Linux Kernel Security Vulnerabilities

The Linux kernel version 6.13 contains security vulnerabilities. These vulnerabilities stem from an error in the update order of NACL firewall entries. The Config field is written first, resulting in pending entries that are observed by the SBI implementation or the NACL hardware. This leads to...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 7.2.9 have a security vulnerability. This vulnerability arises from the BPF verifier failing to reject the transfer of the PTRTOPACKET pointer to procedures that may modify data packets, potentially causing the data packet memory area to become invalid...

Johannes Kuhlmann cgltf buffer error vulnerability

Johannes Kuhlmann’s cgltf versions prior to 1.15 contain a buffer error vulnerability. This vulnerability stems from the cgltfaccessorunpackfloats function, which advances the cursor based on the byteStride of the base bufferView when handling sparse values. This allows for heap out-of-bound...

Linux Kernel Security Vulnerabilities

The Linux kernel version 7.2 contains a security vulnerability. This vulnerability stems from the lack of migration protection in rhtabmaplookupanddeletebatch. Under CONFIGPREEMPTRCU, only rcureadlock is used without disabling migration. Tasks involved in the deletion process can be migrated...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains security vulnerabilities. These vulnerabilities stem from the KVM x86/mmu failing to terminate the traversal of shadow page tables immediately when the root is invalid or dummy root. When memslot creation competes with L2’s stage-2 page errors, the shadow pag...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.12 has security vulnerabilities. These vulnerabilities stem from the fact that the LBLCR and LBLC caches in ipvs are not limited in their growth. Functions like ipvslblcrnew and ipvslblcnew create cache entries for each unseen target address. However, maxsize only...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.26 contains security vulnerabilities. These vulnerabilities stem from race conditions between the tty break ioctl and hang operations. TCSBRK and TCSBRKP are not terminated in time, which may lead to the callback of the tty driver for devices that have been removed...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the EDAC/altera driver, which marks the setup callback and auxiliary functions of a10 EDAC as init. These functions may execute after memory release during the probe path, resulting in the dereferencing of already releas...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.3 has a security vulnerability. This vulnerability stems from the use of hcichansent, which accesses chan-conn after releasing the RCU read lock and returns the channel. The ACL and LE scheduler utilize their data packet queues and update the send counter even when...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.18 contains a security vulnerability. This vulnerability arises from the incorrect invocation of the bonding-specific API when processing team device events by using net/mlx5. This leads to out-of-bound memory access to the slab structure...

Linux Kernel Security Vulnerabilities

Security vulnerabilities exist in Linux kernels versions ranging from 6.12.26 to 6.12.113, 5.4.293 to 5.5, 5.10.237 to 5.11, 5.15.181 to 5.16, 6.1.136 to 6.2, 6.6.89 to 6.7, 6.14.5 to 6.15, and 6.15 itself. These vulnerabilities stem from the fact that when the GEVNTCOUNT value read by...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.18 contains security vulnerabilities. These vulnerabilities arise from the failure to return values when PTP is not in use. During the unbinding of drivers, the uninitialized txskbs queue is cleaned up, leading to null pointer dereferencing...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.10 contains security vulnerabilities. These vulnerabilities arise from the fact that when netdevsetnumtc reduces the numtc, the tctotxq and priotcmap arrays are not cleaned up properly. This leads to netdevtxqtotc returning an out-of-range traffic category. Additionally...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.9 contains security vulnerabilities. These vulnerabilities stem from the lack of mandatory kernel access permissions for the textpoke event. This allows privileged tasks to obtain the kernel’s instruction address through PERFRECORDTEXTPOKE, thereby leaking the runtime...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the function pn533acr122isrxframevalid, which does not validate the frame-ccid.datalen value read from the USB response frame. Instead, it uses this value as an index for frame-data. Malicious or faulty devices can set...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.3 contains a security vulnerability. This vulnerability stems from the nfcllcpwkssap function, which only compares the servicenamelen bytes. A shorter servicename may match the prefix of the longer WKS string, potentially leading to WKS SAP hijacking...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.13 has a security vulnerability. This vulnerability stems from the threaded IRQ handler in the gp2ap020a00f driver, which queues data-work through the irqworkqueue. However, the freeirq function does not refresh the queued irwork, resulting in the work continuing to run...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.11 contains security vulnerabilities. These vulnerabilities stem from a race condition in IPv6’s cached routing processing: when listdelinit is executed concurrently, listempty is incorrectly evaluated as true. This leads to the incorrect invocation of dstholdsafe, and...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.8 contains a security vulnerability. This vulnerability stems from the bpfsock context code, which fails to ensure that the width of the read value is consistent with the assumptions of the verifier when reading the rxqueuemapping field. As a result, the values of runti...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.3 contains a security vulnerability. This vulnerability arises from the possibility that rt6insertexception may be called after fib6info is removed through fib6purgert. As a result, rt6Flushexceptions no longer sets the flags, leading to the successful creation of new...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.13 contains a security vulnerability. This vulnerability arises from the fact that the UDP socket is disconnected from the quadruplet hash table, but the hash count remains retained. As a result, data packets are still processed through quadruplet lookups, which may lea...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.11 contains security vulnerabilities. One of these vulnerabilities arises from sockmapalloc, which does not reject entries greater than INTMAX. Additionally, sockmapfree uses a signed int to iterate through the sks array, leading to integer overflows and potential...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.3 contains a security vulnerability. This vulnerability stems from the use of “Exception info %s” in the btintelHWerror function, where the print statement utilizes skb-data + 1. Additionally, the 12-byte payload does not end with NULs, potentially leading to excessive...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.18 contains security vulnerabilities. These vulnerabilities arise from the lack of cancellation of the wake-up process when a device is removed. Additionally, remote wake-up requests may re-trigger this process after it has been canceled, leading to reuse after release...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the pasteselection function, which releases the selection mutex lock during a loop. As a result, concurrent TIOCLINUX ioctl operations can reduce the vcsel.buflen to a value below pasted, leading to unsigned integer...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the sctpwaitforconnect function releasing the socket lock during sleep. Additionally, the shutdown mechanism does not check this state before reusing the connection after setting RCVSHUTDOWN. This could lead to the...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.0 contains security vulnerabilities. These vulnerabilities arise from the fact that the IRQ is not stopped before terminating the work queue, resulting in the possibility of the IRQ still scheduling plat-work into the queue when the remove function removes the queue...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.14.9 to 6.15 and 6.15 itself have security vulnerabilities. These vulnerabilities stem from the fact that when CONFIGDCB is enabled, it does not check whether queuetopfcmap has been initialized. This can lead to invalid memory accesses by SDP VFs...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.10 contains a security vulnerability. This vulnerability arises from pfcpnewlink creating a UDP socket before registernetdevice. After the registration fails, the socket is released repeatedly through an erroneous path, resulting in a null pointer dereference...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.18 contains security vulnerabilities. These vulnerabilities stem from the cachekeydecode function, which does not validate the logical offset and length of keys coming from persistent memory, potentially leading to out-of-bounds writes...

DataStax Starlight for JMS has a vulnerability related to input validation errors

DataStax Starlight for JMS 9.0.3 and earlier versions have a security vulnerability. This vulnerability arises from operations on the decode function in the file Starlight for JMS/src/main/java/com/DataStax/oss/pulsar/jms/messages/PulsarObjectMessage.java, which may lead to deserialization and...

AbiWord wv buffer error vulnerability

AbiWord versions 1.2.9 and earlier have a buffer error vulnerability. This vulnerability stems from the wvGetSTSH function in stylesheet.c, which involves heap-based out-of-bounds read operations. Attackers can exploit this vulnerability by providing custom Word style sheets or.doc files containi...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.8 contains security vulnerabilities. These vulnerabilities stem from the netfs component, which fails to clear the outdated pagecache after writing files through write operations. This may result in residual data from previous writes via mmap being exposed or retained i...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.35 has a security vulnerability. This vulnerability arises from hifusbtx, which limits TX aggregation by the number of records, rather than by the cumulative byte length. As a result, memcpy may exceed the bounds and write data into txbuf-buf, potentially causing memo...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.35 has a security vulnerability. This vulnerability stems from the ath9kwmirspcallback function, which copies data according to the number of bytes expected by the wait command after removing the verified WMI headers. However, it does not verify the length of the...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.6 contains a security vulnerability. This vulnerability arises from the mtkethsoc driver, which allocates a dummy netdev after registering the MAC netdev and adds shared NAPIs. This results in a null pointer derefrence when network devices become visible prematurely,...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.4 contains security vulnerabilities. These vulnerabilities stem from the mtkdrmbind function, which prematurely returns and does not release the disp-mutex device reference obtained through offinddevicebynode when handling non-mmsys primary devices. This can lead to...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.2 contains security vulnerabilities. These vulnerabilities stem from the kionix-kx022a driver’s improper array boundary checking when converting register values to array indices. As a result, sizeofarray is incorrectly interpreted as the last valid index, potentially...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.7 contains a security vulnerability. This vulnerability arises from the getmtddevice function, which calls the getdevice callback of the main MTD. During this process, the mtd parameter passed in may be a partition. However, the putmtddevice function passes in the main...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 6.12.112 to 6.13, 6.18.55 to 6.19, and 7.0. These vulnerabilities stem from the function bpfmasetdtor, which copies map-record but does not maintain the BTF reference within the destructor context. As a result, the working queue still...

Linux Kernel Security Vulnerabilities

The Linux kernel version 7.1 contains a security vulnerability. This vulnerability arises from calling ops.dequeue while holding the source user’s DSQ lock. When the BPF scheduler locks the source user’s DSQ using ops.dequeue, a deadlock can occur. Additionally, all DSQ locks share the same lockd...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel from 6.18.34 to 6.18.56, as well as 7.0.11 to 7.1 and 7.1 itself, have security vulnerabilities. These vulnerabilities stem from the fprobe processing program executing when RCU does not monitor it. The standard RCU grace period does not wait for these executions, and...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.9 contains a security vulnerability. This vulnerability stems from KVM arm64 failing to properly apply fine-grained UNDEF exceptions. As a result, the configuration of FGT traps is limited to FEATFGT only. This could lead to false warnings being triggered when running...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.0 contains security vulnerabilities. These vulnerabilities arise when binder directly calls kfree to release outdated transactions during the TFUPDATETXN transaction, replacing frozen processes. This bypasses the binderfreetxnfixups function, resulting in a leak of...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.19 contains security vulnerabilities. These vulnerabilities stem from binderfs’ binderadddevice function, which accesses freed objects after simpledonecreating releases the parent directory lock and dentry references. Concurrently, unlinkat can delete the new device ent...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.27 has a security vulnerability. This vulnerability arises from the use of sierragetswocinfo, which requests 60-byte SWoC information through usbcontrolmsg. It does not reject short transmissions, resulting in the newly allocated swocinfo buffer being uninitialized at...

Gitea security vulnerabilities

Gitea versions 28.1.0 and earlier have security vulnerabilities. These vulnerabilities stem from the fact that when parsing SSH certificates, the system searches for all stored public keys rather than just the main key. If a user trusts the certificate authority and accepts any main key, it may...

Gitea authorization issue vulnerability

Gitea 1.27.2 and earlier versions have an authorization issue. This issue arises from the lack of the individualPermsChecker middleware during the registration of seven API routes under /api/v1/users/username. This failure does not enforce visibility for target users, potentially allowing...

libLAS buffer error vulnerability

LibLAS versions 1.8.1 and earlier have a buffer error vulnerability. This vulnerability arises from the point record reader truncating the schema byte size to 16 bits when calculating the point buffer size. An attacker can create a .las file with a schema exceeding 65,535 bytes, resulting in...

Grigory Chudov’s buffer error vulnerability

Grigory Chudov’s libtta versions 2.3 and earlier have a buffer error vulnerability. This vulnerability arises from the lack of header checks that reject zero audio channels. An attacker can create a specially crafted .tta file that declares zero audio channels, causing the application to access...