AZL-9241 CVE-2022-0500 affecting package kernel for versions less than 5.15.37.1-2

A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system...

CVE-2022-0500

A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system. Mitigation The default Red Hat...

PT-2025-8156

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the btf decl tag bug Description A bug in the Linux kernel's btf decl tag functionality has been identified, which can cause a general protection fault due to a null pointer...

PT-2025-8164

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel due to a race condition between the btf try get module and load module functions. This occurs when the module BTF is published to...

PT-2021-6870

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw was found in the Linux kernel's BPF subsystem due to unrestricted eBPF usage by the BPF BTF LOAD, leading to a possible out-of-bounds memory write. This issue allows a local user ...

PT-2021-30730

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.162 Description The issue is related to a memory leak from the perf env insert btf function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prio...

PT-2021-26735

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.162 Description: The issue is related to a memory leak from the perf env insert btf function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2021-30753

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.82 Description The issue is related to a memory leak from the perf env insert btf function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prio...

PT-2021-26798

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.5 Description: The issue is related to a memory leak from the perf env insert btf function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2021-30793

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.5 Description The issue is related to a memory leak from the perf env insert btf function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior...

PT-2021-26758

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.82 Description: The issue is related to a memory leak from the perf env insert btf function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

gcc-toolset-11-gcc security update

11.2.1-1.2.0.1 - Add -ftrivial-auto-var-init support from GCC12 Reviewed-by: Jose E. Marchesi - Add CTF/BTF support Reviewed-by: Qing Zhao 11.2.1-1.2 - add -Wbidirectional patch 2017819...

gcc security and bug fix update

8.5.0-3.0.2 - Fix Orabug 33451471 and backport CTF/BTF enhancements ctfc: Free CTF container elements in ctfcdeletecontainer ctf: Do not warn for CTF not supported for GNU GIMPLE ICE in btffinalize when compiling with -gbtf PR debug/102507, Orabug 33451471 Reviewed-by: Jose E. Marchesi 8.5.0-3.0....

libbpf:bpf-object-fuzzer: Global-buffer-overflow in btf_new

Project: https://github.com/libbpf/libbpf.git Detailed Report: https://oss-fuzz.com/testcase?key=6612626260492288 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzerasanlibbpf Platform Id: linux Crash Type: Global-buffer-overflow READ Crash Address:...

The vulnerability in the BPF subsystem of the `map_create` or `check_btf_info` function of the Linux kernel allows a malicious actor to cause an unexpected termination of the application.

The vulnerability of the BPF subsystem of the mapcreate function kernel/bpf/syscall.c or checkbtfinfo function kernel/bpf/verifier.c in the Linux operating system kernel is due to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to cause an applicati...

CVE-2021-29648

An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolvedids and resolvedsizes are intentionally uninitialized in the vmlinux BPF Type Format BTF, which can cause a system crash upon an unexpected access attempt in mapcreate in...

CVE-2021-29648

An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolvedids and resolvedsizes are intentionally uninitialized in the vmlinux BPF Type Format BTF, which can cause a system crash upon an unexpected access attempt in mapcreate in...

btf-norskeskog.at XSS vulnerability

Open Bug Bounty ID: OBB-602983 Description| Value ---|--- Affected Website:| btf-norskeskog.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Project description is persistent XSS vector for project admins

This issue is a clone of another one that was fixed in OD but left unfixed in BTF as "admin xss". It has been pointed out by several customers that this exploit requires only project admin level of privilege. The following project description: code alert1 code Pops up in the view project page, th...

Make custom field description and options rendering consistent for OnDemand and BTF

JIRA has different behaviour for how it renders custom field descriptions and options depending on if it's running BTF or on OnDemand. On OnDemand, custom field descriptions are wiki markup, but on BTF they're HTML. On OnDemand, custom field options e.g. for checkbox are plain text, but on BTF...