Qualcomm Chipsets 缓冲区错误漏洞

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. Qualcomm Chipsets have a security vulnerability that stems from a memory corruption issue when obtaining TX status information...

kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

A use after free exists in the wifi module of the linux kernel in the function brcmfnetdevstartxmit,thereby leading to damage to system availability and integrity...

kernel: rxrpc: Fix locking in rxrpc's sendmsg

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix locking in rxrpc's sendmsg Fix three bugs in the rxrpc's sendmsg implementation: 1 rxrpcnewclientcall should release the socket lock when returning an error from rxrpcgetcallslot. 2 rxrpcwaitfortxwindowintr will return...

kernel: can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits

In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcanreadfifo,echotxevent: shift timestamp to full 32 bits In commit 1be37d3b0414 "can: mcan: fix periph RX path: use rx-offload to ensure skbs are sent from softirq context" the RX path for peripheral devices was...

kernel: can: m_can: m_can_tx_handler(): fix use after free of skb

In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcantxhandler: fix use after free of skb canputechoskb will clone skb then free the skb. Move the canputechoskb for the mcan version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch...

CVE-2022-47522

The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept possibly cleartext target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point such as authentication...

Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues Affecting Multiple Cisco Products

On March 27, 2023, the research paper Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues was made public. This paper discusses vulnerabilities in the 802.11 standard that could allow an attacker to spoof a targeted wireless client and redirect frames that are present in th...

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host resulting in a denial of service. The highest threat from this vulnerability is to system availability.

...

SUSE CVE-2011-1023

The Reliable Datagram Sockets RDS subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map updates, which allows local users to cause a denial of service BUGON and system crash via vectors involving 1 a loopback aka loop transmit operation or 2 an InfiniBand aka ib...

SUSE CVE-2012-0029

Heap-based buffer overflow in the processtxdesc function in the e1000 emulation hw/e1000.c in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service QEMU crash and possibly execute arbitrary code via crafted legacy mode packets...

SUSE CVE-2015-6815

The processtxdesc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service infinite loop and guest crash via unspecified vectors...

SUSE CVE-2016-10906

An issue was discovered in drivers/net/ethernet/arc/emacmain.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arcemactx and arcemactxclean...

SUSE CVE-2021-20257

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits tx descriptors in processtxdesc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial o...

SUSE CVE-2021-47527

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 "tty: serialcore: convert uartclose to use ttyportclose" converted serial core to use ttyportclose but failed to notice that the transmit buffer still needs ...

SUSE CVE-2022-3110

An issue was discovered in the Linux kernel through 5.16-rc6. rtwinitxmitpriv in drivers/staging/r8188eu/core/rtwxmit.c lacks check of the return value of rtwallochwxmits and will cause the null pointer dereference...

GSD-2023-1000914 ALSA: line6: fix stack overflow in line6_midi_transmit

ALSA: line6: fix stack overflow in line6miditransmit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.87 by commit...

PT-2023-33535 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.17 Description: A stack overflow issue was discovered in the line6 midi transmit function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prio...

PT-2023-33200 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.83 Description: The issue is related to a call to tipc lxc xmit without holding node read lock. This problem was introduced in version v5.5 and is fixed in Linux Kernel version v5.15.83. The actual impact...

PT-2025-37651

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel where a NULL dereference may occur within the mac80211 hwsim select tx link function. This happens when the sta pointer is NULL, leading to a potential...

PT-2025-37544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue in the ath12k driver related to management transmit cleanup. A missing reference to 'ar' in skb cb can lead to a NULL pointer dereference during...