Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a sched/fair module load balancing logic change causing env.maxloop to be ignored when all tasks are fixed,...

SUSE CVE-2024-42135

In the Linux kernel, the following vulnerability has been resolved: vhosttask: Handle SIGKILL by flushing work and exiting Instead of lingering until the device is closed, this has us handle SIGKILL by: 1. marking the worker as killed so we no longer try to use it with new virtqueues and new flus...

AZL-54098 CVE-2024-42135 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: vhosttask: Handle SIGKILL by flushing work and exiting Instead of lingering until the device is closed, this has us handle SIGKILL by: 1. marking the worker as killed so we no longer try to use it with new virtqueues and new flus...

CVE-2024-41082 nvme-fabrics: use reserved tag for reg read/write command

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: use reserved tag for reg read/write command In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of adminq. If a reset nvme reset or IO timeout...

org.apache.pinot:pinot-compatibility-verifier (=0.10.0), org.apache.pinot:pinot-distribution (>=0.1.0 <=0.10.0) +7 more potentially affected by CVE-2024-39676 via org.apache.pinot:pinot-controller (>=0.10.0 <=0.9.3)

org.apache.pinot:pinot-controller MAVEN version =0.10.0, =0.1.0, =0.11.0, =0.9.0, =0.1.0, =0.8.0, =0.8.0, =0.1.0, =0.1.0, =0.10.0 Source cves: CVE-2024-39676 Source advisory: OSV:GHSA-8GJ9-R4HV-3JJW...

SUSE CVE-2024-40977

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery During chip recovery e.g. chip reset, there is a possible situation that kernel worker resetwork is holding the lock and waiting for kernel thread statworker to b...

The vulnerability of the GLPI-Agent, a system agent for requests, incidents, and inventory management of computer equipment, arises due to insufficient validation of input data. This vulnerability allows attackers to trigger service failures or increase their privileges.

The vulnerability of the GLPI-Agent, a system agent for requests, incidents, and computer equipment inventory, exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures or increase their privileges by configuring the server wi...

Hotfix XS82ECU1070 - For Citrix Hypervisor 8.2 Cumulative Update 1

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2 Cumulative Update 1. All customers who are affected by the issues described inCTX691115 - Citrix Hypervisor Security Bulletinshould install this hotfix. Note: This hotfix is available only to customers on...

AZL-48942 CVE-2024-40977 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery During chip recovery e.g. chip reset, there is a possible situation that kernel worker resetwork is holding the lock and waiting for kernel thread statworker to b...

CVE-2024-40995

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix possible infinite loop in tcfidrcheckalloc syzbot found hanging tasks waiting on rtnllock 1 A reproducer is available in the syzbot bug. When a request to add multiple actions with the same index is sent, t...

CVE-2024-40995 net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix possible infinite loop in tcfidrcheckalloc syzbot found hanging tasks waiting on rtnllock 1 A reproducer is available in the syzbot bug. When a request to add multiple actions with the same index is sent, t...

CVE-2024-40995 net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix possible infinite loop in tcfidrcheckalloc syzbot found hanging tasks waiting on rtnllock 1 A reproducer is available in the syzbot bug. When a request to add multiple actions with the same index is sent, t...

CVE-2024-40995

CVE-2024-40995 affects the Linux kernel net/sched: act_api where repeated adds of actions with the same index could hang by causing an infinite loop in tcf_idr_check_alloc. The fix returns -EAGAIN to prevent the loop while preserving documented behavior. Syzbot reported tasks blocked waiting on r...

CVE-2024-6397 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing...

CVE-2024-6397

CVE-2024-6397 concerns the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin. The vulnerability is an authentication bypass caused by insufficient verification of the API key, allowing unauthenticated attackers to log in as an existing site user (e.g., administrator) if they know ...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to access control errors, allows a perpetrator to execute pipeline tasks under the name of any user.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to access control errors. Exploiting this vulnerability allows a malicious actor, operating remotely, to perform pipeline tasks under the name of any user...

PT-2024-33767

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.21 Description: The issue is related to the rcu-tasks component in the Linux kernel, specifically with the rcu tasks need gpcb function. When the kernel is built with CONFIG FORCE NR CPUS=y, it can lead to a...

CVE-2024-22277

VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can craft malicious HTML tags to execute within replication tasks...

CVE-2024-22277

VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can craft malicious HTML tags to execute within replication tasks...

CVE-2024-22277

VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can craft malicious HTML tags to execute within replication tasks...