Paste issue descriptions from older advisories

1 files changed, 42 insertions, 25 deletions

diff --git a/dsa-texts/4.9.303-1 b/dsa-texts/4.9.303-1
index fc3b625b8..90d4e953f 100644
--- a/dsa-texts/4.9.303-1
+++ b/dsa-texts/4.9.303-1
@@ -41,35 +41,38 @@ CVE-2021-4083
 
 CVE-2021-4155
 
-    Description
+    Kirill Tkhai discovered a data leak in the way the XFS_IOC_ALLOCSP
+    IOCTL in the XFS filesystem allowed for a size increase of files
+    with unaligned size. A local attacker can take advantage of this
+    flaw to leak data on the XFS filesystem.
 
 CVE-2021-4202
 
     Description
 
-CVE-2021-28711
-
-    Description
-
-CVE-2021-28712
+CVE-2021-28711, CVE-2021-28712, CVE-2021-28713 (XSA-391)
 
-    Description
+    Juergen Gross reported that malicious PV backends can cause a denial
+    of service to guests being serviced by those backends via high
+    frequency events, even if those backends are running in a less
+    privileged environment.
 
-CVE-2021-28713
+CVE-2021-28714, CVE-2021-28715 (XSA-392)
 
-    Description
-
-CVE-2021-28714
-
-    Description
-
-CVE-2021-28715
-
-    Description
+    Juergen Gross discovered that Xen guests can force the Linux
+    netback driver to hog large amounts of kernel memory, resulting in
+    denial of service.
 
 CVE-2021-29264
 
-    Description
+    It was discovered that the "gianfar" Ethernet driver used with
+    some Freescale SoCs did not correctly handle a Rx queue overrun
+    when jumbo packets were enabled.  On systems using this driver and
+    jumbo packets, an attacker on the network could exploit this to
+    cause a denial of service (crash).
+
+    This driver is not enabled in Debian's official kernel
+    configurations.
 
 CVE-2021-33033
 
@@ -77,15 +80,21 @@ CVE-2021-33033
 
 CVE-2021-39685
 
-    Description
+    Szymon Heidrich discovered a buffer overflow vulnerability in the
+    USB gadget subsystem, resulting in information disclosure, denial of
+    service or privilege escalation.
 
 CVE-2021-43976
 
-    Description
+    Zekun Shen and Brendan Dolan-Gavitt discovered a flaw in the
+    mwifiex_usb_recv() function of the Marvell WiFi-Ex USB Driver. An
+    attacker able to connect a crafted USB device can take advantage of
+    this flaw to cause a denial of service.
 
 CVE-2021-45095
 
-    Description
+    It was discovered that the Phone Network protocol (PhoNet) driver
+    has a reference count leak in the pep_sock_accept() function.
 
 CVE-2022-0001
 
@@ -97,11 +106,15 @@ CVE-2022-0002
 
 CVE-2022-0330
 
-    Description
+    Sushma Venkatesh Reddy discovered a missing GPU TLB flush in the
+    i915 driver, resulting in denial of service or privilege escalation.
 
 CVE-2022-0435
 
-    Description
+    Samuel Page and Eric Dumazet reported a stack overflow in the
+    networking module for the Transparent Inter-Process Communication
+    (TIPC) protocol, resulting in denial of service or potentially the
+    execution of arbitrary code.
 
 CVE-2022-0487
 
@@ -121,11 +134,15 @@ CVE-2022-24448
 
 CVE-2022-25258
 
-    Description
+    Szymon Heidrich reported the USB Gadget subsystem lacks certain
+    validation of interface OS descriptor requests, resulting in memory
+    corruption.
 
 CVE-2022-25375
 
-    Description
+    Szymon Heidrich reported that the RNDIS USB gadget lacks validation
+    of the size of the RNDIS_MSG_SET command, resulting in information
+    leak from kernel memory.
 
 For Debian 9 stretch, these problems have been fixed in version
 4.9.303-1.