GSD-2022-1002538 usb: dwc2: gadget: don't reset gadget's driver->bus

usb: dwc2: gadget: don't reset gadget's driver-bus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002537 sysrq: do not omit current cpu when showing backtrace of all active CPUs

sysrq: do not omit current cpu when showing backtrace of all active CPUs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002536 staging: rtl8712: fix uninit-value in r871xu_drv_init()

staging: rtl8712: fix uninit-value in r871xudrvinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002535 nbd: fix io hung while disconnecting device

nbd: fix io hung while disconnecting device This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002534 cifs: fix potential deadlock in direct reclaim

cifs: fix potential deadlock in direct reclaim This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002533 drm/radeon: fix a possible null pointer dereference

drm/radeon: fix a possible null pointer dereference This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002532 ceph: flush the mdlog for filesystem sync

ceph: flush the mdlog for filesystem sync This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002531 ceph: fix possible deadlock when holding Fwb to get inline_data

ceph: fix possible deadlock when holding Fwb to get inlinedata This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002530 nbd: call genl_unregister_family() first in nbd_cleanup()

nbd: call genlunregisterfamily first in nbdcleanup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002529 drm/amd/display: Check if modulo is 0 before dividing.

drm/amd/display: Check if modulo is 0 before dividing. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002528 s390/gmap: voluntarily schedule during key setting

s390/gmap: voluntarily schedule during key setting This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002527 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.5 by commit...

GSD-2022-1002526 heap buffer overflow in OpenSSL version 3.0.4

In OpenSSL version 3.0.4 a heap buffer overflow exists in the AVX512 support that can be attacked via network resulting in code execution. This is reachable via four code paths: RSAZ 1024, RSAZ 512, Dual 1024 RSAZ, and Default constant-time Montgomery modular exponentiation. Please note this issu...

GSD-2022-2274 heap buffer overflow in OpenSSL version 3.0.4

In OpenSSL version 3.0.4 a heap buffer overflow exists in the AVX512 support that can be attacked via network resulting in code execution. This is reachable via four code paths: RSAZ 1024, RSAZ 512, Dual 1024 RSAZ, and Default constant-time Montgomery modular exponentiation. Please note this issu...

GSD-2022-1002525 IP address filtering in Google Cloud Platform (GCP) version All versions as of 2022-06-07 and later (unfixed as of yet)

In Google Cloud Platform GCP, all versions as of 2022-06-07 and later unfixed as of yet an IP address filtering vulnerability exists in the Kubernetes control plane that can be attacked via other systems within Google Cloud Engine's network filtering is only applied to external IP addresses...

GSD-2022-30190 From the original tweet: Interesting maldoc was submitted from Belarus. It uses Word's external link to load the HTML and then uses the "ms-msdt" scheme to execute PowerShell code. From Microsoft: A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. This issue has been nicknamed "Follina "

From the original tweet: Interesting maldoc was submitted from Belarus. It uses Word's external link to load the HTML and then uses the "ms-msdt" scheme to execute PowerShell code. From Microsoft: A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calli...

GSD-2022-1002524 input validation (CWE-20) in Elastic Load Balancer (ELB) version ELB prior to 2022-01-29 when "Legacy cache settings" is enabled

In Amazon Elastic Load Balancer ELB prior to 2022-01-29 when "Legacy cache settings" is enabled an input validation CWE-20 vulnerability exists in the HTTP Header processing that can be attacked via the network using a trailing space in the requests resulting in HTTP Header Smuggling...

GSD-2022-1002523 data processing in LG F4DV910H2 version possibly all washers in the F4DV series

In the LG F4DV910H2 washing machine, possibly all washers in the F4DV series, a data processing vulnerability exists in the WiFi card and/or software that can be attacked via simply sending a large amount of WiFi network traffic on the WiFi network the washer is attached to, resulting in the wash...

GSD-2022-1002522 backdoor in phpass version 0.3.x-dev, 0.3.x

In PHP phpass version 0.3.x-dev, 0.3.x a backdoor exists in the phpass package that can be attacked via malicious package update resulting in credential theft...

GSD-2022-1002521 backdoor in ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6

In PyPI ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6 a backdoor exists in the ctx package that can be attacked via a malicious package update resulting in credential theft from environment variables...

GSD-2022-1002520 typosquatting / spellcheck squatting in rustdecimal version all

In rustdecimal, all versions prior to 1.23.4 contain malicious code that downloads a binary masked as a "readme" file and then depending on the OS, making it executable and ran it. The rustdecimal crate appears to be a malicious clone of the real rust-decimal crate. Due to the similarity of the...

GSD-2022-1002519 Information Leakage in Analytics version curent as of 2022-05-19

In the Google Analytics admin web interface, current as of 2022-05-19 an information leakage exists in the Account Access Management and Property Access Management that can be used, resulting in an attacker determining if a Google-hosted email address is in fact a Google account or a google group...

GSD-2022-1002518 CWE-158: Improper Neutralization of Null Byte or NUL Character in iPhone, iPad version ALL

In Apple iPhone, iPad version ALL a CWE-158: Improper Neutralization of Null Byte or NUL Character exists in the QR/Barcode Scanner that can be attacked via Phishing, Social engineering resulting in As other scanners checked, such as on various Android devices, escape or strip the QR with embedde...

GSD-2022-1002517 netfilter: nf_tables: initialize registers in nft_do_chain()

netfilter: nftables: initialize registers in nftdochain This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.309 by commit...

GSD-2022-1002516 mac80211: fix potential double free on mesh join

mac80211: fix potential double free on mesh join This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.309 by commit...

GSD-2022-1002515 llc: only change llc->dev when bind() succeeds

llc: only change llc-dev when bind succeeds This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.309 by commit...

GSD-2022-1002514 jffs2: fix use-after-free in jffs2_clear_xattr_subsystem

jffs2: fix use-after-free in jffs2clearxattrsubsystem This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002513 jffs2: fix memory leak in jffs2_scan_medium

jffs2: fix memory leak in jffs2scanmedium This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002512 jffs2: fix memory leak in jffs2_do_mount_fs

jffs2: fix memory leak in jffs2domountfs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002511 mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node

mm/pagesalloc.c: don't create ZONEMOVABLE beyond the end of a node This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002510 NFSD: prevent underflow in nfssvc_decode_writeargs()

NFSD: prevent underflow in nfssvcdecodewriteargs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002509 video: fbdev: sm712fb: Fix crash in smtcfb_read()

video: fbdev: sm712fb: Fix crash in smtcfbread This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002508 video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()

video: fbdev: smscufx: Fix null-ptr-deref in ufxusbprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002507 media: usb: go7007: s2250-board: fix leak in probe()

media: usb: go7007: s2250-board: fix leak in probe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002506 ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction

ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002505 ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe

ASoC: atmel: Add missing ofnodeput in at91sam9g20ekaudioprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002504 ASoC: mxs: Fix error handling in mxs_sgtl5000_probe

ASoC: mxs: Fix error handling in mxssgtl5000probe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002503 ath9k_htc: fix uninit value bugs

ath9khtc: fix uninit value bugs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit 5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9, it...

GSD-2022-1002502 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002501 scsi: pm8001: Fix abort all task initialization

scsi: pm8001: Fix abort all task initialization This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002500 drm/tegra: Fix reference leak in tegra_dsi_ganged_probe

drm/tegra: Fix reference leak in tegradsigangedprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002499 ext2: correct max file size computing

ext2: correct max file size computing This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit df95b0e4f1e2eb7ebbef6618b14a802ea55ce32...

GSD-2022-1002498 power: supply: wm8350-power: Add missing free in free_charger_irq

power: supply: wm8350-power: Add missing free in freechargerirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002497 af_netlink: Fix shift out of bounds in group mask calculation

afnetlink: Fix shift out of bounds in group mask calculation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002496 mxser: fix xmit_buf leak in activate when LSR == 0xff

mxser: fix xmitbuf leak in activate when LSR == 0xff This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002495 NFS: remove unneeded check in decode_devicenotify_args()

NFS: remove unneeded check in decodedevicenotifyargs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002494 kgdboc: fix return value of __setup handler

kgdboc: fix return value of setup handler This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002493 pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe

pinctrl: nomadik: Add missing ofnodeput in nmkpinctrlprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002492 net/x25: Fix null-ptr-deref caused by x25_disconnect

net/x25: Fix null-ptr-deref caused by x25disconnect This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002491 PM: core: keep irq flags in device_pm_check_callbacks()

PM: core: keep irq flags in devicepmcheckcallbacks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...