kernel: net/packet: slab-out-of-bounds access in packet_recvmsg()

An out-of-bounds access issue was found in the Linux kernel networking subsystem in the way raw packet sockets AFPACKET used PACKETCOPYTHRESH and mmap operations. A local attacker with CAPNETRAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or privilege...

kernel: veth: ensure skb entering GRO are not cloned.

In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b "veth: allow enabling NAPI even without XDP", if GRO is enabled on a veth device and TSO is disabled on the peer device, TCP skbs will go through the NAPI...

PT-2025-8597 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A NULL pointer dereference crash was reported in the Linux kernel. The issue occurs when a bc packet is received before the bc link is created, causing a dereference of a NULL pointer ...

Upgraded Q -> M from 94 [1666365598508]

Judge has assessed an item in Issue 94 as Medium risk. The relevant finding follows: L-04 payEther should use .call instead of .transfer Use of .transfer is no longer encouraged, as it may fail if the receiver has any logic in their receive function, due to the 2300 gas consumption limit. --- The...

CVE-2022-36795

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connectio...

CVE-2022-36795 BIG-IP software SYN cookies vulnerability CVE-2022-36795

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connectio...

CVE-2022-36795: Incorrect Calculation

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connectio...

kernel: ice: Fix memory corruption in VF driver

In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory corruption in VF driver Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when it requests a reset. If PF driver assumes that VF is disabled, while VF still has queues configured, VF may...

kernel: ice: arfs: fix use-after-free when freeing @rx_cpu_rmap

In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free when freeing @rxcpurmap The CI testing bots triggered the following splat: 718.203054 BUG: KASAN: use-after-free in freeirqcpurmap+0x53/0x80 718.206349 Read of size 4 at addr ffff8881bd127e00 by task...

GSD-2022-1005394 tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()

tty: ngsm: add sanity check for gsm-receive in gsmreceivebuf This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.66 by commit...

PT-2022-33258 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19.2 through v5.19.8 Description: The issue is related to a wrong last sg check in the sk msg recvmsg function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-33652 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.15.61 through v5.15.65 Description: A potential security issue has been identified in the Linux Kernel. The issue is related to the gsm receive buf function, where a sanity check for gsm-receive has been added. The...

AZL-10975 CVE-2022-2962 affecting package qemu for versions less than 6.2.0-13

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

CVE-2022-39205

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the...

Hardcoded credentials

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the...

PT-2024-11772

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.0-0607+ 23 Description The Linux kernel has a vulnerability that allows possible access to freed memory in link clear. After modifying the QP to the Error state, all RX WR would be completed with WC in IB WC...

PT-2025-25866

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference can occur when attempting to access the gsm-receive function in gsmld receive buf. This happens because the gsmld receive buf function can be accessed without...

PT-2022-4448

Name of the Vulnerable Software and Affected Versions opcua versions all asyncua versions all Description The issue is related to an uncontrolled consumption of resources in the opcua and asyncua libraries. This can be exploited by a remote attacker to cause a denial of service. The vulnerability...

PT-2022-14569 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: A race condition in the stealReceiveChannel of EventThread.cpp could allow interference with process communication, potentially leading to local escalation of privilege without...

QEMU: virtio-net: map leaking on error during receive

A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage, use-after-free or other unexpected results. A malicious privileged guest could exploit...