24590 matches found
fs/ntfs3: cancle set bad inode after removing name fails
...
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
...
RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
...
kprobes: Fix possible use-after-free issue on kprobe registration
...
Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.
...
dm cache: fix flushing uninitialized delayed_work on cache_ctr error
...
HDF5 H5Ocache.c H5O__cache_chk_serialize null pointer dereference
...
drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
...
fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
...
ksmbd: fix slab out of bounds write in smb_inherit_dacl()
...
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
...
eth: bnxt: always recalculate features after XDP clearing, fix null-deref
...
padata: Fix pd UAF once and for all
...
cachefiles: Fix NULL pointer dereference in object->file
...
HDF5 H5MM.c H5MM_realloc double free
...
ice: arfs: fix use-after-free when freeing @rx_cpu_rmap
...
usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
...
A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
...
zram: fix NULL pointer in comp_algorithm_show()
...
An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.
...
HDF5 H5FL.c H5FL__blk_gc_list use after free
...
rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()
...
watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()
...
drm/amd/display: Fix null pointer deref in dcn20_resource.c
...
An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401.
...
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
...
sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.
...
btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
...
scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
...
xfrm: state: fix out-of-bounds read during lookup
...
drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing
...
netfilter: nf_tables: fix memleak in map from abort path
...
If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.
...
Cri-o: pods are able to break out of resource confinement on cgroupv2
...
wifi: mac80211: fix NULL dereference at band check in starting tx ba session
...
ksmbd: fix Preauh_HashValue race condition
...
block: fix uaf for flush rq while iterating tags
...
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
...
mm: zswap: properly synchronize freeing resources during CPU hotunplug
...
drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
...
Usage of unsafe random function in form-data for choosing boundary
...
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
...
BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
...
bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
...
Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init
...
In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
...
Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
...
It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to cause remote denial of service.
...
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
...