CVE Vulnerability Catalog

A flaw was found in the Linux kernel's ext4_search_dir() function where the directory entry bounds check does not account for the 8-byte hash trailer (EXT4_DIRENT_HASHES) used in casefolded encrypted directories. A crafted directory entry whose name ends exactly at the block boundary passes the check, causing ext4_match() to read out of bounds, reported as a use-after-free.

In the Linux kernel, ext4_read_inline_dir() has an out-of-bounds read. Directory iteration uses a larger extra_size than the actual inline_size buffer, allowing a dirent header to be read past the end of the buffer, potentially leading to information disclosure or crash.

In the Linux kernel NTFS3 filesystem, ntfs_reparse_init() and ntfs_objid_init() read type and rule fields from the INDEX_ROOT attribute without checking if the resident attribute is large enough. This can lead to an out-of-bounds read when mounting a crafted image.

In the Linux kernel, rpcb_register_inet4() and rpcb_register_inet6() in SUNRPC store the result of rpc_sockaddr2uaddr() into map->r_addr without checking for NULL. When the underlying kstrdup allocation fails, the unchecked NULL is passed into the RPCBPROC_SET encode path, where strlen() dereferences NULL and crashes the kernel (oops).

In the Linux kernel, xfrm6_input_addr() has an out-of-bounds write due to an off-by-one depth check. When sp->len reaches XFRM_MAX_DEPTH, writing to sp->xvec[sp->len++] goes past the array, potentially causing a system crash.

A vulnerability was found in the Linux kernel's fs/ntfs3 module due to missing validation of restart table growth during $LogFile replay. When mounting a crafted NTFS image, an entry count exceeding U16_MAX is truncated, causing allocation of a table smaller than required and an out-of-bounds access.

In the Linux kernel NTFS3 filesystem, read_log_rec_buf() reads out of bounds due to an invalid log->record_header_len value from disk. This can lead to reading memory beyond the buffer when mounting a crafted NTFS image.

In the Linux kernel, the Qualcomm RMNet driver has a vulnerability where skb->dev is not assigned to frames after deaggregation. This leads to netif_tx_lock() being called on a NULL pointer, causing a kernel panic that can be triggered by an unprivileged user.

In the Linux kernel, fs/ntfs3's ntfs_read_ea() does not verify that the EA record's ef->size is large enough to hold the record's name and value. A crafted NTFS image can set a small ef->size with a large elength, causing an out-of-bounds read past the allocated buffer and leaking kernel heap memory to userspace via getxattr().

A vulnerability in the Linux kernel's ISOFS filesystem related to zisofs compression has been found. The zisofs_uncompress_block() function returns an incorrect byte count for empty blocks, ignoring the poffset, leading to an out-of-bounds read of the page array when handling compressed files on ISO9660 images. A crafted Rock Ridge "ZF" record can trigger this bug during a normal file read.

In the Linux kernel's vfio/pci subsystem, vfio_msi_cap_len() freed vdev->msi_perm on an initialization failure but left the pointer dangling. This led to a use-after-free on the next device open and a double free on device close, potentially causing a kernel panic.

In the Linux kernel's vxlan vnifilter, the GROUP/GROUP6 attribute policy uses NLA_BINARY with only a maximum length, allowing payloads shorter than the address size. The consumer reads the attribute as an unconditional 4-byte load, over-reading up to 3 bytes of uninitialised slab data and disclosing kernel memory via RTM_GETTUNNEL.

In the Linux kernel's KVM for arm64, pgshift_level_to_ttl() does not handle negative levels (e.g. -127 indicating S1 MMU disabled), incorrectly computing the TLB invalidation size as 0. The fix handles negative levels and makes ttl_to_size() return SZ_1G when no valid TTL is present.

In the Linux kernel's Bluetooth SCO subsystem, sco_conn_ready() dereferences sk without holding conn->lock or a reference, leading to a use-after-free when the socket is closed concurrently. The fix holds an sk refcount and rechecks socket validity after lock_sock().

In ZenHive mpp before version 0.16.2, use of cache containing sensitive information allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential sets payment-receipt and cache-control: private, but a mounting application can override them, e.g., by setting cache-control: public, allowing a CDN or reverse proxy to store the paid response and serve it to unpaid clients. Additionally, non-2xx responses may still carry Payment-Receipt.

In ZenHive mpp before version 0.16.2, improper validation of unsafe equivalence in input allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot based on caller-supplied hex, not on a canonical form, allowing two different reserve keys for the same transaction (e.g., v=27 and v=0). As a result, both pass the reserve and reach the broadcast path, and a node may return a second valid Payment-Receipt for a single on-chain payment.

In the Apache Airflow Akeyless secrets backend, the team-scope guard can be bypassed with a user-controlled key. A Dag author scoped to one team can supply a Variable key containing a path separator, causing the backend to resolve a secret belonging to a different team.

In the Apache Airflow FAB provider, changing a user's password via the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker holding a copy of the victim's session cookie retains full access after the password change.

In Ash before version 3.33.4, field policies are documented to protect against filter-based information disclosure, but the nilling was applied only to attributes, not to calculations or aggregates. A user can reference a calculation or aggregate in a filter that they cannot see, and use the filter as an oracle to read the protected value (e.g., filter(secret_calc == "x")).

NLnet Labs Unbound up to and including 1.26.0 is vulnerable to algorithmic complexity attacks (known as 'ReTrap') that cause service degradation. Attacks include TagTrap (large number of mismatched DNSKEY, RRSIG, DS records), DelegationTrap (costly iterative validation for deeply nested domains), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (default validation of ADDITIONAL section).