CVE Vulnerability Catalog

In the Linux kernel, the cdc-wdm USB class driver has a reordering issue in the read code path. Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before the memmove, so wdm_read() may see the new length and copy uninitialized memory to user space. The fix uses WRITE_ONCE and memory barriers.

In the Linux kernel, the Ceph module has a bug where ceph_path_info structures are not zero-initialized before calling ceph_mdsc_build_path(). On error, ceph_mdsc_free_path_info() may operate on uninitialized data, leading to random kernel crashes (oops, BUG) and potentially allowing privilege escalation.

In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negative values in ceph_monmap_decode(). This patch fixes unnecessary implicit conversions that change signedness of blob_len and num_mon in ceph_monmap_decode(). Currently blob_len and num_mon are (signed) int variables. They are used to hold values that are always non-negative and get assigned in ceph_decode_32_safe(), which is meant to assign u32 values. Both variables are subsequently used as unsigned values, and the value of num_mon is further assigned to monmap->num_mon, which is of type u32. Therefore, both variables should be of type u32. This is especially relevant for num_mon. If the value read from the incoming message is very large, it is interpreted as a negative value, and the check for num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to allocate a very large chunk of memory for monmap, which will most likely fail. In this case, an unnecessary attempt to allocate memory is performed, and -ENOMEM is returned instead of -EINVAL.

A vulnerability in the Linux kernel related to permission checks for namespace iteration ioctls has been resolved. Even privileged services should not necessarily be able to see other privileged service's namespaces to prevent information leakage between them.

A vulnerability in the Linux kernel related to handle opening in nsfs has been resolved, which involved overly permissive permission checks. Even privileged services should not have access to other privileged services' namespaces to prevent information leakage.

A vulnerability has been identified in the Linux kernel within the damos_walk() function, which does not clear the walk_control pointer in the case of an inactive context. This can lead to use-after-free situations and a permanent -EBUS error.

A vulnerability related to RCU task stalls during threaded busypoll has been identified and fixed in the Linux kernel. This issue caused bpftrace to hang during startup.

A vulnerability has been identified in the Linux kernel related to use-after-free in the remove_nh_grp_entry() function. The issue occurs when removing a nexthop from a group, potentially leading to dereferencing freed percpu memory stats.

In the Linux kernel, the drm/amdgpu driver has a race condition in VM acquire. The non-atomic vm->process_info assignment was replaced with cmpxchg() to prevent a race when parent/child processes sharing a drm_file both try to acquire the same VM after fork().

In the Linux kernel's drm/i915 component, an overflow occurs in the length field of a scatterlist when populating a scatterlist table for a GEM shmem object of 4 GB or larger. When the total byte length of pages allocated to a single scatterlist reaches or crosses the 4 GB limit, the unsigned int field overflows, causing users to hit an unexpected, premature end of the object's backing pages and triggering warnings in remap_sg.

In the Linux kernel io_uring/kbuf subsystem, there is a gap between grabbing a buffer and its potential recycling where the buffer list could have been upgraded to a ring type. Legacy recycling did not check whether the buffer list still exists and is of the correct type.

A vulnerability in the Linux kernel's XFS filesystem causes incorrect l_iclog_roundoff values (512 instead of expected 4096) when the superblock lacks a log stripe unit, leading to corrupted logs and unmountable filesystems. This occurs on disks with 4k physical sectors.

In the Linux kernel, the SMB client's SMB2_write() places write payload in iov[1..n], and smb3_init_transform_rq() pointer-shares rq_iov, so crypt_message() encrypts iov[1] in place. On retry after an error, the already-encrypted data is resent instead of the original, causing corruption.

In the Linux kernel, a race in the DMA ring dequeue path of the i3c mipi-i3c-hci driver was fixed. The hci_dma_dequeue_xfer() function may be invoked for multiple transfers timing out around the same time, and without serialization the parallel calls can interfere with each other, stopping or restarting the ring unexpectedly.

In the Linux kernel, the i3c mipi-i3c-hci driver's handling of RING_CTRL_ABORT in the DMA dequeue path was fixed. The previous logic unconditionally aborted the ring, never re-initialized the completion used to wait for abort completion, and unintentionally cleared RING_CTRL_ENABLE, resetting hardware ring pointers and disrupting controller state.

ZEBRA, a Zcash node written in Rust, had an issue with handling Orchard transactions that contained the rk field with an identity value. Versions prior to zebrad 4.3.1 and zebra-chain 6.0.2 would cause the node to crash when attempting to verify such transactions.

Brave CMS prior to commit 6c56603 had a publicly accessible contact form, allowing for the injection of unsafe HTML into email content. User-supplied message text was processed by the nl2br() function, which did not sanitize HTML, enabling attackers to create phishing interfaces in emails sent to the administrator.

PHPUnit in versions 12.5.21 and 13.1.5 forwards PHP INI settings to child processes as command-line arguments without neutralizing INI metacharacters. This allows an attacker to inject additional INI directives, potentially leading to remote code execution.

Brave CMS prior to commit 6c56603 stored page and article body content entered by editor-role users through CKEditor verbatim in the database. As a result, any JavaScript or HTML injected by them was permanently stored and executed in every visitor's browser upon page load.

Versions of fohrloop dash-uploader from 0.1.0 to 0.7.0a2 have multiple unauthenticated denial-of-service (DoS) issues. The chunked-upload handler does not validate attacker-controlled upload parameters, leading to various issues such as out-of-memory process crashes.