🛡️ OESA-2025-1282 — kernel (CVE-2021-47631 +26 more)

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ARM: davinci: da850-evm: Avoid NULL pointer dereference

With newer versions of GCC, there is a panic in da850_evm_config_emac()

when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine:

Unable to handle kernel NULL pointer dereference at virtual address 00000020

pgd = (ptrval)

[00000020] *pgd=00000000

Internal error: Oops: 5 [#1] PREEMPT ARM

Modules linked in:

CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1

Hardware name: Generic DT based system

PC is at da850_evm_config_emac+0x1c/0x120

LR is at do_one_initcall+0x50/0x1e0

The emac_pdata pointer in soc_info is NULL because davinci_soc_info only

gets populated on davinci machines but da850_evm_config_emac() is called

on all machines via device_initcall().

Move the rmii_en assignment below the machine check so that it is only

dereferenced when running on a supported SoC.(CVE-2021-47631)

In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow

Coverity complains of a possible buffer overflow. However,

given the 'static' scope of nvidia_setup_i2c_bus() it looks

like that can't happen after examiniing the call sites.

CID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)

1. fixed_size_dest: You might overrun the 48-character fixed-size string

chan->adapter.name by copying name without checking the length.

2. parameter_as_source: Note: This defect has an elevated risk because the

source argument is a parameter of the current function.

89 strcpy(chan->adapter.name, name);

Fix this warning by using strscpy() which will silence the warning and

prevent any future buffer overflows should the names used to identify the

channel become much longer.(CVE-2021-47642)

In the Linux kernel, the following vulnerability has been resolved:

dm integrity: fix memory corruption when tag_size is less than digest size

It is possible to set up dm-integrity in such a way that the

"tag_size" parameter is less than the actual digest size. In this

situation, a part of the digest beyond tag_size is ignored.

In this case, dm-integrity would write beyond the end of the

ic->recalc_tags array and corrupt memory. The corruption happened in

integrity_recalc->integrity_sector_checksum->crypto_shash_final.

Fix this corruption by increasing the tags array so that it has enough

padding at the end to accomodate the loop in integrity_recalc() being

able to write a full digest size for the last member of the tags

array.(CVE-2022-49044)

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Check for potential null return of kmalloc_array()

As the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference.

Therefore, it is better to check the return value of kmalloc_array() to avoid this confusion.(CVE-2022-49055)

In the Linux kernel, the following vulnerability has been resolved:

scsi: libfc: Fix use after free in fc_exch_abts_resp()

fc_exch_release(ep) will decrease the ep's reference count. When the

reference count reaches zero, it is freed. But ep is still used in the

following code, which will lead to a use after free.

Return after the fc_exch_release() call to avoid use after free.(CVE-2022-49114)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj

This issue takes place in an error path in

amdgpu_cs_fence_to_handle_ioctl(). When info->in.what falls into

default case, the function simply returns -EINVAL, forgetting to

decrement the reference count of a dma_fence obj, which is bumped

earlier by amdgpu_cs_get_fence(). This may result in reference count

leaks.

Fix it by decreasing the refcount of specific object before returning

the error code.(CVE-2022-49137)

In the Linux kernel, the following vulnerability has been resolved:

media: usb: go7007: s2250-board: fix leak in probe()

Call i2c_unregister_device(audio) on this error path.(CVE-2022-49253)

In the Linux kernel, the following vulnerability has been resolved:

extcon: Modify extcon device to be created after driver data is set

Currently, someone can invoke the sysfs such as state_show()

intermittently before dev_set_drvdata() is done.

And it can be a cause of kernel Oops because of edev is Null at that time.

So modified the driver registration to after setting drviver data.

• Oops's backtrace.

Backtrace:

[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)

[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)

[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)

[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)

[<c025e11c>] (seq_read)