CVE-2022-3910

Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in iouring leads to Use-After-Free and Local Privilege Escalation. When iomsgring was invoked with a fixed file, it called iofputfile which improperly decreased its reference count...

UBUNTU-CVE-2022-3910

Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in iouring leads to Use-After-Free and Local Privilege Escalation. When iomsgring was invoked with a fixed file, it called iofputfile which improperly decreased its reference count...

CVE-2022-3910 Use after free in IO_uring in the Linux Kernel

Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in iouring leads to Use-After-Free and Local Privilege Escalation. When iomsgring was invoked with a fixed file, it called iofputfile which improperly decreased its reference count...

CVE-2022-3910 Use after free in IO_uring in the Linux Kernel

Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in iouring leads to Use-After-Free and Local Privilege Escalation. When iomsgring was invoked with a fixed file, it called iofputfile which improperly decreased its reference count...

CVE-2022-3910

CVE-2022-3910 is a Local Use-After-Free in the Linux kernel’s io_uring path. The root cause is an improper update of the reference count when io_msg_ring is invoked with a fixed file, causing a use-after-free and local privilege escalation. The issue arises because fixed files are permanently reg...

CVE-2022-3910

Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in iouring leads to Use-After-Free and Local Privilege Escalation. When iomsgring was invoked with a fixed file, it called iofputfile which improperly decreased its reference count...

GHSA-W58W-79XV-6VCJ Out of bounds segmentation fault due to unequal op inputs in Tensorflow

Impact tf.rawops.DynamicStitch specifies input sizes when it is registered. cpp REGISTEROP"DynamicStitch" .Input"indices: N int32" .Input"data: N T" .Output"merged: T" .Attr"N : int = 1" .Attr"T : type" .SetShapeFnDynamicStitchShapeFunction; When it receives a differing number of inputs, such as...

PT-2022-26127

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4 Description TensorFlow is an open source platform for machine learning. If ThreadUnsafeUnigramCandidateSampler is given input filterbank channel count greater than...

Email Cyberattacks on Arab Countries Rise in Lead to Global Football Tournament

Email Cyberattacks on Arab Countries Rise in Lead to Global Football Tournament By Daksh Kapur · November 17, 2022 This story was also written by Sparsh Jain. Figure 1 Global eyes are soon to be turned to the first global football tournament to be held in the Arab world kicking off on November 20...

dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK...

kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c

A use-after-free flaw was found in u32change in net/sched/clsu32.c in the network subcomponent of the Linux kernel. This flaw allows a local attacker to crash the system, cause a privilege escalation, and leak kernel information...

kernel: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data

A reference-count flaw was found in the Linux kernel Berkeley Packet Filter BPF sockmap implementation. When processing messages with remaining data, the same Transmission Control Protocol TCP socket reference could be released more than once. A local user running BPF sockmap programs could use...

kernel: exec: Force single empty string when argv is empty

In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve2 be the name of a program, thus prohibiting a scenario...

kernel: bpf: Fix request_sock leak in sk lookup helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c

A use-after-free flaw was found in u32change in net/sched/clsu32.c in the network subcomponent of the Linux kernel. This flaw allows a local attacker to crash the system, cause a privilege escalation, and leak kernel information...

GSD-2022-1007126 jbd2: fix potential buffer head reference count leak

jbd2: fix potential buffer head reference count leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...

GSD-2022-1006887 jbd2: fix potential buffer head reference count leak

jbd2: fix potential buffer head reference count leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

MGASA-2022-0418 Updated wayland packages fix security vulnerability

An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wlshm buffer objects, or if it...

Closing an unexisting credit can overflow the credit count variable in the LineOfCredit contract

Lines of code Vulnerability details The LineOfCredit contract doesn't verify if a credit exists and is properly initialized when closing it, and will update its state anyway, leading to an inconsistent count. Impact The close function in the LineOfCredit contract doesn't check if the given credit...

Borrower can close non-existent credit line positions to effectively force the overall status to REPAID

Lines of code Vulnerability details The LineOfCredit.close function is used to close a credit line position. Both the lender of a specific credit position and the borrower can call this function. However, the function does not check if the given id belongs to a credit line position in the credits...