See how linux compares to other vendors in security performance
.NET Elevation of Privilege Vulnerability
.NET Elevation of Privilege Vulnerability
.NET Elevation of Privilege Vulnerability
.NET Denial of Service Vulnerability
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.
drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. If tcfchangeindev() fails, u32setparms() will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=04c55383fa5689357bcdd2c8036725a55ed632bc
A use-after-free flaw was found in mm/mempolicy.c in memory management subsystem in the Linux Kernel. This problem is caused by a race between mbind() and VMA-locked page fault, where a local attacker may crash the system, this flaw could even lead to a kernel information leak threat.
Refer: https://www.spinics.net/lists/stable-commits/msg310136.html
A use-after-free vulnerability in the Linux kernel's afunix component can be exploited to achieve local privilege escalation.
The unixstreamsendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unixstreamsendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.
We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.
i2c: imx: Cancel hrtimer before clearing slave pointer
Bluetooth: ISO: fix use-after-free of listener socket in isoconnready
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: zero stale crypto bits
When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
This GlobalProtect app on iOS, Android and ChromeOS is not impacted.
HID: multitouch: fix out-of-bounds bit access on mtioflags
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.
The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted.
The GlobalProtect app on iOS, Android, and Chrome OS is not affected.
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux).
An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.
The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.
can: bcm: switch timer to HRTIMERMODESOFT and remove hrtimertasklet commit bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68
This patch switches the timer to HRTIMERMODESOFT, which executed the timer callback in softirq context and removes the hrtimertasklet.
In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdiscpktlensegsinit()
Most ndostartxmit() methods expects headers of gso packets to be already in skb->head.
net/core/tso.c users are particularly at risk, because tsobuildhdr() does a memcpy(hdr, skb->data, hdrlen);
qdiscpktlensegsinit() already does a dissection of gso packets.
Use pskbmaypull() instead of skbheaderpointer() to make sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKBDROPREASONSKBBADGSO dropreason.
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: avoid double drmexecfini() in userq validate
When newaddition is true, amdgpuuserqvmvalidate() calls drmexecfini(&exec) before iterating over the collected HMM ranges and calling amdgputtmttgetuserpages().
If amdgputtmttgetuserpages() fails in that path, the code jumps to unlockall and calls drmexecfini(&exec) a second time on the same exec object. drmexecfini() is not idempotent: it frees exec->objects and may also drop exec->contended and finalize the ww acquire context.
Route that error path directly to the range cleanup once exec has already been finalized.
Issue found using a prototype static analysis tool and confirmed by code review.
(cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)
In the Linux kernel, the following vulnerability has been resolved:
fs/smb/client: fix out-of-bounds read in cifssanitizeprepath
When cifssanitizeprepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check (cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read.
This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL.
The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01.
As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB.
A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data.
This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected.
gve: fix Rx queue stall on alloc failure
In the Linux kernel, the following vulnerability has been resolved:
fs/smb/client: fix out-of-bounds read in cifssanitizeprepath
When cifssanitizeprepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check (cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read.
This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL.
The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.
In the Linux kernel, the following vulnerability has been resolved:
crypto: krb5 - use kfreesensitive() for derived key buffers
cryptokrb5prepareencryption() and cryptokrb5preparechecksum() free the buffer holding the freshly derived keys with plain kfree(), leaving the key material behind in the freed slab object.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage
Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check.
Increase buffer size in manglecontentlen() while at it.
BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 manglecontentlen+0x1ac/0x280 nfnatsdpsession+0x1cc/0x240 processsdp+0x8f8/0xb80 processinviterequest+0x108/0x2b0 processsipmsg+0x5da/0xf50 siphelptcp+0x45e/0x780 nfconfirm+0x34d/0x990 [..]