OSV-2023-1166 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64176 Crash type: Memcpy-param-overlap Crash state: repeat pere pere...

kernel: scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix issues in mpi3mrgetalltgtinfo The function mpi3mrgetalltgtinfo has four issues: 1 It calculates valid entry length in alltgtinfo assuming the header part of the struct mpi3mrdevicemapinfo would equal to sizeofu3...

kernel: wifi: ath10k: Delay the unmapping of the buffer

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has...

kernel: drm/amdkfd: Fix an illegal memory access

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the system. By triggering a failure during data copying from user space in the event-handling interface, the driver executes error cleanup code that...

kernel: virt/coco/sev-guest: Double-buffer messages

In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy...

kernel: drm: Prevent drm_copy_field() to attempt copying a NULL pointer

A NULL pointer dereference flaw was found in the Linux kernel's DRM subsystem. When a graphics driver incorrectly fails to initialize required fields in the drmdriver structure, the drmcopyfield function attempts to copy from a NULL pointer when handling the DRMIOCTLVERSION ioctl, causing a kerne...

kernel: net/mlx5e: Fix deadlock in tc route query code

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlock in tc route query code Cited commit causes ABBA deadlock0 when peer flows are created while holding the devcom rw semaphore. Due to peer flows offload implementation the lock is taken much higher up the ca...

kernel: wifi: rtw88: use work to update rate to avoid RCU warning

A flaw was identified in the Linux kernel’s rtw88 Wi-Fi driver drivers/net/wireless/realtek/rtw88 where the ieee80211ops::starcupdate callback was invoked within a Read-Copy-Update RCU read-side critical section without proper atomicity or deferral. The ieee80211chanbwchange function holds an RCU...

kernel: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent lpfcdebugfslockstatwrite buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copyfromuser for a debugfs entry. Currently, it is possible that copyfromuser copies...

kernel: drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()

A memory leak vulnerability was found in the VMware graphics driver vmwgfx in the Linux kernel. In vmwmksstataddioctl, when copying the description string from userspace fails with -EFAULT, the allocated page for the instance descriptor is not freed. This leads to memory leakage that can cause...

Wayland Protocol XkbCopyNames Confidential Data Access Data Compromise

The vulnerability of the XkbCopyNames function in the Wayland protocol for X.Org XWayland, which is part of the X.Org Server for the X Window System, relates to the use of memory after it is freed. Exploiting this vulnerability allows a perpetrator to access confidential data, compromise its...

CVE-2023-47801

An issue was discovered in Click Studios Passwordstate before 9811. Existing users Security Administrators could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password...

CVE-2023-47801

An issue was discovered in Click Studios Passwordstate before 9811. Existing users Security Administrators could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password...

mariadb: server crash in JOIN_CACHE::free or in copy_fields

MariaDB v10.7 was discovered to contain an use-after-poison in in interceptormemset at /libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc...

CVE-2023-47801: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Click Studios Passwordstate before 9811. Existing users Security Administrators could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password...

Ghostscript devn_pcx_write_rle Heap Buffer Overflow DoS

The vulnerability of the devnpcxwriterle function in the base/gdevdevn.c file of the Ghostscript document processing software is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow an attacker to cause a service failure using a specially...

CVE-2023-47610

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message...

Design/Logic Flaw

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted syst...

CVE-2023-47610

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message...

CVE-2023-47610

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message...