GHSA-4MJX-2GH5-PH8H Exposure of sensitive Slack webhook URLs in debug logs and traces

Impact Debug logs expose sensitive URLs for Slack webhooks that contain private information. Patches The problem is fixed in v1.3.2 which redacts sensitive URLs for webhooks. Workarounds Disabling/filtering debug logs in case you use Slack webhooks using tracing log level and filters. References...

Exposure of sensitive Slack webhook URLs in debug logs and traces

Impact Debug logs expose sensitive URLs for Slack webhooks that contain private information. Patches The problem is fixed in v1.3.2 which redacts sensitive URLs for webhooks. Workarounds Disabling/filtering debug logs in case you use Slack webhooks using tracing log level and filters. References...

GSD-2022-1006313 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions

spmi: trace: fix stack-out-of-bound access in SPMI tracing functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.326 by commit...

GSD-2022-1006233 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions

spmi: trace: fix stack-out-of-bound access in SPMI tracing functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...

GSD-2022-1005997 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions

spmi: trace: fix stack-out-of-bound access in SPMI tracing functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.211 by commit...

GSD-2022-1005821 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions

spmi: trace: fix stack-out-of-bound access in SPMI tracing functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.137 by commit...

GSD-2022-1005554 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions

spmi: trace: fix stack-out-of-bound access in SPMI tracing functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...

GSD-2022-1005532 tracing/eprobes: Do not allow eprobes to use $stack, or % for regs

tracing/eprobes: Do not allow eprobes to use $stack, or % for regs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

GSD-2022-1005529 tracing/eprobes: Have event probes be consistent with kprobes and uprobes

tracing/eprobes: Have event probes be consistent with kprobes and uprobes This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

PT-2022-34388 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.256 Description: The issue concerns a stack-out-of-bound access in SPMI tracing functions. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions pri...

PT-2022-33812 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: The issue concerns a stack-out-of-bound access in SPMI tracing functions. It was introduced in version v4.3 and fixed in Linux Kernel version v5.15.61. The actual impact and attack...

PT-2022-34491 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.291 Description: The issue concerns a stack-out-of-bound access in SPMI tracing functions. It was introduced in version v4.3 and fixed in version v4.14.291. The actual impact and attack plausibility have n...

PT-2022-34079 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: The issue concerns a stack-out-of-bound access in SPMI tracing functions. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.3 and fixed in...

PT-2022-34571 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.326 Description: The issue concerns a stack-out-of-bound access in SPMI tracing functions. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prio...

GSD-2022-1005192 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions

spmi: trace: fix stack-out-of-bound access in SPMI tracing functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1005173 tracing: Use a copy of the va_list for __assign_vstr()

tracing: Use a copy of the valist for assignvstr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1005163 tracing/eprobes: Have event probes be consistent with kprobes and uprobes

tracing/eprobes: Have event probes be consistent with kprobes and uprobes This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by commit...

PT-2022-33431 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to the tracing functionality in the Linux Kernel, specifically with the assign vstr function. It involves using a copy of the va list to potentially mitigate a security...

PT-2022-33424 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: The issue concerns the tracing/eprobes feature in the Linux Kernel, where eprobes should not be allowed to use $stack or % for registers. The actual impact and attack plausibility of this...

PT-2022-33450 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue concerns a stack-out-of-bound access in SPMI tracing functions. It was introduced in version v4.3 and fixed in Linux Kernel version v5.19.2. The actual impact and attack plausibili...