kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

kernel: netfilter: require Ethernet MAC header before using eth_hdr()

A flaw was found in the Linux kernel's netfilter component. Certain netfilter modules, including ip6teui64 and xtmac, accessed Ethernet MAC header data without first verifying that an Ethernet device was associated with the network packet or that the MAC header was present and of sufficient lengt...

kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

A flaw was found in the Linux kernel's Internet Small Computer System Interface iSCSI Extensions for Remote Direct Memory Access RDMA iSER module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow...

kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTORAW. A remote attacker could send a specially crafted ICMP Internet Control Message Protocol packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for...

kernel: flow_dissector: do not dissect PPPoE PFC frames

A flaw was found in the Linux kernel's flow dissector. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted Point-to-Point Protocol over Ethernet PPPoE Protocol Field Compression PFC frame to an affected system. The incorrect processing of...

kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

A flaw was found in the Linux kernel's Point-to-Point Protocol PPP subsystem. A local unprivileged user can exploit this vulnerability by creating a new user namespace and bypassing authorization checks for unattached administrative input/output controls ioctls. This allows the user to perform...

kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change

A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol network component. A race condition exists during an MTU Maximum Transmission Unit change when the system reallocates receive buffers. This can allow a remote attacker to trigger an out-of-bounds write or write to a freed...

kernel: ipv6: prevent possible UaF in addrconf_permanent_addr()

A flaw was found in the Linux kernel's IPv6 networking subsystem. Specifically, a Use-after-Free UaF vulnerability exists within the addrconfpermanentaddr function. This issue arises when the system attempts to access an IPv6 address after it has been freed, which could allow an attacker to cause...

libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

kernel: ALSA: seq: Serialize UMP output teardown with event_input

A flaw was found in the Advanced Linux Sound Architecture ALSA sequencer component of the Linux kernel. This vulnerability, a use-after-free, occurs because of improper synchronization when handling Universal MIDI Packet UMP output. A local attacker could exploit this by creating a specific timin...

kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL

A flaw was found in the Linux kernel's ice driver. A malicious virtual function VF can provide an out-of-range 'ptype' value through the VIRTCHNL interface. This can lead to a write past the end of an allocated memory region, causing a kernel page fault and resulting in a Denial of Service DoS...

kernel: dm_early_create: fix freeing used table on dm_resume failure

A flaw was found in the Linux kernel's device mapper DM subsystem. During certain resume operations, the kernel might attempt to free a memory table that has already been released. This error, known as a double-free vulnerability, can lead to memory corruption. A successful exploit could result i...

kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow

A flaw was found in the Linux kernel's t7xx WWAN driver. A malicious, buggy, or compromised modem firmware can exploit this by sending packets with excessive fragments. This leads to a buffer overflow in the skbshinfoskb-frags array, corrupting adjacent memory. This can result in kernel crashes o...