CVE-2024-32503: Use After Free

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper memory deallocation checking, which can result in a UAF Use-After-Free vulnerability...

PT-2024-24620 · Samsung · Exynos 1330 +7

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor and Wearable Processor Exynos versions 850, 1080, 2100, 1280, 1380, 1330, W920, W930 Description: An issue was discovered in the Samsung Mobile Processor and Wearable Processor, where the mobile processor lacks proper...

CVE-2023-43543

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object...

The vulnerability of the p9pdu_vreadf() function in the 9P network protocol implementation of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of information, and execute arbitrary code.

The vulnerability of the p9pduvreadf function in the net/9p/protocol.c module of the 9P network protocol implementation in the Linux operating system is related to the use of an uninitialized variable during memory deallocation. Exploiting this vulnerability could allow a remote attacker to...

CVE-2021-47523

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix leak of rcvhdrtaildummykvaddr This buffer is currently allocated in hfi1init: if reinit ret = initafterresetdd; else ret = loadtimeinitdd; if ret goto done; / allocate dummy tail memory for all receive contexts /...

CVE-2021-47508

In the Linux kernel, the following vulnerability has been resolved: btrfs: free exchange changeset on failures Fstests runs on my VMs have show several kmemleak reports like the following. unreferenced object 0xffff88811ae59080 size 64: comm "xfsio", pid 12124, jiffies 4294987392 age 6.368s hex...

CVE-2021-47523

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix leak of rcvhdrtaildummykvaddr This buffer is currently allocated in hfi1init: if reinit ret = initafterresetdd; else ret = loadtimeinitdd; if ret goto done; / allocate dummy tail memory for all receive contexts /...

CVE-2021-47523

CVE-2021-47523 affects the Linux kernel’s IB/hfi1 path. The issue is a leak of rcvhdrtail_dummy_kvaddr which is allocated in hfi1_init() and can be overwritten on a reinit path, leading to a memory leak. The fix moves the allocation to hfi1_alloc_devdata() and deallocation to hfi1_free_devdata(),...

CVE-2021-47523 IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix leak of rcvhdrtaildummykvaddr This buffer is currently allocated in hfi1init: if reinit ret = initafterresetdd; else ret = loadtimeinitdd; if ret goto done; / allocate dummy tail memory for all receive contexts /...

kernel: RDMA/efa: Fix wrong resources deallocation order

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request the device to destroy the object. If t...

mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)

A flaw was found in modhttp2. When a HTTP/2 stream is reset RST frame by a client, there is a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connectio...

CVE-2023-52772

In the Linux kernel, the following vulnerability has been resolved: afunix: fix use-after-free in unixstreamreadactor syzbot reported the following crash 1 After releasing unix socket lock, u-oobskb can be changed by another thread. We must temporarily increase skb refcount to make sure this othe...

CVE-2020-36788

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveauboinit is backed by ttmboinit and ferries its return code back to the caller. On failures, ttmboinit invokes the provided destructor which should de-initialize and fre...

GHSA-3RCQ-39XP-7XJP ic-stable-structures vulnerable to BTreeMap memory leak when deallocating nodes with overflows

Impact When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain incorrectly allocated, causin...

ic-stable-structures vulnerable to BTreeMap memory leak when deallocating nodes with overflows

Impact When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain incorrectly allocated, causin...

CVE-2024-4435 BTreeMap memory leak when deallocating nodes with overflows

When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain incorrectly allocated, causing a...

CVE-2024-4435

CVE-2024-4435 concerns a memory leak in stable-structures’ BTreeMap when deallocating nodes that overflow, where only the first memory chunk is freed and subsequent chunks remain allocated. This can enable memory growth or exhaustion depending on how a canister uses the map. The issue has been fi...

CVE-2024-4435 BTreeMap memory leak when deallocating nodes with overflows

When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain incorrectly allocated, causing a...

SUSE CVE-2024-35832

In the Linux kernel, the following vulnerability has been resolved: bcachefs: kvfree bchfs::snapshots in bch2fssnapshotsexit bchfs::snapshots is allocated by kvzalloc in snapshottmut. It should be freed by kvfree not kfree. Or umount will triger: 406.829178 BUG: unable to handle page fault for...

SUSE CVE-2024-35860

In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpflink dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and...