PT-2024-28025 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow version 2.11.0 Description: A path traversal issue exists due to insufficient validation of the fragment portion of artifact URLs. An attacker can exploit this by inserting a '' character into the URL fragment, allowing them to...

Mlflow 安全漏洞

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow version 2.11.0, which stems from insufficient validation of the fragment portion of a URL, leading to the reading of arbitrary files via path traversal...

The vulnerability of the sch_fragment() function in the net/sched/sch_frag.c module of the net/sched component in the Linux operating system’s kernel allows a attacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the schfragment function in the net/sched/schfrag.c module of the net/sched component of the Linux operating system is related to reading memory beyond the bounds of the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

The vulnerability of the inet_frag_reasm_prepare() function in the net/ipv4/inet_fragment.c module of the Linux operating system’s kernel-based IPv4 protocol implementation allows a attacker to cause a service failure.

The vulnerability of the inetfragreasmprepare function in the net/ipv4/inetfragment.c module of the Linux kernel’s IPv4 protocol implementation is related to the use of memory after it has been freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2023-43529

CVE-2023-43529 describes a transient denial-of-service in Qualcomm Snapdragon/closed-source components caused by processing IKEv2 Informational requests when a malformed fragment packet is received. The impact is DoS affecting availability; no remote code execution or data loss is stated in the p...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a transient DOS that occurs when processing IKEv2 Information Request messages when an incorrectly formatted fragment packet is received...

PT-2024-13102 · Qualcomm · Qualcomm Snapdragon

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to a transient Denial of Service DOS that occurs when processing IKEv2 Informational request messages and a malformed fragment packet is received. This can...

kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags

In the Linux kernel, the following vulnerability has been resolved: skbuff: skbsegment, Call zero copy functions before using skbuff frags Commit bf5c25d60861 "skbuff: in skbsegment, call zerocopy functions once per nskb" added the call to zero copy functions in skbsegment. The change introduced ...

kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: fix NEXTHDRFRAGMENT handling in ip6tnlparsetlvenclim syzbot pointed out 1 that NEXTHDRFRAGMENT handling is broken. Reading fragoff can only be done if we pulled enough bytes to skb-head. Currently we might access...

kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious too big networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system...

SUSE CVE-2024-26921

In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use iplocalout and other functions can pass skb-sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be...

DEBIAN-CVE-2024-26921

In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use iplocalout and other functions can pass skb-sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be...

CVE-2024-26921

In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use iplocalout and other functions can pass skb-sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be...

UBUNTU-CVE-2024-26921

In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use iplocalout and other functions can pass skb-sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be...

CVE-2024-26921 inet: inet_defrag: prevent sk release while still in use

In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use iplocalout and other functions can pass skb-sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be...

CVE-2024-26921

CVE-2024-26921 is a Linux kernel issue where in the tx path, skb fragments could trigger a use-after-free of the socket when fragments are reassembled and the skb->sk field is freed prematurely. The fix, analyzed by Eric Dumazet, moves orphaning to the last safe moment, delaying skb->sk des...

kernel: gro: fix ownership transfer

A flaw was found in the Linux kernel's Generic Receive Offload GRO feature, where packets processed with a fragment list are not properly orphaned due to incorrect handling of socket references. This vulnerability can cause system instability or kernel bugs. The issue has been fixed by making sur...

GHSA-M49C-5C52-6696 mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...

SUSE CVE-2024-26774

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mbupdateavgfragmentsize when block bitmap corrupt Determine if bbfragments is 0 instead of determining bbfree to eliminate the risk of dividing by zero when the block bitmap is corrupted...

DEBIAN-CVE-2024-26704

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents movedlen In ext4moveextents, movedlen is only updated when all moves are successfully executed, and only discards originode and donorinode preallocations when movedlen is not...