CVE-2021-47086 phonet/pep: refuse to enable an unbound pipe

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: refuse to enable an unbound pipe This ioctl implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur: 1 We'd...

CVE-2021-47086

The CVE-2021-47086 entry concerns the Linux kernel Phonet/pep path. The connected Astra Linux bulletin repeats that the vulnerability arises in an ioctl that refines enabling an unbound pipe, where the socket may not be bound to a valid Phonet object. If the socket is not bound, two issues occur:...

CVE-2023-52566

A use after free flaw was found in nilfsgccachesubmitreaddata in the Linux kernel. This may result in a crash...

CVE-2023-43540

Memory corruption while processing the IOCTL FM HCI WRITE request...

CVE-2023-43546

Memory corruption while invoking HGSL IOCTL context create...

Memory corruption

Memory corruption while processing the IOCTL FM HCI WRITE request...

Information disclosure

Information Disclosure while processing IOCTL request in FastRPC...

Memory corruption

Memory corruption while invoking HGSL IOCTL context create...

CVE-2023-43546

CVE-2023-43546 : Memory corruption in HGSL IOCTL context creation has been reported for Qualcomm chipsets. The vulnerability is described as a local issue with high impact (Confidentiality, Integrity, Availability all HIGH) and requires LOCAL access with LOW attack complexity and LOW privileges, ...

CVE-2023-43540 Buffer Copy Without Checking Size of Input in Bluetooth HOST

Memory corruption while processing the IOCTL FM HCI WRITE request...

CVE-2023-43540

CVE-2023-43540 describes a memory corruption vulnerability in Qualcomm chipset firmware when processing the IOCTL FM HCI WRITE request. The issue is tied to the handling path for FM HCI IOCTLs and is reported with high impact across confidentiality, integrity, and availability, with a local attac...

CVE-2023-43540 Buffer Copy Without Checking Size of Input in Bluetooth HOST

Memory corruption while processing the IOCTL FM HCI WRITE request...

CVE-2023-33078 Buffer Over-read in DSP Services

Information Disclosure while processing IOCTL request in FastRPC...

CVE-2023-33078

CVE-2023-33078 affects Qualcomm FastRPC: information disclosure during processing of an IOCTL request on Qualcomm chipsets. Root cause described as information leakage in FastRPC IOCTL handling; impact is Confidentiality ( HIGH ), with Local access as attack vector per NVD metrics. Connected docu...

CVE-2023-33078 Buffer Over-read in DSP Services

Information Disclosure while processing IOCTL request in FastRPC...

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL input and output control dispatcher in appid.sys that allows a local attacker to achieve privilege escalation...

Important: kernel

Issue Overview: dmtablecreate in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to in alloctargets allocate more than INTMAX bytes, and crash, because of a missing check for struct dmioctl.targetcount. CVE-2023-52429 A flaw was found in the ATA over Ethernet AoE driver in the...

CVE-2023-52566

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfsgccachesubmitreaddata In nilfsgccachesubmitreaddata, brelsebh is called to drop the reference count of bh when the call to nilfsdattranslate fails. If the reference count hits 0 and it...

Path traversal

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfsgccachesubmitreaddata In nilfsgccachesubmitreaddata, brelsebh is called to drop the reference count of bh when the call to nilfsdattranslate fails. If the reference count hits 0 and it...

CVE-2023-52566

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfsgccachesubmitreaddata In nilfsgccachesubmitreaddata, brelsebh is called to drop the reference count of bh when the call to nilfsdattranslate fails. If the reference count hits 0 and it...