CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2021-47160 – net: dsa: mt7530: fix VLAN traffic leaks
https://notcve.org/view.php?id=CVE-2021-47160
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix VLAN traffic leaks PCR_MATRIX field was set to all 1's when VLAN filtering is enabled, but was not reset when it is disabled, which may cause traffic leaks: ip link add br0 type bridge vlan_filtering 1 ip link add br1 type bridge vlan_filtering 1 ip link set swp0 master br0 ip link set swp1 master br1 ip link set br0 type bridge vlan_filtering 0 ip link set br1 type bridge vlan_filtering 0 # traffic in br0 and br1 will start leaking to each other As port_bridge_{add,del} have set up PCR_MATRIX properly, remove the PCR_MATRIX write from mt7530_port_set_vlan_aware. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net: dsa: mt7530: corregir fugas de tráfico de VLAN El campo PCR_MATRIX se configuró en todos 1 cuando el filtrado de VLAN está habilitado, pero no se restableció cuando está deshabilitado, lo que puede causar fugas de tráfico: enlace ip agregar puente tipo br0 vlan_filtering 1 enlace ip agregar puente tipo br1 vlan_filtering 1 conjunto de enlaces ip swp0 master br0 conjunto de enlaces ip swp1 maestro br1 conjunto de enlaces ip br0 puente tipo vlan_filtering 0 conjunto de enlaces ip br1 tipo puente vlan_filtering 0 # tráfico en br0 y br1 comenzarán a filtrarse entre sí. Como port_bridge_{add,del} ha configurado PCR_MATRIX correctamente, elimine la escritura PCR_MATRIX de mt7530_port_set_vlan_aware. • https://git.kernel.org/stable/c/83163f7dca5684816d01c8ccf4857aa74801e7b7 https://git.kernel.org/stable/c/ae389812733b1b1e8e07fcc238e41db166b5c78d https://git.kernel.org/stable/c/4fe4e1f48ba119bdbc7c897c83b04ba0d08f5488 https://git.kernel.org/stable/c/b91117b66fe875723a4e79ec6263526fffdb44d2 https://git.kernel.org/stable/c/82ae35b6c14feae5f216913d5b433e143c756d4e https://git.kernel.org/stable/c/474a2ddaa192777522a7499784f1d60691cd831a •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2021-47159 – net: dsa: fix a crash if ->get_sset_count() fails
https://notcve.org/view.php?id=CVE-2021-47159
In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix a crash if ->get_sset_count() fails If ds->ops->get_sset_count() fails then it "count" is a negative error code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative error code is type promoted to a very high value and the loop will corrupt memory until the system crashes. Fix this by checking for error codes and changing the type of "i" to just int. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: dsa: corrige un bloqueo si ->get_sset_count() falla. Si ds->ops->get_sset_count() falla, entonces "count" es un código de error negativo como - EOPNOTSUPP. Debido a que "i" es un int sin signo, el código de error negativo se promociona a un valor muy alto y el bucle corromperá la memoria hasta que el sistema falle. • https://git.kernel.org/stable/c/badf3ada60ab8f76f9488dc8f5c0c57f70682f5a https://git.kernel.org/stable/c/0f2cb08c57edefb0e7b5045e0e3e9980a3d3aa37 https://git.kernel.org/stable/c/ce5355f140a7987011388c7e30c4f8fbe180d3e8 https://git.kernel.org/stable/c/caff86f85512b8e0d9830e8b8b0dfe13c68ce5b6 https://git.kernel.org/stable/c/7b22466648a4f8e3e94f57ca428d1531866d1373 https://git.kernel.org/stable/c/a269333fa5c0c8e53c92b5a28a6076a28cde3e83 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47158 – net: dsa: sja1105: add error handling in sja1105_setup()
https://notcve.org/view.php?id=CVE-2021-47158
In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: add error handling in sja1105_setup() If any of sja1105_static_config_load(), sja1105_clocking_setup() or sja1105_devlink_setup() fails, we can't just return in the middle of sja1105_setup() or memory will leak. Add a cleanup path. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: dsa: sja1105: agregue manejo de errores en sja1105_setup() Si alguno de sja1105_static_config_load(), sja1105_clocking_setup() o sja1105_devlink_setup() falla, no podemos simplemente regresar en el medio de sja1105_setup() o se perderá memoria. Agregue una ruta de limpieza. • https://git.kernel.org/stable/c/8aa9ebccae87621d997707e4f25e53fddd7e30e4 https://git.kernel.org/stable/c/dd8609f203448ca6d58ae71461208b3f6b0329b0 https://git.kernel.org/stable/c/987e4ab8b8a4fcbf783069e03e7524cd39ffd563 https://git.kernel.org/stable/c/cec279a898a3b004411682f212215ccaea1cd0fb •
CVSS: 6.0EPSS: 0%CPEs: 8EXPL: 0CVE-2021-47153 – i2c: i801: Don't generate an interrupt on bus reset
https://notcve.org/view.php?id=CVE-2021-47153
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Don't generate an interrupt on bus reset Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling the end of a successful transaction. In the case of a block transaction, this can result in an out-of-range memory access. This condition was reproduced several times by syzbot: https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e https://syzkaller.appspot.com/bug? • https://git.kernel.org/stable/c/636752bcb5177a301d0266270661581de8624828 https://git.kernel.org/stable/c/f9469082126cebb7337db3992d143f5e4edfe629 https://git.kernel.org/stable/c/09c9e79f4c10cfb6b9e0e1b4dd355232e4b5a3b3 https://git.kernel.org/stable/c/dfa8929e117b0228a7765f5c3f5988a4a028f3c6 https://git.kernel.org/stable/c/c70e1ba2e7e65255a0ce004f531dd90dada97a8c https://git.kernel.org/stable/c/04cc05e3716ae31b17ecdab7bc55c8170def1b8b https://git.kernel.org/stable/c/b523feb7e8e44652f92f3babb953a976e7ccbbef https://git.kernel.org/stable/c/1f583d3813f204449037cd2acbfc09168 • CWE-125: Out-of-bounds Read •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47152 – mptcp: fix data stream corruption
https://notcve.org/view.php?id=CVE-2021-47152
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data stream corruption Maxim reported several issues when forcing a TCP transparent proxy to use the MPTCP protocol for the inbound connections. He also provided a clean reproducer. The problem boils down to 'mptcp_frag_can_collapse_to()' assuming that only MPTCP will use the given page_frag. If others - e.g. the plain TCP protocol - allocate page fragments, we can end-up re-using already allocated memory for mptcp_data_frag. Fix the issue ensuring that the to-be-expanded data fragment is located at the current page frag end. v1 -> v2: - added missing fixes tag (Mat) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mptcp: corrige la corrupción del flujo de datos Maxim informó varios problemas al forzar a un proxy transparente TCP a utilizar el protocolo MPTCP para las conexiones entrantes. También proporcionó un reproductor limpio. El problema se reduce a 'mptcp_frag_can_collapse_to()' suponiendo que sólo MPTCP utilizará el page_frag dado. Si otros (por ejemplo, el protocolo TCP simple) asignan fragmentos de página, podemos terminar reutilizando la memoria ya asignada para mptcp_data_frag. • https://git.kernel.org/stable/c/18b683bff89d46ace55f12d00c0440d44d6160c4 https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34 https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8 https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154 •