In the Linux kernel, the following vulnerability has been resolved:
ipack: ipoctal: fix stack information leak
The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space (or triggering an oops).
Drivers should not try to encode topology information in the tty device name but this one snuck in through staging without anyone noticing and another driver has since copied this malpractice.
Fixing the ABI is a separate issue, but this at least plugs the security hole.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade dlm-kmp-defaultUpgrade dtb-xilinxUpgrade dtb-marvellUpgrade kernel-source-rtUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade dtb-sprdUpgrade dtb-amdUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-vanillaUpgrade ocfs2-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-debug-develUpgrade kselftests-kmp-rtUpgrade kernel-rt-optionalUpgrade dtb-renesasUpgrade kernel-obs-buildUpgrade dtb-alteraUpgrade dtb-nvidiaUpgrade kernel-default-livepatchUpgrade dtb-rockchipUpgrade kernel-defaultUpgrade kernel-default-vdsoUpgrade dlm-kmp-rtUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-baseUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-azureUpgrade dtb-socionextUpgrade kernel-docsUpgrade ocfs2-kmp-64kbUpgrade dtb-broadcomUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade kernel-rt-livepatchUpgrade dtb-allwinnerUpgrade dtb-caviumUpgrade kernel-rt-extraUpgrade kernel-azureUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-default-optionalUpgrade kernel-develUpgrade reiserfs-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-devel-azureUpgrade dtb-hisiliconUpgrade dtb-qcomUpgrade kernel-sourceUpgrade gfs2-kmp-rtUpgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade kernel-syms-azureUpgrade dlm-kmp-64kbUpgrade kernel-macrosUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-64kbUpgrade kernel-default-extraUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-develUpgrade kernel-default-develUpgrade dtb-mediatekUpgrade dtb-freescaleUpgrade kernel-64kb-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade dtb-apmUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-rt_debug-vdsoUpgrade dtb-lgUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade kernel-devel-rtUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade kselftests-kmp-defaultUpgrade dtb-armUpgrade kernel-kvmsmall-develUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade dtb-exynosUpgrade kernel-64kb-optionalUpgrade kernel-default-manUpgrade dtb-amazonUpgrade kernel-debugUpgrade kselftests-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-rt_debugUpgrade kernel-obs-qa | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-fipsUpgrade linux-azureUpgrade linux-azure-4.15Upgrade linux-gcp-5.4Upgrade linux-bluefieldUpgrade linux-hweUpgrade linux-gcp-fipsUpgrade linux-gcp-4.15Upgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-raspi-5.4Upgrade linuxUpgrade linux-ibmUpgrade linux-hwe-5.4Upgrade linux-aws-hweUpgrade linux-gkeopUpgrade linux-oracle-5.4Upgrade linux-raspiUpgrade linux-oracleUpgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-gcpUpgrade linux-azure-fipsUpgrade linux-fips | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub