firmware-nonfree - Debian Package Tracker

general

source: firmware-nonfree (non-free-firmware)
version: 20250410-1
maintainer: Debian Kernel Team (archive) (DMD)
uploaders: Steve Langasek [DMD] – Bastian Blank [DMD] – Salvatore Bonaccorso [DMD] – maximilian attems [DMD] – Ben Hutchings [DMD]
arch: all
std-ver: 4.3.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 20190114-2
o-o-sec: 20190114+really20220913-0+deb10u2
oldstable: 20210315-3
old-bpo: 20230210-5~bpo11+1
stable: 20230210-5
stable-bpo: 20241210-1~bpo12+1
testing: 20241210-1
unstable: 20250410-1

versioned links

20190114-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20190114+really20220913-0+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20210315-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20230210-5~bpo11+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20230210-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20241210-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20241210-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20250410-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

firmware-amd-graphics (9 bugs: 0, 9, 0, 0)
firmware-atheros (4 bugs: 0, 4, 0, 0)
firmware-bnx2
firmware-bnx2x
firmware-brcm80211 (3 bugs: 0, 3, 0, 0)
firmware-cavium
firmware-cirrus
firmware-intel-graphics
firmware-intel-misc
firmware-intel-sound
firmware-ipw2x00
firmware-ivtv
firmware-iwlwifi (16 bugs: 0, 16, 0, 0)
firmware-libertas
firmware-linux
firmware-linux-nonfree (4 bugs: 0, 1, 3, 0)
firmware-marvell-prestera
firmware-mediatek
firmware-misc-nonfree (13 bugs: 0, 11, 2, 0)
firmware-myricom
firmware-netronome
firmware-netxen (1 bugs: 0, 1, 0, 0)
firmware-nvidia-graphics
firmware-qcom-media
firmware-qcom-soc
firmware-qlogic
firmware-realtek (6 bugs: 0, 6, 0, 0)
firmware-samsung
firmware-siano (1 bugs: 0, 1, 0, 0)
firmware-ti-connectivity (1 bugs: 0, 1, 0, 0)

action needed

Marked for autoremoval on 12 May: #1102999 high

Version 20241210-1 of firmware-nonfree is marked for autoremoval from testing on Mon 12 May 2025. It is affected by #1102999. You should try to prevent the removal by fixing these RC bugs.

Created: 2025-04-21 Last update: 2025-04-24 12:27

21 security issues in bullseye high

There are 21 open security issues in bullseye.

4 important issues:

CVE-2024-23198: Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access.
CVE-2024-24984: Improper input validation for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.40 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2024-25563: Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow a privileged user to potentially enable information disclosure via local access.
CVE-2024-28049: Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access.

17 issues postponed or untriaged:

CVE-2023-4969: (needs triaging) A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
CVE-2020-24586: (needs triaging) The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
CVE-2020-24587: (needs triaging) The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.
CVE-2020-24588: (needs triaging) The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
CVE-2021-23168: (needs triaging) Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2021-23223: (needs triaging) Improper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2021-37409: (needs triaging) Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2021-44545: (needs triaging) Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2022-21181: (needs triaging) Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2022-27635: (needs triaging) Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2022-36351: (needs triaging) Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2022-38076: (needs triaging) Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-40964: (needs triaging) Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2022-46329: (needs triaging) Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2023-35061: (needs triaging) Improper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
CVE-2023-38417: (needs triaging) Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-47210: (needs triaging) Improper input validation for some Intel(R) PROSet/Wireless WiFi software for linux before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

Created: 2024-11-16 Last update: 2025-04-21 06:01

13 security issues in buster high

There are 13 open security issues in buster.

12 important issues:

CVE-2023-25951: Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2023-26586: Uncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-28374: Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-28720: Improper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access..
CVE-2023-32642: Insufficient adherence to expected conventions for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-32644: Protection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-32651: Improper validation of specified type of input for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-33875: Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via local access..
CVE-2023-34983: Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-35061: Improper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
CVE-2023-38417: Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-47210: Improper input validation for some Intel(R) PROSet/Wireless WiFi software for linux before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

1 issue postponed or untriaged:

CVE-2023-4969: (postponed; to be fixed through a stable update) A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.

Created: 2024-05-02 Last update: 2024-05-22 17:48

4 bugs tagged help in the BTS normal

The BTS contains 4 bugs tagged help, please consider helping the maintainer in dealing with them.

Created: 2019-03-21 Last update: 2025-04-24 12:25

4 bugs tagged patch in the BTS normal

The BTS contains patches fixing 4 bugs (5 if counting merged bugs), consider including or untagging them.

Created: 2025-01-06 Last update: 2025-04-24 12:25

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 20250410-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 55e0dec83c79fe02889168c2598de120ff7e1016
Author: Salvatore Bonaccorso <carnil@debian.org>
Date:   Thu Apr 24 07:22:06 2025 +0200

    debian/watch: Add back back slash to concatenate the separte lines for the uscan invocation
    
    Fixes: ffd704715c3d ("Update upstream URLs to point to repository on gitlab.com")

commit 3540e39389ddfc9cd6a301961fe128f60f50bec8
Merge: 4a948f8 ffd7047
Author: Ben Hutchings <benh@debian.org>
Date:   Wed Apr 23 23:57:27 2025 +0000

    Merge branch 'update-upstream-url' into 'debian/latest'
    
    Update upstream URLs to point to repository on gitlab.com
    
    See merge request kernel-team/firmware-nonfree!124

commit ffd704715c3d1b4e021f5ac034cc0648cf22422b
Author: Ben Hutchings <benh@debian.org>
Date:   Wed Apr 23 04:29:23 2025 +0200

    Update upstream URLs to point to repository on gitlab.com
    
    The canonical repository for linux-firmware, as documented in
    README.md, is now on gitlab.com.  Update the Homepage field in
    debian/control, the Source field in debian/copyright, and the URL in
    debian/watch accordingly.

Created: 2025-04-24 Last update: 2025-04-24 06:30

AppStream hints: 1 warning for firmware-bnx2,firmware-intel-graphics,firmware-qlogic,firmware-nvidia-graphics,firmware-intel-sound,firmware-ipw2x00,firmware-amd-graphics,firmware-intel-misc,firmware-iwlwifi,firmware-samsung,firmware-realtek,firmware-libertas,firmware-ti-connectivity,firmware-mediatek,firmware-cavium,firmware-atheros,firmware-marvell-prestera,firmware-bnx2x,firmware-brcm80211,firmware-misc-nonfree,firmware-siano,firmware-myricom,firmware-qcom-soc,firmware-ivtv,firmware-cirrus,firmware-netronome,firmware-netxen normal

AppStream found metadata issues for packages:

firmware-ipw2x00: 1 warning

You should get rid of them to provide more metadata about this software.

Created: 2024-01-27 Last update: 2025-04-21 17:20

debian/patches: 2 patches to forward upstream low

Among the 5 debian patches available in version 20250410-1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-12-20 Last update: 2025-04-21 10:32

No known security issue in bookworm wishlist

There are 13 open security issues in bookworm.

13 ignored issues:

CVE-2023-4969: A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
CVE-2022-27635: Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2022-36351: Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2022-38076: Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-40964: Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2022-46329: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2023-35061: Improper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
CVE-2023-38417: Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-47210: Improper input validation for some Intel(R) PROSet/Wireless WiFi software for linux before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2024-23198: Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access.
CVE-2024-24984: Improper input validation for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.40 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2024-25563: Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow a privileged user to potentially enable information disclosure via local access.
CVE-2024-28049: Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access.

Created: 2023-08-18 Last update: 2025-04-21 06:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.3.0).

Created: 2023-05-16 Last update: 2025-04-21 04:01

testing migrations

excuses:
- Migration status for firmware-nonfree (20241210-1 to 20250410-1): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Too young, only 3 of 10 days old
- Additional info:
- ∙ ∙ Updating firmware-nonfree will fix bugs in testing: #1102999
- ∙ ∙ Cannot be tested by piuparts (not a blocker) - (no link yet)
- Not considered

news

[rss feed]

[2025-04-21] Accepted firmware-nonfree 20250410-1 (source) into unstable (Ben Hutchings)
[2025-04-15] Accepted firmware-nonfree 20250311-1 (source) into unstable (Ben Hutchings)
[2025-04-14] Accepted firmware-nonfree 20250211-1 (source) into unstable (Ben Hutchings)
[2025-04-13] Accepted firmware-nonfree 20250109-1 (source) into unstable (Ben Hutchings)
[2025-03-20] Accepted firmware-nonfree 20241210-1~bpo12+1 (source) into stable-backports (Ben Hutchings)
[2024-12-25] firmware-nonfree 20241210-1 MIGRATED to testing (Debian testing watch)
[2024-12-19] Accepted firmware-nonfree 20241210-1 (source) into unstable (Ben Hutchings)
[2024-11-04] firmware-nonfree 20240909-2 MIGRATED to testing (Debian testing watch)
[2024-10-30] Accepted firmware-nonfree 20240909-2 (source) into unstable (Ben Hutchings)
[2024-10-07] Accepted firmware-nonfree 20240909-1 (source) into unstable (Ben Hutchings)
[2024-10-07] Accepted firmware-nonfree 20240811-1 (source) into unstable (Ben Hutchings)
[2024-09-06] Accepted firmware-nonfree 20240709-2~bpo12+1 (all source) into stable-backports (Debian FTP Masters) (signed by: Ben Hutchings)
[2024-09-06] firmware-nonfree 20240709-2 MIGRATED to testing (Debian testing watch)
[2024-09-01] Accepted firmware-nonfree 20240709-2 (source) into unstable (Ben Hutchings)
[2024-08-01] firmware-nonfree 20240709-1 MIGRATED to testing (Debian testing watch)
[2024-07-26] Accepted firmware-nonfree 20240709-1 (source) into unstable (Ben Hutchings)
[2024-07-21] firmware-nonfree 20240610-1 MIGRATED to testing (Debian testing watch)
[2024-07-15] Accepted firmware-nonfree 20240610-1 (source) into unstable (Ben Hutchings)
[2024-06-30] Accepted firmware-nonfree 20230625-3~exp3 (source) into experimental (Ben Hutchings)
[2024-06-18] Accepted firmware-nonfree 20230625-3~exp2 (all source) into experimental (Debian FTP Masters) (signed by: Ben Hutchings)
[2023-12-25] firmware-nonfree 20230625-2 MIGRATED to testing (Debian testing watch)
[2023-12-19] Accepted firmware-nonfree 20230625-2 (source) into unstable (Salvatore Bonaccorso)
[2023-12-04] firmware-nonfree 20230625-1 MIGRATED to testing (Debian testing watch)
[2023-11-29] Accepted firmware-nonfree 20230625-1 (source) into unstable (Salvatore Bonaccorso)
[2023-11-25] Accepted firmware-nonfree 20230515-4 (source) into experimental (Ben Hutchings)
[2023-09-30] Accepted firmware-nonfree 20190114+really20220913-0+deb10u2 (source all) into oldoldstable (Tobias Frost)
[2023-07-17] Accepted firmware-nonfree 20230210-5~bpo11+1 (source) into bullseye-backports (Debian FTP Masters) (signed by: Ben Hutchings)
[2023-07-10] firmware-nonfree 20230515-3 MIGRATED to testing (Debian testing watch)
[2023-07-10] firmware-nonfree 20230515-3 MIGRATED to testing (Debian testing watch)
[2023-07-04] Accepted firmware-nonfree 20230515-3 (source) into unstable (Salvatore Bonaccorso)

bugs [bug history graph]

all: 70 75
RC: 0
I&N: 56 58
M&W: 14 17
F&P: 0
patch: 4 5
help: 4

links

buildd: logs
popcon
browse source code
edit tags
other distros
security tracker
debian patches