Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from an array overflow vulnerability in hnsdsafgesrstbyport...

CVE-2021-47548: Improper Validation of Array Index

In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hnsdsafmisc: fix a possible array overflow in hnsdsafgesrstbyport The if statement: if port = DSAFGENUM return; limits the value of port less than DSAFGENUM i.e., 8. However, if the value of port is 6 or...

CVE-2023-52746

In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrmxlate32attr int type = nlatypenla; if type XFRMAMAX return -EOPNOTSUPP; @type is then used as an array index and can be used as a Spectre v1 gadget. if nlalennla...

SUSE CVE-2023-52746

In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrmxlate32attr int type = nlatypenla; if type XFRMAMAX return -EOPNOTSUPP; @type is then used as an array index and can be used as a Spectre v1 gadget. if nlalennla...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONArray.writeTo

Detailed Report: https://oss-fuzz.com/testcase?key=5455267230711808 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

CVE-2023-52824

REJECTED CVE A memory handling vulnerability was identified in the Linux kernel's watchqueue subsystem. The issue stems from the lack of overflow checks when duplicating a user-space array with memdupuser. This could allow an attacker to exploit the absence of safeguards, potentially leading to a...

CVE-2023-52823

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2023-52822

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2023-52820

REJECTED CVE In the Linux kernel, the following vulnerability has been resolved: drmlease.c: copy user-array safely Currently, there is no overflow-check with memdupuser. Use the new function memduparrayuser instead of memdupuser for duplicating the user-space array safely...

CVE-2023-52818

In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 For pptable structs that use flexible array sizes, use flexible arrays...

CVE-2023-52805

In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diAlloc Currently there is not check against the agno of the iag while allocating new inodes to avoid fragmentation problem. Added the check which is required...

CVE-2023-52804

In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Add validity check for dbmaxag and dbagpref Both dbmaxag and dbagpref are used as the index of the dbagfree array, but there is currently no validity check for dbmaxag and dbagpref, which can lead to errors. The following...

CVE-2023-52799

In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbFindLeaf Currently while searching for dmtreet for sufficient free blocks there is an array out of bounds while getting element in tp-dmstree. To add the required check for out of bound we...

CVE-2023-52797

In the Linux kernel, the following vulnerability has been resolved: drivers: perf: Check findfirstbit return value We must check the return value of findfirstbit before using the return value as an index array since it happens to overflow the array and then panic: 107.318430 Kernel BUG 1 107.3194...

CVE-2023-52793

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

SUSE CVE-2021-47233

In the Linux kernel, the following vulnerability has been resolved: regulator: rt4801: Fix NULL pointer dereference if priv-enablegpios is NULL devmgpiodgetarrayoptional may return NULL if no GPIO was assigned...

SUSE CVE-2021-47308

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix array index out of bound exception Fix array index out of bound exception in fcrportprliresp...

PT-2024-5407

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description The issue is related to the do map benchmark function in the Linux kernel, which can cause an array-index-out-of-bounds error when cpumask of node is called for NUMA NO NODE inside do map...

PT-2024-31309

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue allows userspace to trigger a speculative read of an address outside the gpio descriptor array by calling gpio ioctl with an offset out of range. The offset is copied from user...

kernel: ixgbe: Fix panic during XDP_TX with > 64 CPUs

A flaw was found in the Linux kernel's ixgbe network driver. On systems with more than 64 CPUs, XDPTX operations can cause a kernel panic due to an array-index-out-of-bounds access. The ixgbexdplockingkey variable can be incorrectly decremented to zero during ring reconfiguration, causing the...