Baxter Life2000 安全漏洞

The Baxter Life2000 is a mask-less non-invasive ventilator from Baxter. A security vulnerability exists in Baxter Life2000 version 06.08.00.00 and earlier, which stems from a lack of memory protection and allows an attacker to read or write to flash memory via the JTAG interface, potentially...

CVE-2024-4741 Use After Free with SSL_free_buffers

Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...

CVE-2024-4741 Use After Free with SSL_free_buffers

Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...

`simd-json-derive` vulnerable to `MaybeUninit` misuse

An invalid use of MaybeUninit::uninit.assumeinit in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can...

openssl: Use After Free with SSL_free_buffers

A use-after-free vulnerability was found in OpenSSL. Calling the OpenSSL API SSLfreebuffers function may cause memory to be accessed that was previously freed in some situations...

kernel: atl1c: Work around the DMA RX overflow issue

In the Linux kernel, the following vulnerability has been resolved: atl1c: Work around the DMA RX overflow issue This is based on alx driver commit 881d0327db37 "net: alx: Work around the DMA RX overflow issue". The alx and atl1c drivers had RX overflow error which was why a custom allocator was...

kernel: vmxnet3: disable rx data ring on dma allocation failure

A vulnerability was found in the Linux kernel's vmxnet3 driver in the vmxnet3rqcreate function, where this issue occurs when memory allocation fails for the RX data ring, leading to an improper reference size that may cause the hypervisor to access invalid memory during packet reception, which ca...

kernel: nvmet: always initialize cqe.result

In the Linux kernel, the following vulnerability has been resolved: nvmet: always initialize cqe.result The spec doesn't mandate that the first two double words aka results for the command queue entry need to be set to 0 when they are not used not specified. Though, the target implemention return...

kernel: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT

A flaw was found in the bnxten module in the Linux kernel. A double DMA unmapping can trigger a kernel warning and cause a denial of service...

kernel: Bluetooth: btrtl: fix out of bounds memory access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtekdata'. If btrtl driver is used with btusb, then memory for private hci data is...

kernel: out-of-bounds read in pci_dev_for_each_resource()

An out-of-bounds read flaw was found in pcidevforeachresource in the Linux Kernel. The pointer in the pcidevforeachresource may be wrong. For example, it might be used for the out-of-bounds read. This issue was identified by the Coverity static analysis tool, which flagged a pointer res that coul...

kernel: hwmon: (coretemp) Fix out-of-bounds memory access

In the Linux kernel, the following vulnerability has been resolved: hwmon: coretemp Fix out-of-bounds memory access Fix a bug that pdata-cpumap is set before out-of-bounds check. The problem might be triggered on systems with more than 128 cores per package...

kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhcimapurbfordma The Linux kernel CVE team has assigned CVE-2024-26964 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-26964-54c8@gregkh/T...

kernel: use after free in i2c

An out-of-bounds OOB memory access flaw was found in the i2c driver module in the Linux kernel...

kernel: RDMA/siw: Fix connection failure handling

A NULL dereference vulnerability was found in the Linux kernel, which is caused when the siwcmworkhandler function attempts to dereference a NULL listener that may be created when immediate MPA request processing fails and the newly created endpoint unlinks the listening endpoint ready to be...

kernel: dma-direct: Leak pages on dma_set_decrypted() failure

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dmasetdecrypted failure The Linux kernel CVE team has assigned CVE-2024-35939 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051919-CVE-2024-35939-f877@gregkh/T...

kernel: dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow

A counter-overflow flaw was found in the Linux kernel Texas Instruments K3 Universal Direct Memory Access UDMA driver. During long data transfers exceeding four gigabytes, the hardware byte-count registers could wrap and misreport progress, causing the transfer to hang indefinitely. A local user...

kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter

A flaw was foundin the Linux Kernel when specifying the srptserviceguid parameter, which may lead to kernel crash...

kernel: RDMA/qedr: Fix qedr_create_user_qp error flow

In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedrcreateuserqp error flow The Linux kernel CVE team has assigned CVE-2024-26743 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040301-CVE-2024-26743-6034@gregkh/T...

FreeBSD 安全漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD that stems from an infinite loop in the hda audio driver, which allows an attacker to perform a denial-of-service DoS attack against the host and read memory that should not be...