CVE Vulnerability Catalog

An unsafe deserialization vulnerability exists in MixPHP Framework versions 2.x through 2.2.17. The sync-invoke TCP server receives data from a TCP socket and passes it directly to Opis\Closure\unserialize(), then executes the result via call_user_func(). No authentication or signature verification is performed on the TCP connection, allowing an attacker with access to the localhost TCP port (server binds 127.0.0.1) to send a crafted serialized PHP closure to achieve arbitrary code execution.

Oprogramowanie uruchamiane jako użytkownik bez uprawnień może wykonywać nieprawidłowe wywołania systemowe GPU, zmuszając GPU do zapisu w dowolnych stronach pamięci fizycznej. W określonych okolicznościach, ten exploit może prowadzić do uszkodzenia stron danych, które nie są przydzielone przez sterownik GPU.

Strona internetowa zawierająca nietypową zawartość WebGPU ładowaną do procesu renderowania GPU GLES może wywołać awarię związaną z użyciem po zwolnieniu (UAF) w bibliotece współdzielonej użytkownika GPU GLES. Na niektórych platformach, gdy proces wykonujący obciążenie graficzne ma uprawnienia systemowe, może to umożliwić dalsze wykorzystanie podatności w systemie.

Strona internetowa zawierająca nietypową zawartość WebGPU ładowaną do procesu renderowania GPU GLES może wywołać awarię związaną z używaniem po zwolnieniu pamięci (UAF) w bibliotece współdzielonej użytkownika GPU GLES. Na niektórych platformach, gdy proces wykonujący obciążenie graficzne ma uprawnienia systemowe, może to umożliwić dalsze exploity na urządzeniu.

A vulnerability in the Linux kernel's GSO fallback for tunneled traffic with IPV6_CSUM flag was found. Incorrect network header length checking caused tunneled packets with IPv6 extension headers to not fall back to software checksumming, potentially leading to processing errors.

In the Linux kernel mana network driver, a use-after-free occurs in the add_adev() error path. If auxiliary_device_add() fails, auxiliary_device_uninit(adev) frees the containing mana_adev struct, and subsequent access to adev->id results in use-after-free.

A vulnerability has been identified in the Linux kernel related to improper initialization of the aio_cmd->iocb structure in target_core_file. This issue may lead to incorrect write failure statuses during write command execution.

A vulnerability has been identified in the Linux kernel's wifi (mac80211) module that allows improper operations on non-TDLS stations. The issue arises from the lack of verification whether a station is actually a TDLS station before executing the ENABLE_LINK operation.

The wacom_intuos_bt_irq() function in the Linux kernel processes Bluetooth HID reports without sufficient bounds checking, allowing an out-of-bounds read when a short crafted report is received. Report 0x03 requires at least 22 bytes, while report 0x04 (which falls through to 0x03) requires 32 bytes.

A use-after-free vulnerability exists in the Linux kernel's ATM LEC module within sock_def_readable(). A race condition between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send() causes the socket to be freed via RCU while another thread is still using it. The fix converts priv->lecd to an RCU-protected pointer.

In the Linux kernel, the HID logitech-hidpp driver was fixed to prevent a use-after-free on force feedback initialization failure. When force feedback init failed for the Logitech G920 Driving Force Racing Wheel, the error was returned before sysfs and /dev/input infrastructure was torn down, leading to UAF if userspace kept using those references.

In the Linux kernel HID subsystem, hid_report_raw_event() called memset() to zero the area from the end of incoming data to the assumed end of the buffer, which could cause out-of-bounds reads and writes. The fix removes this memset() and returns early if the event buffer is too small.

In the Linux kernel HID multitouch driver, the report ID in a device response was not verified against the requested one. A malicious or clumsy device can respond with a different report ID, causing out-of-bounds writes in the HID core.

In the Linux kernel MPLS subsystem, RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels versus platform_label during a concurrent resize (resize_platform_label_table under platform_mutex). This can lead to out-of-bounds accesses.

In the Linux kernel, when processing user options in IPv6 Router Advertisement (RA) messages, the nduseroptmsg structure sent in RTM_NEWNDUSEROPT netlink message does not zero its padding fields, potentially leaking kernel memory. The fix initializes these padding fields to zero.

In the Linux kernel, the crypto authencesn module has a vulnerability where high-order sequence bits (hiseq) are unnecessarily placed at the end of the destination buffer during out-of-place decryption (src != dst), causing incorrect hashing data arrangement.

A vulnerability has been identified in the Linux kernel regarding incorrect length accounting for TX packets that span multiple buffer descriptors. This issue leads to the loss of earlier bytes, potentially stalling the TX queue.

In the Linux kernel, a vulnerability was found in the regsafe() function related to pointers to packets. The bug may cause a state with a valid packet range not to be explored, leading to potential security issues.

In the Linux kernel, the netfilter x_tables module lacks validation that names are nul-terminated. This flaw can cause invalid data to be passed to functions expecting C strings, potentially leading to errors or security breaches.

In the Linux kernel netfilter subsystem, a use-after-free vulnerability was found in nf_conntrack_helper_unregister(). When destroying expectations for a helper being unregistered, a NULL pointer was passed instead of the helper pointer, so expectations were not removed and the freed helper structure was still referenced.