575523 matches found
kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
A flaw was found in the Linux kernel's Sound Open Firmware SOF subsystem, specifically within the ipc3-control component. This vulnerability occurs in the sndsofupdatecontrol function where the size of firmware-provided data is not properly validated against the allocated buffer size. An attacker...
kernel: block: zero non-PI portion of auto integrity buffer
An information disclosure vulnerability was found in the Linux kernel's block layer integrity handling. When auto-generating integrity buffers for writes with protection information PI enabled, the non-PI portion of the metadata buffer is left uninitialized if the metadata size exceeds the PI tup...
kernel: smb: client: fix double-free in SMB2_flush() replay
A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...
kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock...
kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush()
A flaw was found in the Linux kernel's block input/output control group blk-cgroup component. This vulnerability, a Use-After-Free UAF, occurs when multiple block control groups are released at the same time. A race condition allows one group to remove another's entries while it is still in use,...
kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...
kernel: af_unix: Drop all SCM attributes for SOCKMAP
A flaw was found in the Linux kernel's afunix component, specifically within its SOCKMAP feature. This vulnerability stems from the kernel's improper handling of Socket Control Message SCM attributes when data is passed to the SOCKMAP layer. This can lead to a use-after-free condition, which may...
kernel: xfrm: ah6: validate routing header segments_left
A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 Authentication Header for IPv6 module. The ipv6rearrangerthdr function does not properly validate the segmentsleft field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacke...
sudo: Sudo: Policy bypass allows unauthorized program execution via execveat
A flaw was found in Sudo. This vulnerability allows users who are permitted to run specific commands to bypass security policy checks when using the execveat system call in ptrace-based intercept mode. By directly calling execveat or fexecve, an attacker can execute programs that would otherwise ...
FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests
A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders
A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...
FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response
A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...
FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read
A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application...
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders
A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...
FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read
A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application...
FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests
A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...
FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response
A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...
libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation
A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...
SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service
A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...
kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite
A flaw was found in the Linux kernel's netfilter bridge ebtables SNAT Source Network Address Translation module. This vulnerability allows a local attacker on a system configured with specific bridge netfilter rules to improperly modify underlying memory pages during an ARP Address Resolution...