Поиск уязвимостей

In the Linux kernel, the following vulnerability has been resolved: binder: fix async_free_space accounting for empty parcels In 4.13, commit 74310e06be4d ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are ...

In the Linux kernel, the following vulnerability has been resolved: binder: fix async_free_space accounting for empty parcels In 4.13, commit 74310e06be4d ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are ...

In the Linux kernel, the following vulnerability has been resolved: binder: fix async_free_space accounting for empty parcels In 4.13, commit 74310e06be4d ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are

In the Linux kernel, the following vulnerability has been resolved: b ...

In the Linux kernel, the following vulnerability has been resolved: binder: fix async_free_space accounting for empty parcels In 4.13, commit 74310e06be4d ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These ...

Уязвимость функции async_free_space() в компоненте binder ядра операционной системы Linux, позволяющая нарушителю раскрыть защищаемую информацию

Множественные уязвимости kernel-lt

ALT-PU-2022-7795: package `kernel-image-std-def` update to version 5.10.90-alt1

ALT-PU-2022-1108: package `kernel-image-mp` update to version 5.15.16-alt1

ALT-PU-2022-7708: package `kernel-image-std-def` update to version 5.10.90-alt1

ALT-PU-2022-1051: package `kernel-image-un-def` update to version 5.15.14-alt1

ALT-PU-2022-1026: package `kernel-image-un-def` update to version 5.15.14-alt1

ALT-PU-2022-1012: package `kernel-image-rt` update to version 5.10.90-alt1.rt60

ALT-PU-2022-1057: package `kernel-image-std-kvm` update to version 5.10.91-alt1

ALT-PU-2022-7822: package `kernel-image-xenomai` update to version 4.19.229-alt1.cip67.21

ALT-PU-2022-1016: package `kernel-image-rpi-un` update to version 5.15.13-alt1

ALT-PU-2022-1015: package `kernel-image-rpi-un` update to version 5.15.13-alt1

ALT-PU-2022-1428: package `kernel-image-rt` update to version 5.10.100-alt1.rt62

ALT-PU-2022-2096: package `kernel-image-xenomai` update to version 4.19.229-alt1.cip67.21

ALT-PU-2022-1421: package `kernel-image-rpi-def` update to version 5.15.25-alt1