1435 matches found
CVE-2023-48024
Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hashdestroyhashtablet h at hash.c...
CVE-2023-48024
Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hashdestroyhashtablet h at hash.c...
PT-2023-30671 · Liblisp · Liblisp
Name of the Vulnerable Software and Affected Versions: Liblisp through commit 4c65969 Description: A use-after-free issue was found in the hash destroy function, located in hash.c. Recommendations: For versions through commit 4c65969, consider applying a patch that fixes the hash destroy function...
kernel: ipmi: fix use after free in _ipmi_destroy_user()
A use-after-free flaw was found in the IPMI driver in the Linux kernel. In ipmidestroyuser, the intffree function frees the interface pointer, but the code subsequently attempts to dereference this freed pointer. This could result in kernel crashes or potentially allow an attacker with local acce...
kernel: drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
A flaw was found in the DRM subsystem in the Linux kernel. A NULL pointer dereference can be triggered due to a missing check, causing a system crash and resulting in a denial of service...
kernel: net/sched: sch_taprio: fix possible use-after-free
In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: fix possible use-after-free syzbot reported a nasty crash 1 in nettxaction which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCARATE attribute...
kernel: dm cache: free background tracker's queued work in btracker_destroy
A memory leak was found in the device-mapper cache target in the Linux kernel. The btrackerdestroy function fails to free queued work items from the background tracker before destroying the slab cache. This triggers a BUG when kmemcacheshutdown finds objects still remaining...
kernel: drm/vkms: Fix null-ptr-deref in vkms_release()
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix null-ptr-deref in vkmsrelease A null-ptr-deref is triggered when it tries to destroy the workqueue in vkms-output.composerworkq in vkmsrelease. KASAN: null-ptr-deref in range 0x0000000000000118-0x000000000000011f CP...
kernel: drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
A flaw was found in the DRM subsystem in the Linux kernel. A NULL pointer dereference can be triggered due to a missing check, causing a system crash and resulting in a denial of service...
kernel: drbd: use after free in drbd_create_device()
In the Linux kernel, the following vulnerability has been resolved: drbd: use after free in drbdcreatedevice The drbddestroyconnection frees the "connection" so use the safe iterator to prevent a use after free...
kernel: ipmi: fix use after free in _ipmi_destroy_user()
A use-after-free flaw was found in the IPMI driver in the Linux kernel. In ipmidestroyuser, the intffree function frees the interface pointer, but the code subsequently attempts to dereference this freed pointer. This could result in kernel crashes or potentially allow an attacker with local acce...
kernel: ixgbevf: Fix resource leak in ixgbevf_init_module()
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: Fix resource leak in ixgbevfinitmodule ixgbevfinitmodule won't destroy the workqueue created by createsinglethreadworkqueue when pciregisterdriver failed. Add destroyworkqueue in fail path to prevent the resource leak...
kernel: iommufd: IOMMUFD_DESTROY should not increase the refcount
A race condition was identified in the iommufd subsystem of the Linux kernel where the IOMMUFDDESTROY command incorrectly increments an object’s reference count without holding the expected exclusive synchronization destroyrwsem. This violates the assumption that temporary reference count...
kernel: mptcp: use the workqueue to destroy unaccepted sockets
In the Linux kernel, the following vulnerability has been resolved: mptcp: use the workqueue to destroy unaccepted sockets Christoph reported a UaF at token lookup time after having refactored the passive socket initialization part: BUG: KASAN: use-after-free in tokenbucketbusy+0x253/0x260 Read o...
PT-2025-18544 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: A potential null pointer dereference issue has been identified in the Linux kernel, specifically in the drm vblank destroy worker function. This issue arises when drm vblank init...
OSV-2023-1025 Heap-buffer-overflow in ucl_hash_destroy
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63299 Crash type: Heap-buffer-overflow READ 8 Crash state: uclhashdestroy uclobjectdtorunrefsingle uclobjectdtorunref...
CLSA-2023-1696351966 Fix CVE(s): CVE-2022-48541
SECURITY UPDATE: a memory leak that allows remote attackers to perform a denial of service via the "identify -help" command - debian/patches/CVE-2022-48541.patch: added missing calls to destroy methods - CVE-2022-48541...
CLSA-2023-1696351712 Fix CVE(s): CVE-2022-48541
SECURITY UPDATE: a memory leak that allows remote attackers to perform a denial of service via the "identify -help" command - debian/patches/CVE-2022-48541.patch: added missing calls to destroy methods - CVE-2022-48541...
PT-2023-36003 · Git +1 · Libucl
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. Technical details include a crash state involving ucl object dtor unref single, ucl object dto...