ALT-PU-2021-2415-1
Package kernel-image-mp updated to version 5.13.8-alt1 for branch sisyphus in task 281799.
Closed vulnerabilities
BDU:2021-04027
Уязвимость функции hso_free_net_device драйвера /net/usb/hso.c ядра операционной системы Linux, позволяющая нарушителю оказать влияние на конфиденциальность, целостность и доступность
BDU:2021-04028
Уязвимость функции rtas_args.nargs драйвера arch/powerpc/kvm/book3s_rtas.c ядра операционной системы Linux, позволяющая нарушителю вызвать повреждение памяти операционной системы хоста
BDU:2021-04840
Уязвимость ядра операционной системы Linux , связанная с раскрытием информации через несоответствие, позволяющая нарушителю прочитать часть памяти ядра
BDU:2021-04845
Уязвимость ядра операционной системы Linux , связанная с раскрытием информации через несоответствие, позволяющая нарушителю получить конфиденциальную информацию
BDU:2021-04851
Уязвимость компонента drivers/usb/host/max3421-hcd.c ядра операционной системы Linux , связанная с использованием памяти после её освобождения, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-34556
In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.
- http://www.openwall.com/lists/oss-security/2021/08/01/3
- http://www.openwall.com/lists/oss-security/2021/08/01/3
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=2039f26f3aca5b0e419b98f65dd36481337b86ee
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=2039f26f3aca5b0e419b98f65dd36481337b86ee
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=f5e81d1117501546b7be050c5fbafa6efd2c722c
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=f5e81d1117501546b7be050c5fbafa6efd2c722c
- [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update
- [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update
- FEDORA-2021-54ee631709
- FEDORA-2021-54ee631709
- FEDORA-2021-4d4d3866ca
- FEDORA-2021-4d4d3866ca
Modified: 2024-11-21
CVE-2021-35477
In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=2039f26f3aca5b0e419b98f65dd36481337b86ee
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=2039f26f3aca5b0e419b98f65dd36481337b86ee
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=f5e81d1117501546b7be050c5fbafa6efd2c722c
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=f5e81d1117501546b7be050c5fbafa6efd2c722c
- [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update
- [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update
- FEDORA-2021-54ee631709
- FEDORA-2021-54ee631709
- FEDORA-2021-4d4d3866ca
- FEDORA-2021-4d4d3866ca
- https://www.openwall.com/lists/oss-security/2021/08/01/3
- https://www.openwall.com/lists/oss-security/2021/08/01/3
Modified: 2024-11-21
CVE-2021-37159
hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
- https://bugzilla.suse.com/show_bug.cgi?id=1188601
- https://bugzilla.suse.com/show_bug.cgi?id=1188601
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a6ecfb39ba9d7316057cea823b196b734f6b18ca
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a6ecfb39ba9d7316057cea823b196b734f6b18ca
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dcb713d53e2eadf42b878c12a471e74dc6ed3145
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dcb713d53e2eadf42b878c12a471e74dc6ed3145
- [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update
- [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update
- [debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update
- [debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update
- https://security.netapp.com/advisory/ntap-20210819-0003/
- https://security.netapp.com/advisory/ntap-20210819-0003/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.spinics.net/lists/linux-usb/msg202228.html
- https://www.spinics.net/lists/linux-usb/msg202228.html
Modified: 2024-11-21
CVE-2021-37576
arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e.
- [oss-security] 20210727 Re: Linux kernel: powerpc: KVM guest to host memory corruption
- [oss-security] 20210727 Re: Linux kernel: powerpc: KVM guest to host memory corruption
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f62f3c20647ebd5fb6ecb8f0b477b9281c44c10a
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f62f3c20647ebd5fb6ecb8f0b477b9281c44c10a
- FEDORA-2021-12618d9b08
- FEDORA-2021-12618d9b08
- FEDORA-2021-817b3d47d2
- FEDORA-2021-817b3d47d2
- https://lore.kernel.org/linuxppc-dev/87im0x1lqi.fsf%40mpe.ellerman.id.au/T/#u
- https://lore.kernel.org/linuxppc-dev/87im0x1lqi.fsf%40mpe.ellerman.id.au/T/#u
- https://security.netapp.com/advisory/ntap-20210917-0005/
- https://security.netapp.com/advisory/ntap-20210917-0005/
- DSA-4978
- DSA-4978
Modified: 2024-11-21
CVE-2021-38204
drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
- https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
- https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
- [debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update
- [debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update