In the Linux kernel, the following vulnerability has been resolved:
ipack: ipoctal: fix stack information leak
The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space (or triggering an oops).
Drivers should not try to encode topology information in the tty device name but this one snuck in through staging without anyone noticing and another driver has since copied this malpractice.
Fixing the ABI is a separate issue, but this at least plugs the security hole.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade dtb-rockchipUpgrade dtb-alteraUpgrade dlm-kmp-rtUpgrade kernel-develUpgrade reiserfs-kmp-azureUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-rtUpgrade dtb-broadcomUpgrade kernel-default-optionalUpgrade kernel-rt-extraUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-azure-optionalUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-defaultUpgrade dtb-allwinnerUpgrade dtb-xilinxUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade dtb-nvidiaUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-debug-develUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-default-vdsoUpgrade kernel-64kb-extraUpgrade kernel-rt-livepatchUpgrade kernel-azure-baseUpgrade ocfs2-kmp-azureUpgrade dtb-sprdUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-azureUpgrade kernel-rt-optionalUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-default-baseUpgrade dtb-socionextUpgrade kernel-debug-vdsoUpgrade dlm-kmp-defaultUpgrade dtb-caviumUpgrade dtb-amdUpgrade dtb-marvellUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-rt_debugUpgrade dtb-hisiliconUpgrade kernel-64kbUpgrade dtb-qcomUpgrade dtb-appleUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade kernel-symsUpgrade kernel-devel-rtUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-64kbUpgrade dtb-armUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extraUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade dtb-amlogicUpgrade kernel-64kb-optionalUpgrade dlm-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade kernel-azure-extraUpgrade dtb-exynosUpgrade kernel-default-manUpgrade kernel-devel-azureUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade dtb-lgUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-mediatekUpgrade kselftests-kmp-64kb | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-bluefieldUpgrade linux-azure-4.15Upgrade linux-gcp-4.15Upgrade linux-azure-5.4Upgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linuxUpgrade linux-hweUpgrade linux-awsUpgrade linux-gcp-5.4Upgrade linux-azureUpgrade linux-gcp-fipsUpgrade linux-raspi-5.4Upgrade linux-ibmUpgrade linux-fipsUpgrade linux-oracleUpgrade linux-gcpUpgrade linux-kvmUpgrade linux-azure-fipsUpgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-gkeopUpgrade linux-aws-hweUpgrade linux-aws-5.4 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub