UBUNTU-CVE-2024-44993

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix out-of-bounds read in v3dcsdjobrun When enabling UBSAN on Raspberry Pi 5, we get the following warning: 387.894977 UBSAN: array-index-out-of-bounds in drivers/gpu/drm/v3d/v3dsched.c:320:3 387.903868 index 7 is out of...

Division By Zero Error

TensorFlow is vulnerable to a Division By Zero Error. The vulnerability is due to the EmbeddingLookup TFLite operator not checking if the first dimension of the value input is zero before performing a division operation. It allows an attacker to craft a model that triggers the error, potentially...

kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq

in linux kernel, shift undefined behavior occurs in bnxtqpliballocinithwq with hwqattr-auxdepth of nonzero and hwqattr-auxstride of zero...

kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq

in linux kernel, shift undefined behavior occurs in bnxtqpliballocinithwq with hwqattr-auxdepth of nonzero and hwqattr-auxstride of zero...

SUSE CVE-2022-48906

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

DEBIAN-CVE-2022-48906

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

UBUNTU-CVE-2022-48906

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

PT-2024-33775

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability has been resolved in the Linux kernel, specifically in the blk iocost component, where out of bound shifts were caught by UBSAN in the ioc forgive debts function. The issue...

PT-2024-32245

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the initialization of the vmap block structure in the Linux kernel. When a new vmap block is being instantiated by new vmap block, the partially initialized...

kernel: media: gspca: cpia1: shift-out-of-bounds in set_flicker

In the Linux kernel, the following vulnerability has been resolved: media: gspca: cpia1: shift-out-of-bounds in setflicker Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the...

kernel: wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211gettxpower We can get a UBSAN warning if ieee80211gettxpower returns the INTMIN value mac80211 internally uses for "unset power level". UBSAN: signed-integer-overflow in...

kernel: media: gspca: cpia1: shift-out-of-bounds in set_flicker

In the Linux kernel, the following vulnerability has been resolved: media: gspca: cpia1: shift-out-of-bounds in setflicker Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the...

UBUNTU-CVE-2024-42148

In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FPSBMAXE1x...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that originates from a UBSAN array index out-of-bounds in the bnx2x module when using systems with more than 32 physical CPU cor...

XMP Toolkit's `XmpFile::close` can trigger undefined behavior

Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occurred, it would trigger undefined behavior, typically a process abort. This is best demonstrated in issue 230, where a race condition causes the close call to fail due ...

`XmpFile::close` can trigger UB

Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occured, it would trigger undefined behavior, typically a process abort. This is best demonstrated in issue 230, where a race condition causes the close call to fail due t...

SUSE CVE-2024-40987

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix UBSAN warning in kvdpm.c Adds bounds check for sumovidmappingentry...

PT-2024-40915 · Unknown · Xmp Toolkit

Name of the Vulnerable Software and Affected Versions: xmp toolkit versions prior to 1.9.0 Description: The issue arises when C++ exceptions are raised within the XmpFile::close function, leading to undefined behavior, typically a process abort. This can be triggered by a race condition causing...

kernel: ext4: fix double-free of blocks due to wrong extents moved_len

A vulnerability was found in the Linux kernel. This issue occurs in the ext4 function, in ext4moveextents, where an error in updating the movedlen variable can lead to double-free of blocks and corrupt block accounting. This could lead to crashes or undefined behavior...

mruby:mruby_proto_fuzzer: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=5180359298318336 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyprotofuzzer Job Type: libfuzzerubsanmruby Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace Sanitizer:...