6098 matches found
kernel: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
A vulnerability was found in the Linux kernel's net rtl8xxxucore.c driver, where a race condition can lead to a use-after-free situation in the rtl8xxxustop function. This occurs when the workqueue is still running but the driver has been stopped and can lead to c2hcmdwork attempting to access...
kernel: RDMA/siw: Fix connection failure handling
A NULL dereference vulnerability was found in the Linux kernel, which is caused when the siwcmworkhandler function attempts to dereference a NULL listener that may be created when immediate MPA request processing fails and the newly created endpoint unlinks the listening endpoint ready to be...
kernel: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
A vulnerability was found in the Linux kernel's net rtl8xxxucore.c driver, where a race condition can lead to a use-after-free situation in the rtl8xxxustop function. This occurs when the workqueue is still running but the driver has been stopped and can lead to c2hcmdwork attempting to access...
kernel: RDMA/siw: Fix connection failure handling
A NULL dereference vulnerability was found in the Linux kernel, which is caused when the siwcmworkhandler function attempts to dereference a NULL listener that may be created when immediate MPA request processing fails and the newly created endpoint unlinks the listening endpoint ready to be...
SUSE CVE-2024-36924
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfcworkerwakeup lpfcworkerwakeup calls the lpfcworkdone routine, which takes the hbalock. Thus, lpfcworkerwakeup should not be called while holding the hbalock to avoid potential deadlo...
PT-2024-31337
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50 Description The issue arises in the net/mlx5e component of the Linux kernel, specifically with the SHAMPO feature. When all strides in a Work Queue Element WQE are consumed, the WQE is unlinked from the Wo...
CVE-2021-47552
A vulnerability was found in the Linux kernel's block blk-mq when dispatch work was handled during queue cleanup. This issue occurs when dispatch work is not properly canceled in both the blkcleanupqueue and diskrelease functions, which can lead to a NULL pointer dereference if the associated SCS...
CVE-2021-47552
In the Linux kernel, the following vulnerability has been resolved: blk-mq: cancel blk-mq dispatch work in both blkcleanupqueue and diskrelease For avoiding to slow down queue destroy, we don't call blkmqquiescequeue in blkcleanupqueue, instead of delaying to cancel dispatch work in...
CVE-2021-47552 blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()
In the Linux kernel, the following vulnerability has been resolved: blk-mq: cancel blk-mq dispatch work in both blkcleanupqueue and diskrelease For avoiding to slow down queue destroy, we don't call blkmqquiescequeue in blkcleanupqueue, instead of delaying to cancel dispatch work in...
PoolParty - A Set Of Fully-Undetectable Process Injection Techniques Abusing Windows Thread Pools
A collection of fully-undetectable process injection techniques abusing Windows Thread Pools. Presented at Black Hat EU 2023 Briefings under the title - injection-techniques-using-windows-thread-pools-35446"The Pool Party You Will Never Forget: New Process Injection Techniques UsingWindows Thread...
CVE-2021-47239
In the Linux kernel, the following vulnerability has been resolved: net: usb: fix possible use-after-free in smsc75xxbind The commit 46a8b29c6306 "net: usb: fix memory leak in smsc75xxbind" fails to clean up the work scheduled in smsc75xxreset- smsc75xxsetmulticast, which leads to use-after-free ...
CVE-2024-35224
OpenProject is the leading open source project management software. OpenProject utilizes "tablesorter" inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via "icon" substitution in table header values. This attack requires the permissions "Edit work...
CVE-2024-35224 Stored Cross-Site Scripting (XSS) in OpenProject
OpenProject is the leading open source project management software. OpenProject utilizes tablesorter inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via icon substitution in table header values. This attack requires the permissions "Edit work package...
SUSE CVE-2021-47239
In the Linux kernel, the following vulnerability has been resolved: net: usb: fix possible use-after-free in smsc75xxbind The commit 46a8b29c6306 "net: usb: fix memory leak in smsc75xxbind" fails to clean up the work scheduled in smsc75xxreset- smsc75xxsetmulticast, which leads to use-after-free ...
SUSE CVE-2021-47261
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function initcqfragbuf can be called to initialize the current CQ fragments buffer cq-buf, or the temporary cq-resizebuf that is filled during CQ resize operation. However, the...
SUSE CVE-2023-52731
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix invalid page access after closing deferred I/O devices When a fbdev with deferred I/O is once opened and closed, the dirty pages still remain queued in the pageref list, and eventually later those may be processed in t...
SUSE CVE-2023-52853
In the Linux kernel, the following vulnerability has been resolved: hid: cp2112: Fix duplicate workqueue initialization Previously the cp2112 driver called INITDELAYEDWORK within cp2112gpioirqstartup, resulting in duplicate initilizations of the workqueue on subsequent IRQ startups following an...
kernel: scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use rawsmpprocessorid instead of smpprocessorid The following call trace was observed: localhost kernel: nvme nvme0: NVME-FC0: controller connect complete localhost kernel: BUG: using smpprocessorid in preemptible...
kernel: md/raid5-cache: fix a deadlock in r5l_exit_log()
A deadlock vulnerability was found in the md RAID5 cache r5l subsystem in the Linux kernel. In r5lexitlog, flushwork is called while holding reconfigmutex, which waits for disablewritebackwork to complete. However, r5cdisablewritebackasync calls waitevent which requires conf-log to be NULL, but...