ALT-BU-2022-6166-3
Branch sisyphus update bulletin.
Closed vulnerabilities
BDU:2024-05813
Уязвимость системы работы с заявками и инцидентами GLPI, связанная c раскрытием конфиденциальной информации неавторизованному лицу, позволяющая нарушителю раскрыть конфиденциальные данные
BDU:2024-05814
Уязвимость системы работы с заявками и инцидентами GLPI, связанная с отсутствием нейтрализации HTML-тегов во время генерации веб-страницы, позволяющая нарушителю провести атаку межсайтового скриптинга
BDU:2024-05815
Уязвимость системы работы с заявками и инцидентами GLPI, связанная c неправильной нейтрализация входных данных во время генерации веб-страницы, позволяющая нарушителю получить несанкционированный доступ к файлам cookie администратора GLPI
BDU:2024-05816
Уязвимость системы работы с заявками и инцидентами GLPI, связанная c неправильной нейтрализацией специальных элементов, используемых в команде SQL, позволяющая нарушителю воздействовать на целостность системы
BDU:2024-05817
Уязвимость системы работы с заявками и инцидентами GLPI, связанная с непринятием мер по защите структуры запроса SQL, используемых в команде SQL, позволяющая нарушителю проводить атаки SQL-инъекцией
BDU:2024-05818
Уязвимость системы работы с заявками и инцидентами GLPI, связанная c подделкой запросов на стороне сервера, позволяющая нарушителю сканировать порты сервера или служб, открытых на сервере GLPI или его частной сети
Modified: 2025-10-22
BDU:2025-03383
Уязвимость модуля htmlawed системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, позволяющая нарушителю внедрить произвольных PHP код
Modified: 2024-11-21
CVE-2022-31143
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of GLPI (like smtp or cas hosts). Note that passwords are not exposed. Users are advised to upgrade to version 10.0.3. There are no known workarounds for this issue.
- https://github.com/glpi-project/glpi/commit/e66a0dfe697cbd4b3ec22736a8f8fd025a28f978
- https://github.com/glpi-project/glpi/security/advisories/GHSA-6mmq-x3j2-677j
- https://github.com/glpi-project/glpi/commit/e66a0dfe697cbd4b3ec22736a8f8fd025a28f978
- https://github.com/glpi-project/glpi/security/advisories/GHSA-6mmq-x3j2-677j
Modified: 2024-11-21
CVE-2022-31187
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions were found to not properly neutralize HTML tags in the global search context. Users are advised to upgrade to version 10.0.3 to resolve this issue. Users unable to upgrade should disable global search.
- https://github.com/glpi-project/glpi/commit/e248ed5649d267c0f61a17d99b7bd6be4074aadb
- https://github.com/glpi-project/glpi/security/advisories/GHSA-43j5-xhvj-9236
- https://github.com/glpi-project/glpi/commit/e248ed5649d267c0f61a17d99b7bd6be4074aadb
- https://github.com/glpi-project/glpi/security/advisories/GHSA-43j5-xhvj-9236
Modified: 2025-11-03
CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
- http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
- http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed
- https://github.com/Orange-Cyberdefense/CVE-repository/
- https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh
- https://github.com/glpi-project/glpi/releases
- https://glpi-project.org/fr/glpi-10-0-3-disponible/
- https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/
- http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
- http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed
- https://github.com/glpi-project/glpi/releases
- https://glpi-project.org/fr/glpi-10-0-3-disponible/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914
Modified: 2024-11-21
CVE-2022-35945
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration page. They can be used to steal a GLPI administrator cookie. Users are advised to upgrade to 10.0.3. There are no known workarounds for this issue. ### Workarounds Do not use a registration key created by an untrusted person.
- https://github.com/glpi-project/glpi/commit/2b8f9aa54ae4a4ec07bde0c8db739a292b8ec09a
- https://github.com/glpi-project/glpi/security/advisories/GHSA-jrgw-cx24-56x5
- https://github.com/glpi-project/glpi/commit/2b8f9aa54ae4a4ec07bde0c8db739a292b8ec09a
- https://github.com/glpi-project/glpi/security/advisories/GHSA-jrgw-cx24-56x5
Modified: 2024-11-21
CVE-2022-35946
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In affected versions request input is not properly validated in the plugin controller and can be used to access low-level API of Plugin class. An attacker can, for instance, alter database data. Attacker must have "General setup" update rights to be able to perform this attack. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should remove the `front/plugin.form.php` script.
- https://github.com/glpi-project/glpi/commit/f542ec8378afbd8038aeca5975b15eca3f0574c8
- https://github.com/glpi-project/glpi/security/advisories/GHSA-92q5-pfr8-r9r2
- https://github.com/glpi-project/glpi/commit/f542ec8378afbd8038aeca5975b15eca3f0574c8
- https://github.com/glpi-project/glpi/security/advisories/GHSA-92q5-pfr8-r9r2
Modified: 2024-11-21
CVE-2022-35947
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration.
- https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962
- https://github.com/glpi-project/glpi/security/advisories/GHSA-7p3q-cffg-c8xh
- https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962
- https://github.com/glpi-project/glpi/security/advisories/GHSA-7p3q-cffg-c8xh
Modified: 2024-11-21
CVE-2022-36112
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests can be used to scan server port or services opened on GLPI server or its private network. Queries responses are not exposed to end-user (blind SSRF). Users are advised to upgrade to version 10.0.3 to resolve this issue. There are no known workarounds.
- https://github.com/glpi-project/glpi/commit/ad66d69049ae02bead8ed0f4ee654a458643244e
- https://github.com/glpi-project/glpi/security/advisories/GHSA-rqgx-gqhp-x8vv
- https://github.com/glpi-project/glpi/commit/ad66d69049ae02bead8ed0f4ee654a458643244e
- https://github.com/glpi-project/glpi/security/advisories/GHSA-rqgx-gqhp-x8vv
Closed vulnerabilities
Modified: 2023-11-21
BDU:2022-05544
Уязвимость пакета net/http языка программирования Go, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-11-21
CVE-2022-27664
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/x49AQzIVX-s
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/
- https://security.gentoo.org/glsa/202209-26
- https://security.netapp.com/advisory/ntap-20220923-0004/
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/x49AQzIVX-s
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/
- https://security.gentoo.org/glsa/202209-26
- https://security.netapp.com/advisory/ntap-20220923-0004/
Modified: 2024-05-21
GHSA-69cg-p879-7622
golang.org/x/net/http2 Denial of Service vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2022-27664
- https://cs.opensource.google/go/x/net
- https://go.dev/cl/428735
- https://go.dev/issue/54658
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/x49AQzIVX-s
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX
- https://pkg.go.dev/vuln/GO-2022-0969
- https://security.gentoo.org/glsa/202209-26
- https://security.netapp.com/advisory/ntap-20220923-0004
Closed vulnerabilities
Modified: 2023-11-13
BDU:2022-05081
Уязвимость функции string_quote() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-11-13
BDU:2022-05082
Уязвимость функции check_vim9_unlet() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-09-13
BDU:2022-05093
Уязвимость функции utf_head_off() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-11-13
BDU:2022-05096
Уязвимость функции compile_lock_unlock() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-09-13
BDU:2022-05097
Уязвимость функции latin_ptr2len() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-11-13
BDU:2022-05098
Уязвимость функции generate_PCALL() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-11-13
BDU:2022-05145
Уязвимость функции generate_loadvar() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-11-13
BDU:2022-05146
Уязвимость функции find_var_also_in_script() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-09-13
BDU:2022-05289
Уязвимость функции vim_vsnprintf_typval() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-04-04
BDU:2022-05331
Уязвимость функции get_next_valid_entry() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-04-04
BDU:2022-05389
Уязвимость функции qf_buf_add_line() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-04-04
BDU:2022-05390
Уязвимость функции qf_fill_buffer() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2025-07-31
BDU:2022-05500
Уязвимость текстового редактора Vim, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2025-07-31
BDU:2022-05501
Уязвимость текстового редактора Vim, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-04-04
BDU:2022-05509
Уязвимость функции do_cmdline() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-09-13
BDU:2022-05523
Уязвимость функции utf_ptr2char() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-04-04
BDU:2022-05551
Уязвимость функции do_tag() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-04-04
BDU:2022-05597
Уязвимость функции vim_regcomp() текстового редактора Vim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2023-04-04
BDU:2022-05659
Уязвимость функции do_mouse() текстового редактора Vim, позволяющая нарушителю оказать воздействие на доступность защищаемой информации
Modified: 2023-04-04
BDU:2023-00450
Уязвимость функции gui_x11_create_blank_mouse() (gui_x11.c) текстового редактора Vim, связанная с переполнением буфера, позволяющая нарушителю выполнить атаку типа «отказ в обслуживании» (DoS) или оказать другое воздействие
Modified: 2024-11-21
CVE-2021-3984
vim is vulnerable to Heap-based Buffer Overflow
- http://www.openwall.com/lists/oss-security/2022/01/15/1
- https://github.com/vim/vim/commit/2de9b7c7c8791da8853a9a7ca9c467867465b655
- https://huntr.dev/bounties/b114b5a2-18e2-49f0-b350-15994d71426a
- https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
- https://security.gentoo.org/glsa/202208-32
- http://www.openwall.com/lists/oss-security/2022/01/15/1
- https://github.com/vim/vim/commit/2de9b7c7c8791da8853a9a7ca9c467867465b655
- https://huntr.dev/bounties/b114b5a2-18e2-49f0-b350-15994d71426a
- https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
- https://security.gentoo.org/glsa/202208-32
Modified: 2025-11-03
CVE-2021-4019
vim is vulnerable to Heap-based Buffer Overflow
- http://www.openwall.com/lists/oss-security/2022/01/15/1
- https://github.com/vim/vim/commit/bd228fd097b41a798f90944b5d1245eddd484142
- https://huntr.dev/bounties/d8798584-a6c9-4619-b18f-001b9a6fca92
- https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRPAI5JVZLI7WHWSBR6NWAPBQAYUQREW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
- https://security.gentoo.org/glsa/202208-32
- http://www.openwall.com/lists/oss-security/2022/01/15/1
- https://github.com/vim/vim/commit/bd228fd097b41a798f90944b5d1245eddd484142
- https://huntr.dev/bounties/d8798584-a6c9-4619-b18f-001b9a6fca92
- https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRPAI5JVZLI7WHWSBR6NWAPBQAYUQREW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
- https://security.gentoo.org/glsa/202208-32
Modified: 2024-11-21
CVE-2022-1927
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/41
- https://github.com/vim/vim/commit/4d97a565ae8be0d4debba04ebd2ac3e75a0c8010
- https://huntr.dev/bounties/945107ef-0b27-41c7-a03c-db99def0e777
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZSLFIKFYU5Y2KM5EJKQNYHWRUBDQ4GJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMFHBC5OQXDPV2SDYA2JUQGVCPYASTJB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM/
- https://security.gentoo.org/glsa/202208-32
- https://security.gentoo.org/glsa/202305-16
- https://support.apple.com/kb/HT213488
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/41
- https://github.com/vim/vim/commit/4d97a565ae8be0d4debba04ebd2ac3e75a0c8010
- https://huntr.dev/bounties/945107ef-0b27-41c7-a03c-db99def0e777
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZSLFIKFYU5Y2KM5EJKQNYHWRUBDQ4GJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMFHBC5OQXDPV2SDYA2JUQGVCPYASTJB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM/
- https://security.gentoo.org/glsa/202208-32
- https://security.gentoo.org/glsa/202305-16
- https://support.apple.com/kb/HT213488
Modified: 2024-11-21
CVE-2022-2816
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.
- https://github.com/vim/vim/commit/dbdd16b62560413abcc3c8e893cc3010ccf31666
- https://huntr.dev/bounties/e2a83037-fcf9-4218-b2b9-b7507dacde58
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/dbdd16b62560413abcc3c8e893cc3010ccf31666
- https://huntr.dev/bounties/e2a83037-fcf9-4218-b2b9-b7507dacde58
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2817
Use After Free in GitHub repository vim/vim prior to 9.0.0213.
- https://github.com/vim/vim/commit/249e1b903a9c0460d618f6dcc59aeb8c03b24b20
- https://huntr.dev/bounties/a7b7d242-3d88-4bde-a681-6c986aff886f
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/249e1b903a9c0460d618f6dcc59aeb8c03b24b20
- https://huntr.dev/bounties/a7b7d242-3d88-4bde-a681-6c986aff886f
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2819
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.
- https://github.com/vim/vim/commit/d1d8f6bacb489036d0fd479c9dd3c0102c988889
- https://huntr.dev/bounties/0a9bd71e-66b8-4eb1-9566-7dfd9b097e59
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/d1d8f6bacb489036d0fd479c9dd3c0102c988889
- https://huntr.dev/bounties/0a9bd71e-66b8-4eb1-9566-7dfd9b097e59
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
- https://security.gentoo.org/glsa/202305-16
Modified: 2026-02-25
CVE-2022-2845
Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.
- https://github.com/vim/vim/commit/e98c88c44c308edaea5994b8ad4363e65030968c
- https://huntr.dev/bounties/3e1d31ac-1cfd-4a9f-bc5c-213376b69445
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/e98c88c44c308edaea5994b8ad4363e65030968c
- https://huntr.dev/bounties/3e1d31ac-1cfd-4a9f-bc5c-213376b69445
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2849
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.
- https://github.com/vim/vim/commit/f6d39c31d2177549a986d170e192d8351bd571e2
- https://huntr.dev/bounties/389aeccd-deb9-49ae-9b6a-24c12d79b02e
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/f6d39c31d2177549a986d170e192d8351bd571e2
- https://huntr.dev/bounties/389aeccd-deb9-49ae-9b6a-24c12d79b02e
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2862
Use After Free in GitHub repository vim/vim prior to 9.0.0221.
- https://github.com/vim/vim/commit/1889f499a4f248cd84e0e0bf6d0d820016774494
- https://huntr.dev/bounties/71180988-1ab6-4311-bca8-e9a879b06765
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/1889f499a4f248cd84e0e0bf6d0d820016774494
- https://huntr.dev/bounties/71180988-1ab6-4311-bca8-e9a879b06765
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2874
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.
- https://github.com/vim/vim/commit/4875d6ab068f09df88d24d81de40dcd8d56e243d
- https://huntr.dev/bounties/95f97dfe-247d-475d-9740-b7adc71f4c79
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/4875d6ab068f09df88d24d81de40dcd8d56e243d
- https://huntr.dev/bounties/95f97dfe-247d-475d-9740-b7adc71f4c79
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2889
Use After Free in GitHub repository vim/vim prior to 9.0.0225.
- https://github.com/vim/vim/commit/91c7cbfe31bbef57d5fcf7d76989fc159f73ef15
- https://huntr.dev/bounties/d1ac9817-825d-49ce-b514-1d5b12b6bdaa
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/91c7cbfe31bbef57d5fcf7d76989fc159f73ef15
- https://huntr.dev/bounties/d1ac9817-825d-49ce-b514-1d5b12b6bdaa
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2923
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.
- https://github.com/vim/vim/commit/6669de1b235843968e88844ca6d3c8dec4b01a9e
- https://huntr.dev/bounties/fd3a3ab8-ab0f-452f-afea-8c613e283fd2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/6669de1b235843968e88844ca6d3c8dec4b01a9e
- https://huntr.dev/bounties/fd3a3ab8-ab0f-452f-afea-8c613e283fd2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2946
Use After Free in GitHub repository vim/vim prior to 9.0.0246.
- https://github.com/vim/vim/commit/adce965162dd89bf29ee0e5baf53652e7515762c
- https://huntr.dev/bounties/5d389a18-5026-47df-a5d0-1548a9b555d5
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/adce965162dd89bf29ee0e5baf53652e7515762c
- https://huntr.dev/bounties/5d389a18-5026-47df-a5d0-1548a9b555d5
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2980
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.
- https://github.com/vim/vim/commit/80525751c5ce9ed82c41d83faf9ef38667bf61b1
- https://huntr.dev/bounties/6e7b12a5-242c-453d-b39e-9625d563b0ea
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/80525751c5ce9ed82c41d83faf9ef38667bf61b1
- https://huntr.dev/bounties/6e7b12a5-242c-453d-b39e-9625d563b0ea
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-2982
Use After Free in GitHub repository vim/vim prior to 9.0.0260.
- https://github.com/vim/vim/commit/d6c67629ed05aae436164eec474832daf8ba7420
- https://huntr.dev/bounties/53f53d9a-ba8a-4985-b7ba-23efbe6833be
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/d6c67629ed05aae436164eec474832daf8ba7420
- https://huntr.dev/bounties/53f53d9a-ba8a-4985-b7ba-23efbe6833be
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-3016
Use After Free in GitHub repository vim/vim prior to 9.0.0286.
- https://github.com/vim/vim/commit/6d24a51b94beb1991cddce221f90b455e2d50db7
- https://huntr.dev/bounties/260516c2-5c4a-4b7f-a01c-04b1aeeea371
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/6d24a51b94beb1991cddce221f90b455e2d50db7
- https://huntr.dev/bounties/260516c2-5c4a-4b7f-a01c-04b1aeeea371
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-3037
Use After Free in GitHub repository vim/vim prior to 9.0.0322.
- https://github.com/vim/vim/commit/4f1b083be43f351bc107541e7b0c9655a5d2c0bb
- https://huntr.dev/bounties/af4c2f2d-d754-4607-b565-9e92f3f717b5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RY3GEN2Q46ZJKSNHTN2XB6B3VAJBEILN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHJ6LCLHGGVI2U6ZHXHTZ2PYP4STC23N/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://github.com/vim/vim/commit/4f1b083be43f351bc107541e7b0c9655a5d2c0bb
- https://huntr.dev/bounties/af4c2f2d-d754-4607-b565-9e92f3f717b5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RY3GEN2Q46ZJKSNHTN2XB6B3VAJBEILN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHJ6LCLHGGVI2U6ZHXHTZ2PYP4STC23N/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
Modified: 2025-11-03
CVE-2022-3099
Use After Free in GitHub repository vim/vim prior to 9.0.0360.
- https://github.com/vim/vim/commit/35d21c6830fc2d68aca838424a0e786821c5891c
- https://huntr.dev/bounties/403210c7-6cc7-4874-8934-b57f88bd4f5e
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DVWBI4BVTBUMNW4NMB3WZZDQJBKIGXI3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LLK2RMZEECKKWUQK7J46D2FQZOXFQLTC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/35d21c6830fc2d68aca838424a0e786821c5891c
- https://huntr.dev/bounties/403210c7-6cc7-4874-8934-b57f88bd4f5e
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DVWBI4BVTBUMNW4NMB3WZZDQJBKIGXI3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LLK2RMZEECKKWUQK7J46D2FQZOXFQLTC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
- https://security.gentoo.org/glsa/202305-16
Modified: 2025-11-03
CVE-2022-3134
Use After Free in GitHub repository vim/vim prior to 9.0.0389.
- https://github.com/vim/vim/commit/ccfde4d028e891a41e3548323c3d47b06fb0b83e
- https://huntr.dev/bounties/6ec79e49-c7ab-4cd6-a517-e7934c2eb9dc
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/ccfde4d028e891a41e3548323c3d47b06fb0b83e
- https://huntr.dev/bounties/6ec79e49-c7ab-4cd6-a517-e7934c2eb9dc
- https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html
- https://security.gentoo.org/glsa/202305-16
Modified: 2024-11-21
CVE-2022-3153
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
- https://github.com/vim/vim/commit/1540d334a04d874c2aa9d26b82dbbcd4bc5a78de
- https://huntr.dev/bounties/68331124-620d-48bc-a8fa-cd947b26270a
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/1540d334a04d874c2aa9d26b82dbbcd4bc5a78de
- https://huntr.dev/bounties/68331124-620d-48bc-a8fa-cd947b26270a
- https://security.gentoo.org/glsa/202305-16
Modified: 2025-04-03
CVE-2022-47024
A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.
- https://github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EX6N2DB75A73MQGVW3CS4VTNPAYVM2M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWIJBSQX53P7DHV77KRXJIXA4GH7XHC/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EX6N2DB75A73MQGVW3CS4VTNPAYVM2M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWIJBSQX53P7DHV77KRXJIXA4GH7XHC/
- https://security.gentoo.org/glsa/202305-16
Closed bugs
Пустая переменная окружения CDROMDEV вызывает некорректную работа скрипта 90-pkg.sh из installer-feature-repo-add
Package LibreOffice-still updated to version 7.3.6.2-alt1 for branch sisyphus in task 306809.
Closed vulnerabilities
Modified: 2023-12-26
BDU:2022-06246
Уязвимость реализации схемы vnd.libreoffice.command пакета офисных программ LibreOffice, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2022-3140
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.1; 7.3 versions prior to 7.3.6.
- https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TORANVTIWWBH3DNJR4UZATAG67KZOH32/
- https://security.gentoo.org/glsa/202212-04
- https://www.debian.org/security/2022/dsa-5252
- https://www.libreoffice.org/about-us/security/advisories/CVE-2022-3140
- https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TORANVTIWWBH3DNJR4UZATAG67KZOH32/
- https://security.gentoo.org/glsa/202212-04
- https://www.debian.org/security/2022/dsa-5252
- https://www.libreoffice.org/about-us/security/advisories/CVE-2022-3140
Closed bugs
Websockets && mosquitto
Closed bugs
Ошибка при systemctl restart distccd
distccd: ошибка проверки доступа по IP адресам
Package kernel-image-un-def updated to version 5.19.9-alt1 for branch sisyphus in task 306854.
Closed vulnerabilities
Modified: 2024-11-07
BDU:2022-05654
Уязвимость компонента drivers/firmware/efi/capsule-loader.c ядра операционной системы Linux, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании
Modified: 2024-10-10
BDU:2024-04573
Уязвимость функции erofs_workgroup_unfreeze() файловой системы EROFS (Enhanced Read-Only File System) ядра операционной системы Linux в однопроцессороной конфигурации, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-08-16
BDU:2024-04574
Уязвимость функции nvme_tcp_io_work() драйвера NVMe ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2026-02-17
BDU:2024-04575
Уязвимость функции irdma_generate_flush_completions() драйвера InfiniBand irdma ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-08-16
BDU:2024-04586
Уязвимость функции tcp_build_frag() реализации протокола IPv4 ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-10-10
BDU:2024-06338
Уязвимость функции mmput() в компоненте IB/core ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-10-10
BDU:2024-06339
Уязвимость функции brcmstb_pm_probe() в компоненте brcmstb ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-10-10
BDU:2024-06340
Уязвимость компонента RDMA/srp ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-10-10
BDU:2024-06341
Уязвимость функции ft_chain_release_hook() в компоненте netfilter ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-10-10
BDU:2024-06342
Уязвимость компонента i40e ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-10-10
BDU:2024-06343
Уязвимость компонента ipv6 ядра операционной системы Linux, позволяющая нарушителю получить доступ к конфиденциальной информации
Modified: 2025-02-25
BDU:2024-09710
Уязвимость компонентов drm/radeon ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-02-25
BDU:2024-09713
Уязвимость компонента mpt3sas ядра операционной системы Linux, позволяющая нарушителю повысить привилегии в системе
Modified: 2025-02-25
BDU:2024-09760
Уязвимость компонента emu10k1 ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2026-01-20
BDU:2024-09762
Уязвимость компонента usb-audio ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-02-25
BDU:2024-09766
Уязвимость компонентов sched/debug ядра операционной системы Linux, позволяющая нарушителю получить доступ к конфиденциальной информации
Modified: 2025-02-24
BDU:2024-09986
Уязвимость компонента mt7921e ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-02-24
BDU:2024-09987
Уязвимость компонента ice ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-02-24
BDU:2024-10000
Уязвимость компонента spi ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2025-04449
Уязвимость функции int3400_setup_gddv() модуля drivers/thermal/intel/int340x_thermal/int3400_thermal.c - драйвера управления температурой ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2025-14250
Уязвимость функции smcr_link_init() модуля net/smc/smc_core.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-11-25
BDU:2025-14566
Уязвимость функции crtc_debugfs_init() модуля drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c драйвера поддержки инфраструктуры прямого рендеринга (DRI) видеокарт AMD ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2025-14601
Уязвимость функции __nvmet_req_complete() модуля drivers/nvme/target/core.c драйвера поддержки NVME ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2026-03265
Уязвимость функции snd_pcm_oss_sync() модуля sound/core/oss/pcm_oss.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2022-40307
An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.
- https://github.com/torvalds/linux/commit/9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95
- https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
- https://www.debian.org/security/2022/dsa-5257
- https://github.com/torvalds/linux/commit/9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95
- https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
- https://www.debian.org/security/2022/dsa-5257
Modified: 2024-11-21
CVE-2022-48673
In the Linux kernel, the following vulnerability has been resolved:
net/smc: Fix possible access to freed memory in link clear
After modifying the QP to the Error state, all RX WR would be completed
with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not
wait for it is done, but destroy the QP and free the link group directly.
So there is a risk that accessing the freed memory in tasklet context.
Here is a crash example:
BUG: unable to handle page fault for address: ffffffff8f220860
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060
Oops: 0002 [#1] SMP PTI
CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23
Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018
RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0
Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32
RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086
RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000
RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00
RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b
R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010
R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modified: 2025-01-10
CVE-2022-48674
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix pcluster use-after-free on UP platforms
During stress testing with CONFIG_SMP disabled, KASAN reports as below:
==================================================================
BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30
Read of size 8 at addr ffff8881094223f8 by task stress/7789
CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3
Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
Call Trace:
- https://git.kernel.org/stable/c/2f44013e39984c127c6efedf70e6b5f4e9dcf315
- https://git.kernel.org/stable/c/8ddd001cef5e82d19192e6861068463ecca5f556
- https://git.kernel.org/stable/c/94c34faaafe7b55adc2d8d881db195b646959b9e
- https://git.kernel.org/stable/c/2f44013e39984c127c6efedf70e6b5f4e9dcf315
- https://git.kernel.org/stable/c/8ddd001cef5e82d19192e6861068463ecca5f556
- https://git.kernel.org/stable/c/94c34faaafe7b55adc2d8d881db195b646959b9e
Modified: 2024-11-21
CVE-2022-48675
In the Linux kernel, the following vulnerability has been resolved:
IB/core: Fix a nested dead lock as part of ODP flow
Fix a nested dead lock as part of ODP flow by using mmput_async().
From the below call trace [1] can see that calling mmput() once we have
the umem_odp->umem_mutex locked as required by
ib_umem_odp_map_dma_and_lock() might trigger in the same task the
exit_mmap()->__mmu_notifier_release()->mlx5_ib_invalidate_range() which
may dead lock when trying to lock the same mutex.
Moving to use mmput_async() will solve the problem as the above
exit_mmap() flow will be called in other task and will be executed once
the lock will be available.
[1]
[64843.077665] task:kworker/u133:2 state:D stack: 0 pid:80906 ppid:
2 flags:0x00004000
[64843.077672] Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]
[64843.077719] Call Trace:
[64843.077722]
- https://git.kernel.org/stable/c/819110054b14d7272b4188db997a3d80f75ab785
- https://git.kernel.org/stable/c/83c43fd872e32c8071d5582eb7c40f573a8342f3
- https://git.kernel.org/stable/c/85eaeb5058f0f04dffb124c97c86b4f18db0b833
- https://git.kernel.org/stable/c/e8de6cb5755eae7b793d8c00c8696c8667d44a7f
- https://git.kernel.org/stable/c/819110054b14d7272b4188db997a3d80f75ab785
- https://git.kernel.org/stable/c/83c43fd872e32c8071d5582eb7c40f573a8342f3
- https://git.kernel.org/stable/c/85eaeb5058f0f04dffb124c97c86b4f18db0b833
- https://git.kernel.org/stable/c/e8de6cb5755eae7b793d8c00c8696c8667d44a7f
Modified: 2024-11-21
CVE-2022-48686
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted.
- https://git.kernel.org/stable/c/13c80a6c112467bab5e44d090767930555fc17a5
- https://git.kernel.org/stable/c/160f3549a907a50e51a8518678ba2dcf2541abea
- https://git.kernel.org/stable/c/19816a0214684f70b49b25075ff8c402fdd611d3
- https://git.kernel.org/stable/c/5914fa32ef1b7766fea933f9eed94ac5c00aa7ff
- https://git.kernel.org/stable/c/c3eb461aa56e6fa94fb80442ba2586bd223a8886
- https://git.kernel.org/stable/c/13c80a6c112467bab5e44d090767930555fc17a5
- https://git.kernel.org/stable/c/160f3549a907a50e51a8518678ba2dcf2541abea
- https://git.kernel.org/stable/c/19816a0214684f70b49b25075ff8c402fdd611d3
- https://git.kernel.org/stable/c/5914fa32ef1b7766fea933f9eed94ac5c00aa7ff
- https://git.kernel.org/stable/c/c3eb461aa56e6fa94fb80442ba2586bd223a8886
Modified: 2024-11-21
CVE-2022-48687
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data.
The SRv6 layer allows defining HMAC data that can later be used to sign IPv6
Segment Routing Headers. This configuration is realised via netlink through
four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and
SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual
length of the SECRET attribute, it is possible to provide invalid combinations
(e.g., secret = "", secretlen = 64). This case is not checked in the code and
with an appropriately crafted netlink message, an out-of-bounds read of up
to 64 bytes (max secret length) can occur past the skb end pointer and into
skb_shared_info:
Breakpoint 1, seg6_genl_sethmac (skb=
- https://git.kernel.org/stable/c/076f2479fc5a15c4a970ca3b5e57d42ba09a31fa
- https://git.kernel.org/stable/c/3df71e11a4773d775c3633c44319f7acdb89011c
- https://git.kernel.org/stable/c/55195563ec29f80f984237b743de0e2b6ba4d093
- https://git.kernel.org/stable/c/56ad3f475482bca55b0ae544031333018eb145b3
- https://git.kernel.org/stable/c/84a53580c5d2138c7361c7c3eea5b31827e63b35
- https://git.kernel.org/stable/c/dc9dbd65c803af1607484fed5da50d41dc8dd864
- https://git.kernel.org/stable/c/f684c16971ed5e77dfa25a9ad25b5297e1f58eab
- https://git.kernel.org/stable/c/076f2479fc5a15c4a970ca3b5e57d42ba09a31fa
- https://git.kernel.org/stable/c/3df71e11a4773d775c3633c44319f7acdb89011c
- https://git.kernel.org/stable/c/55195563ec29f80f984237b743de0e2b6ba4d093
- https://git.kernel.org/stable/c/56ad3f475482bca55b0ae544031333018eb145b3
- https://git.kernel.org/stable/c/84a53580c5d2138c7361c7c3eea5b31827e63b35
- https://git.kernel.org/stable/c/dc9dbd65c803af1607484fed5da50d41dc8dd864
- https://git.kernel.org/stable/c/f684c16971ed5e77dfa25a9ad25b5297e1f58eab
Modified: 2024-11-21
CVE-2022-48688
In the Linux kernel, the following vulnerability has been resolved:
i40e: Fix kernel crash during module removal
The driver incorrectly frees client instance and subsequent
i40e module removal leads to kernel crash.
Reproducer:
1. Do ethtool offline test followed immediately by another one
host# ethtool -t eth0 offline; ethtool -t eth0 offline
2. Remove recursively irdma module that also removes i40e module
host# modprobe -r irdma
Result:
[ 8675.035651] i40e 0000:3d:00.0 eno1: offline testing starting
[ 8675.193774] i40e 0000:3d:00.0 eno1: testing finished
[ 8675.201316] i40e 0000:3d:00.0 eno1: offline testing starting
[ 8675.358921] i40e 0000:3d:00.0 eno1: testing finished
[ 8675.496921] i40e 0000:3d:00.0: IRDMA hardware initialization FAILED init_state=2 status=-110
[ 8686.188955] i40e 0000:3d:00.1: i40e_ptp_stop: removed PHC on eno2
[ 8686.943890] i40e 0000:3d:00.1: Deleted LAN device PF1 bus=0x3d dev=0x00 func=0x01
[ 8686.952669] i40e 0000:3d:00.0: i40e_ptp_stop: removed PHC on eno1
[ 8687.761787] BUG: kernel NULL pointer dereference, address: 0000000000000030
[ 8687.768755] #PF: supervisor read access in kernel mode
[ 8687.773895] #PF: error_code(0x0000) - not-present page
[ 8687.779034] PGD 0 P4D 0
[ 8687.781575] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 8687.785935] CPU: 51 PID: 172891 Comm: rmmod Kdump: loaded Tainted: G W I 5.19.0+ #2
[ 8687.794800] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5C620.86B.0X.02.0001.051420190324 05/14/2019
[ 8687.805222] RIP: 0010:i40e_lan_del_device+0x13/0xb0 [i40e]
[ 8687.810719] Code: d4 84 c0 0f 84 b8 25 01 00 e9 9c 25 01 00 41 bc f4 ff ff ff eb 91 90 0f 1f 44 00 00 41 54 55 53 48 8b 87 58 08 00 00 48 89 fb <48> 8b 68 30 48 89 ef e8 21 8a 0f d5 48 89 ef e8 a9 78 0f d5 48 8b
[ 8687.829462] RSP: 0018:ffffa604072efce0 EFLAGS: 00010202
[ 8687.834689] RAX: 0000000000000000 RBX: ffff8f43833b2000 RCX: 0000000000000000
[ 8687.841821] RDX: 0000000000000000 RSI: ffff8f4b0545b298 RDI: ffff8f43833b2000
[ 8687.848955] RBP: ffff8f43833b2000 R08: 0000000000000001 R09: 0000000000000000
[ 8687.856086] R10: 0000000000000000 R11: 000ffffffffff000 R12: ffff8f43833b2ef0
[ 8687.863218] R13: ffff8f43833b2ef0 R14: ffff915103966000 R15: ffff8f43833b2008
[ 8687.870342] FS: 00007f79501c3740(0000) GS:ffff8f4adffc0000(0000) knlGS:0000000000000000
[ 8687.878427] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8687.884174] CR2: 0000000000000030 CR3: 000000014276e004 CR4: 00000000007706e0
[ 8687.891306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8687.898441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8687.905572] PKRU: 55555554
[ 8687.908286] Call Trace:
[ 8687.910737]
- https://git.kernel.org/stable/c/2ed94383f3a2693dbf5bc47c514b42524bd8f9ae
- https://git.kernel.org/stable/c/342d77769a6cceb3df7720a1e18baa4339eee3fc
- https://git.kernel.org/stable/c/38af35bec59a8431a1eb29da994a0a45cba275d9
- https://git.kernel.org/stable/c/5332a094514852d5e58c278cf4193adb937337fc
- https://git.kernel.org/stable/c/c49f320e2492738d478bc427dcd54ccfe0cba746
- https://git.kernel.org/stable/c/fb8396aeda5872369a8ed6d2301e2c86e303c520
- https://git.kernel.org/stable/c/2ed94383f3a2693dbf5bc47c514b42524bd8f9ae
- https://git.kernel.org/stable/c/342d77769a6cceb3df7720a1e18baa4339eee3fc
- https://git.kernel.org/stable/c/38af35bec59a8431a1eb29da994a0a45cba275d9
- https://git.kernel.org/stable/c/5332a094514852d5e58c278cf4193adb937337fc
- https://git.kernel.org/stable/c/c49f320e2492738d478bc427dcd54ccfe0cba746
- https://git.kernel.org/stable/c/fb8396aeda5872369a8ed6d2301e2c86e303c520
Modified: 2024-11-21
CVE-2022-48689
In the Linux kernel, the following vulnerability has been resolved: tcp: TX zerocopy should not sense pfmemalloc status We got a recent syzbot report [1] showing a possible misuse of pfmemalloc page status in TCP zerocopy paths. Indeed, for pages coming from user space or other layers, using page_is_pfmemalloc() is moot, and possibly could give false positives. There has been attempts to make page_is_pfmemalloc() more robust, but not using it in the first place in this context is probably better, removing cpu cycles. Note to stable teams : You need to backport 84ce071e38a6 ("net: introduce __skb_fill_page_desc_noacc") as a prereq. Race is more probable after commit c07aea3ef4d4 ("mm: add a signature in struct page") because page_is_pfmemalloc() is now using low order bit from page->lru.next, which can change more often than page->index. Low order bit should never be set for lru.next (when used as an anchor in LRU list), so KCSAN report is mostly a false positive. Backporting to older kernel versions seems not necessary. [1] BUG: KCSAN: data-race in lru_add_fn / tcp_build_frag write to 0xffffea0004a1d2c8 of 8 bytes by task 18600 on cpu 0: __list_add include/linux/list.h:73 [inline] list_add include/linux/list.h:88 [inline] lruvec_add_folio include/linux/mm_inline.h:105 [inline] lru_add_fn+0x440/0x520 mm/swap.c:228 folio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246 folio_batch_add_and_move mm/swap.c:263 [inline] folio_add_lru+0xf1/0x140 mm/swap.c:490 filemap_add_folio+0xf8/0x150 mm/filemap.c:948 __filemap_get_folio+0x510/0x6d0 mm/filemap.c:1981 pagecache_get_page+0x26/0x190 mm/folio-compat.c:104 grab_cache_page_write_begin+0x2a/0x30 mm/folio-compat.c:116 ext4_da_write_begin+0x2dd/0x5f0 fs/ext4/inode.c:2988 generic_perform_write+0x1d4/0x3f0 mm/filemap.c:3738 ext4_buffered_write_iter+0x235/0x3e0 fs/ext4/file.c:270 ext4_file_write_iter+0x2e3/0x1210 call_write_iter include/linux/fs.h:2187 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x468/0x760 fs/read_write.c:578 ksys_write+0xe8/0x1a0 fs/read_write.c:631 __do_sys_write fs/read_write.c:643 [inline] __se_sys_write fs/read_write.c:640 [inline] __x64_sys_write+0x3e/0x50 fs/read_write.c:640 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffea0004a1d2c8 of 8 bytes by task 18611 on cpu 1: page_is_pfmemalloc include/linux/mm.h:1740 [inline] __skb_fill_page_desc include/linux/skbuff.h:2422 [inline] skb_fill_page_desc include/linux/skbuff.h:2443 [inline] tcp_build_frag+0x613/0xb20 net/ipv4/tcp.c:1018 do_tcp_sendpages+0x3e8/0xaf0 net/ipv4/tcp.c:1075 tcp_sendpage_locked net/ipv4/tcp.c:1140 [inline] tcp_sendpage+0x89/0xb0 net/ipv4/tcp.c:1150 inet_sendpage+0x7f/0xc0 net/ipv4/af_inet.c:833 kernel_sendpage+0x184/0x300 net/socket.c:3561 sock_sendpage+0x5a/0x70 net/socket.c:1054 pipe_to_sendpage+0x128/0x160 fs/splice.c:361 splice_from_pipe_feed fs/splice.c:415 [inline] __splice_from_pipe+0x222/0x4d0 fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage+0x89/0xc0 fs/splice.c:743 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:931 splice_direct_to_actor+0x305/0x620 fs/splice.c:886 do_splice_direct+0xfb/0x180 fs/splice.c:974 do_sendfile+0x3bf/0x910 fs/read_write.c:1249 __do_sys_sendfile64 fs/read_write.c:1317 [inline] __se_sys_sendfile64 fs/read_write.c:1303 [inline] __x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1303 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xffffea0004a1d288 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 18611 Comm: syz-executor.4 Not tainted 6.0.0-rc2-syzkaller-00248-ge022620b5d05-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
- https://git.kernel.org/stable/c/3261400639463a853ba2b3be8bd009c2a8089775
- https://git.kernel.org/stable/c/6730c48ed6b0cd939fc9b30b2d621ce0b89bea83
- https://git.kernel.org/stable/c/8527c9a6bf8e54fef0a8d3d7d8874a48c725c915
- https://git.kernel.org/stable/c/3261400639463a853ba2b3be8bd009c2a8089775
- https://git.kernel.org/stable/c/6730c48ed6b0cd939fc9b30b2d621ce0b89bea83
- https://git.kernel.org/stable/c/8527c9a6bf8e54fef0a8d3d7d8874a48c725c915
Modified: 2025-09-19
CVE-2022-48690
In the Linux kernel, the following vulnerability has been resolved: ice: Fix DMA mappings leak Fix leak, when user changes ring parameters. During reallocation of RX buffers, new DMA mappings are created for those buffers. New buffers with different RX ring count should substitute older ones, but those buffers were freed in ice_vsi_cfg_rxq and reallocated again with ice_alloc_rx_buf. kfree on rx_buf caused leak of already mapped DMA. Reallocate ZC with xdp_buf struct, when BPF program loads. Reallocate back to rx_buf, when BPF program unloads. If BPF program is loaded/unloaded and XSK pools are created, reallocate RX queues accordingly in XDP_SETUP_XSK_POOL handler. Steps for reproduction: while : do for ((i=0; i<=8160; i=i+32)) do ethtool -G enp130s0f0 rx $i tx $i sleep 0.5 ethtool -g enp130s0f0 done done
Modified: 2024-11-21
CVE-2022-48691
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: clean up hook list when offload flags check fails
splice back the hook list so nft_chain_release_hook() has a chance to
release the hooks.
BUG: memory leak
unreferenced object 0xffff88810180b100 (size 96):
comm "syz-executor133", pid 3619, jiffies 4294945714 (age 12.690s)
hex dump (first 32 bytes):
28 64 23 02 81 88 ff ff 28 64 23 02 81 88 ff ff (d#.....(d#.....
90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff ................
backtrace:
[
- https://git.kernel.org/stable/c/1ce55ec5cb7c573c983dffbe290b8d17caf1f157
- https://git.kernel.org/stable/c/77972a36ecc4db7fc7c68f0e80714263c5f03f65
- https://git.kernel.org/stable/c/910891a2a44cdc49efcc4fe7459c1085ba00d0f4
- https://git.kernel.org/stable/c/94ed8eeb8d9aeb00e4f4e19b83a2e28b6442fbc5
- https://git.kernel.org/stable/c/1ce55ec5cb7c573c983dffbe290b8d17caf1f157
- https://git.kernel.org/stable/c/77972a36ecc4db7fc7c68f0e80714263c5f03f65
- https://git.kernel.org/stable/c/910891a2a44cdc49efcc4fe7459c1085ba00d0f4
- https://git.kernel.org/stable/c/94ed8eeb8d9aeb00e4f4e19b83a2e28b6442fbc5
Modified: 2024-11-21
CVE-2022-48692
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srp: Set scmnd->result only when scmnd is not NULL
This change fixes the following kernel NULL pointer dereference
which is reproduced by blktests srp/007 occasionally.
BUG: kernel NULL pointer dereference, address: 0000000000000170
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 9 Comm: kworker/0:1H Kdump: loaded Not tainted 6.0.0-rc1+ #37
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qemu.org 04/01/2014
Workqueue: 0x0 (kblockd)
RIP: 0010:srp_recv_done+0x176/0x500 [ib_srp]
Code: 00 4d 85 ff 0f 84 52 02 00 00 48 c7 82 80 02 00 00 00 00 00 00 4c 89 df 4c 89 14 24 e8 53 d3 4a f6 4c 8b 14 24 41 0f b6 42 13 <41> 89 87 70 01 00 00 41 0f b6 52 12 f6 c2 02 74 44 41 8b 42 1c b9
RSP: 0018:ffffaef7c0003e28 EFLAGS: 00000282
RAX: 0000000000000000 RBX: ffff9bc9486dea60 RCX: 0000000000000000
RDX: 0000000000000102 RSI: ffffffffb76bbd0e RDI: 00000000ffffffff
RBP: ffff9bc980099a00 R08: 0000000000000001 R09: 0000000000000001
R10: ffff9bca53ef0000 R11: ffff9bc980099a10 R12: ffff9bc956e14000
R13: ffff9bc9836b9cb0 R14: ffff9bc9557b4480 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff9bc97ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 0000000007e04000 CR4: 00000000000006f0
Call Trace:
- https://git.kernel.org/stable/c/12f35199a2c0551187edbf8eb01379f0598659fa
- https://git.kernel.org/stable/c/a8edd49c94b4b08019ed7d6dd794fca8078a4deb
- https://git.kernel.org/stable/c/f022576aa03c2385ea7f2b27ee5b331e43abf624
- https://git.kernel.org/stable/c/f2c70f56f762e5dc3b0d7dc438fbb137cb116413
- https://git.kernel.org/stable/c/12f35199a2c0551187edbf8eb01379f0598659fa
- https://git.kernel.org/stable/c/a8edd49c94b4b08019ed7d6dd794fca8078a4deb
- https://git.kernel.org/stable/c/f022576aa03c2385ea7f2b27ee5b331e43abf624
- https://git.kernel.org/stable/c/f2c70f56f762e5dc3b0d7dc438fbb137cb116413
Modified: 2024-11-21
CVE-2022-48693
In the Linux kernel, the following vulnerability has been resolved: soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs In brcmstb_pm_probe(), there are two kinds of leak bugs: (1) we need to add of_node_put() when for_each__matching_node() breaks (2) we need to add iounmap() for each iomap in fail path
- https://git.kernel.org/stable/c/0284b4e6dec6088a41607aa3f42bf51edff01883
- https://git.kernel.org/stable/c/1085f5080647f0c9f357c270a537869191f7f2a1
- https://git.kernel.org/stable/c/43245c77d9efd8c9eb91bf225d07954dcf32204d
- https://git.kernel.org/stable/c/57b2897ec3ffe4cbe018446be6d04432919dca6b
- https://git.kernel.org/stable/c/653500b400d5576940b7429690f7197199ddcc82
- https://git.kernel.org/stable/c/6dc0251638a4a1a998506dbd4627f8317e907558
- https://git.kernel.org/stable/c/0284b4e6dec6088a41607aa3f42bf51edff01883
- https://git.kernel.org/stable/c/1085f5080647f0c9f357c270a537869191f7f2a1
- https://git.kernel.org/stable/c/43245c77d9efd8c9eb91bf225d07954dcf32204d
- https://git.kernel.org/stable/c/57b2897ec3ffe4cbe018446be6d04432919dca6b
- https://git.kernel.org/stable/c/653500b400d5576940b7429690f7197199ddcc82
- https://git.kernel.org/stable/c/6dc0251638a4a1a998506dbd4627f8317e907558
Modified: 2024-11-21
CVE-2022-48694
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix drain SQ hang with no completion SW generated completions for outstanding WRs posted on SQ after QP is in error target the wrong CQ. This causes the ib_drain_sq to hang with no completion. Fix this to generate completions on the right CQ. [ 863.969340] INFO: task kworker/u52:2:671 blocked for more than 122 seconds. [ 863.979224] Not tainted 5.14.0-130.el9.x86_64 #1 [ 863.986588] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 863.996997] task:kworker/u52:2 state:D stack: 0 pid: 671 ppid: 2 flags:0x00004000 [ 864.007272] Workqueue: xprtiod xprt_autoclose [sunrpc] [ 864.014056] Call Trace: [ 864.017575] __schedule+0x206/0x580 [ 864.022296] schedule+0x43/0xa0 [ 864.026736] schedule_timeout+0x115/0x150 [ 864.032185] __wait_for_common+0x93/0x1d0 [ 864.037717] ? usleep_range_state+0x90/0x90 [ 864.043368] __ib_drain_sq+0xf6/0x170 [ib_core] [ 864.049371] ? __rdma_block_iter_next+0x80/0x80 [ib_core] [ 864.056240] ib_drain_sq+0x66/0x70 [ib_core] [ 864.062003] rpcrdma_xprt_disconnect+0x82/0x3b0 [rpcrdma] [ 864.069365] ? xprt_prepare_transmit+0x5d/0xc0 [sunrpc] [ 864.076386] xprt_rdma_close+0xe/0x30 [rpcrdma] [ 864.082593] xprt_autoclose+0x52/0x100 [sunrpc] [ 864.088718] process_one_work+0x1e8/0x3c0 [ 864.094170] worker_thread+0x50/0x3b0 [ 864.099109] ? rescuer_thread+0x370/0x370 [ 864.104473] kthread+0x149/0x170 [ 864.109022] ? set_kthread_struct+0x40/0x40 [ 864.114713] ret_from_fork+0x22/0x30
- https://git.kernel.org/stable/c/14d148401c5202fec3a071e24785481d540b22c3
- https://git.kernel.org/stable/c/5becc531a3fa8da75158a8993f56cc3e0717716e
- https://git.kernel.org/stable/c/ead54ced6321099978d30d62dc49c282a6e70574
- https://git.kernel.org/stable/c/14d148401c5202fec3a071e24785481d540b22c3
- https://git.kernel.org/stable/c/5becc531a3fa8da75158a8993f56cc3e0717716e
- https://git.kernel.org/stable/c/ead54ced6321099978d30d62dc49c282a6e70574
Modified: 2024-12-26
CVE-2022-48695
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0
- https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b
- https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5
- https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7
- https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16
- https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34
- https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82
- https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6
- https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057
- https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b
- https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5
- https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7
- https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16
- https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34
- https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82
- https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6
- https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057
Modified: 2025-04-08
CVE-2022-48696
In the Linux kernel, the following vulnerability has been resolved: regmap: spi: Reserve space for register address/padding Currently the max_raw_read and max_raw_write limits in regmap_spi struct do not take into account the additional size of the transmitted register address and padding. This may result in exceeding the maximum permitted SPI message size, which could cause undefined behaviour, e.g. data corruption. Fix regmap_get_spi_bus() to properly adjust the above mentioned limits by reserving space for the register address/padding as set in the regmap configuration.
Modified: 2025-04-08
CVE-2022-48697
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a use-after-free Fix the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop] __nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30
- https://git.kernel.org/stable/c/17f121ca3ec6be0fb32d77c7f65362934a38cc8e
- https://git.kernel.org/stable/c/4484ce97a78171668c402e0c45db7f760aea8060
- https://git.kernel.org/stable/c/6a02a61e81c231cc5c680c5dbf8665275147ac52
- https://git.kernel.org/stable/c/8d66989b5f7bb28bba2f8e1e2ffc8bfef4a10717
- https://git.kernel.org/stable/c/be01f1c988757b95f11f090a9f491365670a522b
- https://git.kernel.org/stable/c/ebf46da50beb78066674354ad650606a467e33fa
- https://git.kernel.org/stable/c/17f121ca3ec6be0fb32d77c7f65362934a38cc8e
- https://git.kernel.org/stable/c/4484ce97a78171668c402e0c45db7f760aea8060
- https://git.kernel.org/stable/c/6a02a61e81c231cc5c680c5dbf8665275147ac52
- https://git.kernel.org/stable/c/8d66989b5f7bb28bba2f8e1e2ffc8bfef4a10717
- https://git.kernel.org/stable/c/be01f1c988757b95f11f090a9f491365670a522b
- https://git.kernel.org/stable/c/ebf46da50beb78066674354ad650606a467e33fa
Modified: 2025-04-08
CVE-2022-48698
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix memory leak when using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up by properly calling dput().
- https://git.kernel.org/stable/c/3a6279d243cb035eaaff1450980b40cf19748f05
- https://git.kernel.org/stable/c/58acd2ebae034db3bacf38708f508fbd12ae2e54
- https://git.kernel.org/stable/c/cbfac7fa491651c57926c99edeb7495c6c1aeac2
- https://git.kernel.org/stable/c/3a6279d243cb035eaaff1450980b40cf19748f05
- https://git.kernel.org/stable/c/58acd2ebae034db3bacf38708f508fbd12ae2e54
- https://git.kernel.org/stable/c/cbfac7fa491651c57926c99edeb7495c6c1aeac2
Modified: 2025-09-19
CVE-2022-48699
In the Linux kernel, the following vulnerability has been resolved: sched/debug: fix dentry leak in update_sched_domain_debugfs Kuyo reports that the pattern of using debugfs_remove(debugfs_lookup()) leaks a dentry and with a hotplug stress test, the machine eventually runs out of memory. Fix this up by using the newly created debugfs_lookup_and_remove() call instead which properly handles the dentry reference counting logic.
- https://git.kernel.org/stable/c/0c32a93963e03c03e561d5a066eedad211880ba3
- https://git.kernel.org/stable/c/26e9a1ded8923510e5529fbb28390b22228700c2
- https://git.kernel.org/stable/c/c2e406596571659451f4b95e37ddfd5a8ef1d0dc
- https://git.kernel.org/stable/c/0c32a93963e03c03e561d5a066eedad211880ba3
- https://git.kernel.org/stable/c/26e9a1ded8923510e5529fbb28390b22228700c2
- https://git.kernel.org/stable/c/c2e406596571659451f4b95e37ddfd5a8ef1d0dc
Modified: 2025-03-05
CVE-2022-48701
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces.
- https://git.kernel.org/stable/c/0492798bf8dfcc09c9337a1ba065da1d1ca68712
- https://git.kernel.org/stable/c/2a308e415d247a23d4d64c964c02e782eede2936
- https://git.kernel.org/stable/c/6123bec8480d23369e2ee0b2208611619f269faf
- https://git.kernel.org/stable/c/8293e61bbf908b18ff9935238d4fc2ad359e3fe0
- https://git.kernel.org/stable/c/91904870370fd986c29719846ed76d559de43251
- https://git.kernel.org/stable/c/98e8e67395cc6d0cdf3a771f86ea42d0ee6e59dd
- https://git.kernel.org/stable/c/b970518014f2f0f6c493fb86c1e092b936899061
- https://git.kernel.org/stable/c/e53f47f6c1a56d2af728909f1cb894da6b43d9bf
- https://git.kernel.org/stable/c/0492798bf8dfcc09c9337a1ba065da1d1ca68712
- https://git.kernel.org/stable/c/2a308e415d247a23d4d64c964c02e782eede2936
- https://git.kernel.org/stable/c/6123bec8480d23369e2ee0b2208611619f269faf
- https://git.kernel.org/stable/c/8293e61bbf908b18ff9935238d4fc2ad359e3fe0
- https://git.kernel.org/stable/c/91904870370fd986c29719846ed76d559de43251
- https://git.kernel.org/stable/c/98e8e67395cc6d0cdf3a771f86ea42d0ee6e59dd
- https://git.kernel.org/stable/c/b970518014f2f0f6c493fb86c1e092b936899061
- https://git.kernel.org/stable/c/e53f47f6c1a56d2af728909f1cb894da6b43d9bf
Modified: 2025-03-05
CVE-2022-48702
In the Linux kernel, the following vulnerability has been resolved:
ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
The voice allocator sometimes begins allocating from near the end of the
array and then wraps around, however snd_emu10k1_pcm_channel_alloc()
accesses the newly allocated voices as if it never wrapped around.
This results in out of bounds access if the first voice has a high enough
index so that first_voice + requested_voice_count > NUM_G (64).
The more voices are requested, the more likely it is for this to occur.
This was initially discovered using PipeWire, however it can be reproduced
by calling aplay multiple times with 16 channels:
aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero
UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40
index 65 is out of range for type 'snd_emu10k1_voice [64]'
CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7
Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010
Call Trace:
- https://git.kernel.org/stable/c/39a90720f3abe96625d1224e7a7463410875de4c
- https://git.kernel.org/stable/c/4204a01ffce97cae1d59edc5848f02be5b2b9178
- https://git.kernel.org/stable/c/45321a7d02b7cf9b3f97e3987fc1e4d649b82da2
- https://git.kernel.org/stable/c/45814a53514e10a8014906c882e0d0d38df39cc1
- https://git.kernel.org/stable/c/637c5310acb48fffcc5657568db3f3e9bc719bfa
- https://git.kernel.org/stable/c/6b0e260ac3cf289e38446552461caa65e6dab275
- https://git.kernel.org/stable/c/88aac6684cf8bc885cca15463cb4407e91f28ff7
- https://git.kernel.org/stable/c/d29f59051d3a07b81281b2df2b8c9dfe4716067f
- https://git.kernel.org/stable/c/39a90720f3abe96625d1224e7a7463410875de4c
- https://git.kernel.org/stable/c/4204a01ffce97cae1d59edc5848f02be5b2b9178
- https://git.kernel.org/stable/c/45321a7d02b7cf9b3f97e3987fc1e4d649b82da2
- https://git.kernel.org/stable/c/45814a53514e10a8014906c882e0d0d38df39cc1
- https://git.kernel.org/stable/c/637c5310acb48fffcc5657568db3f3e9bc719bfa
- https://git.kernel.org/stable/c/6b0e260ac3cf289e38446552461caa65e6dab275
- https://git.kernel.org/stable/c/88aac6684cf8bc885cca15463cb4407e91f28ff7
- https://git.kernel.org/stable/c/d29f59051d3a07b81281b2df2b8c9dfe4716067f
Modified: 2025-07-17
CVE-2022-48703
In the Linux kernel, the following vulnerability has been resolved: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR In some case, the GDDV returns a package with a buffer which has zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10). Then the data_vault_read() got NULL point dereference problem when accessing the 0x10 value in data_vault. [ 71.024560] BUG: kernel NULL pointer dereference, address: 0000000000000010 This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or NULL value in data_vault.
- https://git.kernel.org/stable/c/39d5137085a6c37ace4680ee4d24020a4a03e7dc
- https://git.kernel.org/stable/c/7931e28098a4c1a2a6802510b0cbe57546d2049d
- https://git.kernel.org/stable/c/dae42083b045a4ddf71c57cf350cb2412b5915c2
- https://git.kernel.org/stable/c/7931e28098a4c1a2a6802510b0cbe57546d2049d
- https://git.kernel.org/stable/c/dae42083b045a4ddf71c57cf350cb2412b5915c2
Modified: 2025-09-19
CVE-2022-48704
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: add a force flush to delay work when radeon
Although radeon card fence and wait for gpu to finish processing current batch rings,
there is still a corner case that radeon lockup work queue may not be fully flushed,
and meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to
put device in D3hot state.
Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State.
> Configuration and Message requests are the only TLPs accepted by a Function in
> the D3hot state. All other received Requests must be handled as Unsupported Requests,
> and all received Completions may optionally be handled as Unexpected Completions.
This issue will happen in following logs:
Unable to handle kernel paging request at virtual address 00008800e0008010
CPU 0 kworker/0:3(131): Oops 0
pc = [
- https://git.kernel.org/stable/c/16cb367daa446923d82e332537f446a4cc784b40
- https://git.kernel.org/stable/c/4e25e8f27fdbdc6fd55cc572a9939bf24500b9e8
- https://git.kernel.org/stable/c/5a7a5b2edac4b05abd744eeaebda46d9dacd952d
- https://git.kernel.org/stable/c/826b46fd5974113515abe9e4fc8178009a8ce18c
- https://git.kernel.org/stable/c/b878da58df2c40b08914d3960e2224040fd1fbfe
- https://git.kernel.org/stable/c/c0a45f41fde4a0f2c900f719817493ee5c4a5aa3
- https://git.kernel.org/stable/c/c72d97146fc5a4dff381b1737f6167e89860430d
- https://git.kernel.org/stable/c/f461950fdc374a3ada5a63c669d997de4600dffe
- https://git.kernel.org/stable/c/16cb367daa446923d82e332537f446a4cc784b40
- https://git.kernel.org/stable/c/4e25e8f27fdbdc6fd55cc572a9939bf24500b9e8
- https://git.kernel.org/stable/c/5a7a5b2edac4b05abd744eeaebda46d9dacd952d
- https://git.kernel.org/stable/c/826b46fd5974113515abe9e4fc8178009a8ce18c
- https://git.kernel.org/stable/c/b878da58df2c40b08914d3960e2224040fd1fbfe
- https://git.kernel.org/stable/c/c0a45f41fde4a0f2c900f719817493ee5c4a5aa3
- https://git.kernel.org/stable/c/c72d97146fc5a4dff381b1737f6167e89860430d
- https://git.kernel.org/stable/c/f461950fdc374a3ada5a63c669d997de4600dffe
Modified: 2025-09-19
CVE-2022-48705
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921e: fix crash in chip reset fail
In case of drv own fail in reset, we may need to run mac_reset several
times. The sequence would trigger system crash as the log below.
Because we do not re-enable/schedule "tx_napi" before disable it again,
the process would keep waiting for state change in napi_diable(). To
avoid the problem and keep status synchronize for each run, goto final
resource handling if drv own failed.
[ 5857.353423] mt7921e 0000:3b:00.0: driver own failed
[ 5858.433427] mt7921e 0000:3b:00.0: Timeout for driver own
[ 5859.633430] mt7921e 0000:3b:00.0: driver own failed
[ 5859.633444] ------------[ cut here ]------------
[ 5859.633446] WARNING: CPU: 6 at kernel/kthread.c:659 kthread_park+0x11d
[ 5859.633717] Workqueue: mt76 mt7921_mac_reset_work [mt7921_common]
[ 5859.633728] RIP: 0010:kthread_park+0x11d/0x150
[ 5859.633736] RSP: 0018:ffff8881b676fc68 EFLAGS: 00010202
......
[ 5859.633766] Call Trace:
[ 5859.633768]
Modified: 2025-10-01
CVE-2022-49733
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant.
- https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0
- https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb
- https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86
- https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d
- https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36
Closed bugs
Критическая ошибка ядра при загрузке модуля phy-rockchip-inno-usb2.ko на NanoPC-T4
