmxnet3/vmxnet3_drv.c драйвера vmxnet3 ядра операционной системы Linux, позволяющая нарушителю получить доступ к защищаемой информации или вызвать отказ в обслуживании
Modified: 2024-06-18
BDU:2024-02026
Уязвимость функции qcom_rng_read() компонента qcom-rng.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2022-0854
A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5161
- https://www.debian.org/security/2022/dsa-5173
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5161
- https://www.debian.org/security/2022/dsa-5173
Modified: 2024-11-21
CVE-2022-1652
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
- https://bugzilla.redhat.com/show_bug.cgi?id=1832397
- https://francozappa.github.io/about-bias/
- https://kb.cert.org/vuls/id/647177/
- https://security.netapp.com/advisory/ntap-20220722-0002/
- https://www.debian.org/security/2022/dsa-5173
- https://bugzilla.redhat.com/show_bug.cgi?id=1832397
- https://francozappa.github.io/about-bias/
- https://kb.cert.org/vuls/id/647177/
- https://security.netapp.com/advisory/ntap-20220722-0002/
- https://www.debian.org/security/2022/dsa-5173
Modified: 2024-11-21
CVE-2022-1729
A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ac6487e584a1eb54071dbe1212e05b884136704
- https://security.netapp.com/advisory/ntap-20230214-0006/
- https://www.openwall.com/lists/oss-security/2022/05/20/2
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ac6487e584a1eb54071dbe1212e05b884136704
- https://security.netapp.com/advisory/ntap-20230214-0006/
- https://www.openwall.com/lists/oss-security/2022/05/20/2
Modified: 2025-02-03
CVE-2022-48630
In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ The commit referenced in the Fixes tag removed the 'break' from the else branch in qcom_rng_read(), causing an infinite loop whenever 'max' is not a multiple of WORD_SZ. This can be reproduced e.g. by running: kcapi-rng -b 67 >/dev/null There are many ways to fix this without adding back the 'break', but they all seem more awkward than simply adding it back, so do just that. Tested on a machine with Qualcomm Amberwing processor.
- https://git.kernel.org/stable/c/05d4d17475d8d094c519bb51658bc47899c175e3
- https://git.kernel.org/stable/c/16287397ec5c08aa58db6acf7dbc55470d78087d
- https://git.kernel.org/stable/c/233a3cc60e7a8fe0be8cf9934ae7b67ba25a866c
- https://git.kernel.org/stable/c/71a89789552b7faf3ef27969b9bc783fa0df3550
- https://git.kernel.org/stable/c/8a06f25f5941c145773204f2f7abef95b4ffb8ce
- https://git.kernel.org/stable/c/8be06f62b426801dba43ddf8893952a0e62ab6ae
- https://git.kernel.org/stable/c/05d4d17475d8d094c519bb51658bc47899c175e3
- https://git.kernel.org/stable/c/16287397ec5c08aa58db6acf7dbc55470d78087d
- https://git.kernel.org/stable/c/233a3cc60e7a8fe0be8cf9934ae7b67ba25a866c
- https://git.kernel.org/stable/c/71a89789552b7faf3ef27969b9bc783fa0df3550
- https://git.kernel.org/stable/c/8a06f25f5941c145773204f2f7abef95b4ffb8ce
- https://git.kernel.org/stable/c/8be06f62b426801dba43ddf8893952a0e62ab6ae
Modified: 2024-11-21
CVE-2023-1838
A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.
Modified: 2025-06-03
CVE-2023-4387
A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.
- https://access.redhat.com/errata/RHSA-2022:7683
- https://access.redhat.com/errata/RHSA-2022:8267
- https://access.redhat.com/security/cve/CVE-2023-4387
- https://bugzilla.redhat.com/show_bug.cgi?id=2219270
- https://github.com/torvalds/linux/commit/9e7fef9521e73ca8afd7da9e58c14654b02dfad8
- https://access.redhat.com/security/cve/CVE-2023-4387
- https://bugzilla.redhat.com/show_bug.cgi?id=2219270
- https://github.com/torvalds/linux/commit/9e7fef9521e73ca8afd7da9e58c14654b02dfad8
