CVE Vulnerability Catalog

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth HIDP subsystem. The issue is caused by not releasing the l2cap_conn reference when the user->remove callback is invoked, potentially leading to system crashes.

In the Linux kernel, the Bluetooth L2CAP subsystem has a use-after-free vulnerability in l2cap_unregister_user. Missing locking (conn->lock) between l2cap_conn_del() and registration functions causes a race condition leading to use-after-free and list corruption.

In the Linux kernel, the iptunnel_xmit_stats() function has a vulnerability due to missing support for NETDEV_PCPU_STAT_DSTATS. It assumed tunnels only use NETDEV_PCPU_STAT_TSTATS, causing syncp offset differences between pcpu_sw_netstats and pcpu_dstats, leading to corruption or hangs on 32-bit kernels.

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in the ctnetlink_dump_exp_ct() function. The conntrack pointer is stored in netlink callback data but its reference is dropped immediately after dump start, causing a use-after-free on subsequent recvmsg() calls.

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability where Content-Length is truncated from unsigned long to unsigned int in sip_help_tcp(). On 64-bit systems, values exceeding UINT_MAX are silently truncated, causing incorrect SIP message boundary calculation and potentially processing trailing data as a second SIP message.

An out-of-bounds read vulnerability exists in the Linux kernel's netfilter nf_conntrack_h323 module in the decode_int() function's CONS case. Missing boundary check allows reading 1-4 bytes beyond the allocated buffer via a crafted H.323/RAS packet.

In the Linux kernel's MANA driver, a use-after-free vulnerability exists in mana_hwc_destroy_channel(). The teardown order frees hwc->caller_ctx before destroying CQ and EQ queues, allowing interrupt handlers to access freed memory.

In the Linux kernel, in the TI ICSSG PRUETH network driver, there is a memory leak in the XDP_DROP path for non-zero-copy mode. Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, but this causes a memory leak when running XDP programs that drop packets in non-zero-copy mode (standard page pool mode). Pages are never returned to the page pool, leading to OOM conditions. The fix handles cleanup in the caller, emac_rx_packet(), which now recycles the page back to the page pool when emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP.

In the Linux kernel, a potential infinite loop in bond_header_parse() occurs when a stack of two bonding devices is set up. A 'dev' parameter was added to the parse() method in header_ops to bound recursion and ensure the correct leaf method is called.

A double-free vulnerability was found in the Linux kernel's TEQL (trivial link equalizer) network scheduler. The issue occurs because qdisc_reset is called without proper locking when a TEQL device uses a lockless root qdisc, leading to a race condition and double memory free.

In the cdc_ncm driver (Linux kernel), the cdc_ncm_rx_verify_ndp16() function omitted ndpoffset in the second bounds check for the DPE array. When the NDP is near the end of the buffer, out-of-bounds read may occur.

In the cdc_ncm driver (Linux kernel), the cdc_ncm_rx_verify_ndp32() function omitted ndpoffset in the bounds check for the DPE array, allowing out-of-bounds read when the NDP32 is near the end of the buffer.

In the igc driver (Linux kernel), during TX queue shutdown with XDP and timestamp requests, xsk_meta pointers were not cleared, causing a page fault in the interrupt handler when accessing them.

In the Linux kernel, ieee80211_tx_prepare_skb() (mac80211) had an error path that did not free the skb, causing a memory leak. Added missing kfree_skb() and removed redundant frees in callers (ath9k, mt76, mac80211_hwsim).

A race condition was found in the MLX5 driver in the Linux kernel during ESN (Extended Sequence Number) update in IPSec full offload mode. The driver acknowledged the ESN wrap event too late, which could lead to reprocessing the same event and incorrect increment of ESN high-order bits.

In the Linux kernel net: shaper, late read accesses to the hierarchy after converting a reference to a locked net_device did not check if the device was unregistered. This can lead to use-after-free.

In the Linux kernel, the MTD NAND driver lacked serialization of lock/unlock operations against other NAND operations. nand_lock() and nand_unlock() called controller operations without holding the device lock, potentially racing with concurrent UBI/UBIFS erase/write operations.

In the Linux kernel's mshv driver, a use-after-free vulnerability exists in the error path of mshv_map_user_memory(). Calling vfree() directly leaves the MMU notifier registered, which accesses freed memory after userspace unmaps it.

In the Linux kernel IOMMU SVA subsystem, a bug in iommu_sva_unbind_device() caused a use-after-free. After iommu_domain_free() freed the mm structure, accessing domain->mm->iommu_mm resulted in a crash.

An issue was discovered in Biztalk360 before 11.5. Due to mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.