2401 matches found
PT-2024-6210
Name of the Vulnerable Software and Affected Versions HDF5 Library versions prior to 1.14.4 Description The issue is related to a buffer overflow in the heap, caused by the H5A close function in the H5Aint.c file of the HDF5 library, leading to corruption of the instruction pointer. This can be...
PT-2024-6207
Name of the Vulnerable Software and Affected Versions HDF5 Library versions 1.14.3 and earlier Description The issue is related to a corrupted instruction pointer due to a SEGV in the H5T close real function in the H5T.c file. This is caused by a buffer overflow in memory, which can lead to a...
CVE-2024-1930 No Limit on Number of Open Sessions / Bad Session Close Behaviour
No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the opensession D-Bus method. For each...
CVE-2022-48688 i40e: Fix kernel crash during module removal
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix kernel crash during module removal The driver incorrectly frees client instance and subsequent i40e module removal leads to kernel crash. Reproducer: 1. Do ethtool offline test followed immediately by another one host...
PT-2024-4090
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a slab-use-after-free vulnerability in the msft do close function. This vulnerability is caused by a race condition where the msft-data is freed in hci release de...
CVE-2024-27057
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend When the system is suspended while audio is active, the sofipc4pcmhwfree is invoked to reset the pipelines since during suspend the DSP is turned off, streams...
CVE-2024-26959
CVE-2024-26959 affects the Linux kernel Bluetooth subsystem (btnxpuart). The issue is a scheduling while atomic BUG in btnxpuart_close that could leave the transmit queue unpurged and skb release unsafe. The fixed path is in btnxpuart_close, with related call chain through tty/serdev/uart during ...
kernel: tty: n_gsm: fix deadlock and link starvation in outgoing data path
In the Linux kernel, the following vulnerability has been resolved: tty: ngsm: fix deadlock and link starvation in outgoing data path The current implementation queues up new control and user packets as needed and processes this queue down to the ldisc in the same code path. That means that the...
kernel: Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcildisc,serdev: check percpuinitrwsem failure syzbot is reporting NULL pointer dereference at hciuartttyclose 1, for rcusyncenter is called without rcusyncinit due to hciuartttyopen ignoring percpuinitrwsem failure...
kernel: scsi: target: iscsit: Free cmds before session free
A use-after-free vulnerability was found in the Linux kernel's iSCSI target subsystem. When the Time2Retain timer expires and an iSCSI session is being cleaned up, commands from recovery entries are freed after the session has already been closed. This leads to a NULL pointer dereference or...
kernel: tls: race between tx work scheduling and socket close
A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread recvmsg/sendmsg may exit as soon as the async crypto handler calls complete, which could lead to undefined behavior and a denial of service...
kernel: tls: race between async notify and socket close
A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread that calls recvmsg/sendmsg may exit as soon as the async crypto handler calls complete; any code past that point risks touching already freed data. This could lead to a use-after-free issue an...
PT-2025-38184
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to Bluetooth handling. Specifically, a NULL pointer dereference can occur in the hci uart tty close function due to a failure in percpu init rwse...
DEBIAN-CVE-2022-48662
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Really move i915gemcontext.link under ref protection i915perf assumes that it can use the i915gemcontext reference to protect its i915-gem.contexts.list iteration. However, this requires that we do not remove the...
CLSA-2024-1714066220 Fix CVE(s): CVE-2022-48624
SECURITY UPDATE: shell-quote filenames when invoking LESSCLOSE. - debian/patches/CVE-2022-48624.patch: Fix closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE. - CVE-2022-48624...
CVE-2024-26923
CVE-2024-26923 in the Linux kernel exposes a race in the AF_UNIX garbage collector during connect() handling. An embryo enqueued during GC may be reachable via a peer with SCM_RIGHTS, causing two consecutive scan passes to observe different child sets and inflate the inflight count, which can lea...
SUSE CVE-2024-32650
Rustls is a modern TLS library written in Rust. rustls::ConnectionCommon::completeio could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a closenotify message immediately after clienthello, the server's completeio will get in an infinite...
DEBIAN-CVE-2024-32650
Rustls is a modern TLS library written in Rust. rustls::ConnectionCommon::completeio could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a closenotify message immediately after clienthello, the server's completeio will get in an infinite...
`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
If a closenotify alert is received during a handshake, completeio does not terminate. Callers which do not call completeio are not affected. rustls-tokio and rustls-ffi do not call completeio and are not affected. rustls::Stream and rustls::StreamOwned types use completeio and are affected...