CVE Vulnerability Catalog

In the Linux kernel, iommufd_take_all_iova_rwsem() takes an object reference and write lock before storing the IOAS in the xarray; if xa_store() fails, the current IOAS is not released, causing a leak. The fix releases the current IOAS before unwinding previously stored entries.

In the Linux kernel, the IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, so a concurrent iommu_report_device_fault() can dereference a freed handle, causing a UAF. The fix adds an iopf_rwsem in mock_dev for synchronization.

In the Linux kernel, set_attribute() in dell-wmi-sysman populates the BIOS attribute request buffer with the admin password and then dumps the whole buffer via print_hex_dump_bytes(), exposing the password in the kernel log. The fix removes this dump.

In the Linux kernel, isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] without validation, allowing out-of-bounds reads. The fix adds bounds checks and rejects disabled SST-PP levels.

In the Linux kernel, isst_if_clos_assoc() validates socket_id with '>' instead of '>=', allowing indexing past the sst_inst[] array; additionally, a missing NULL check for unbound packages leads to a NULL dereference. The fix rejects socket_id >= topology_max_packages() and NULL sst_inst.

In the Linux kernel, the mmc via-sdmmc driver does not cancel carddet_work on device removal; already queued work can run after the host is freed, causing a use-after-free. The fix cancels carddet_work after freeing the IRQ and before cancelling finish_bh_work.

In the Linux kernel, the mmc via-sdmmc driver registers and enables the card-detect interrupt before mmc_add_host(); if mmc_add_host() fails, the interrupt stays registered and runs against the freed host, causing a use-after-free. The fix adds a probe-error path that disables and frees the interrupt and cancels carddet_work.

In the Linux kernel, ISST lacked a NULL check for isst_common.sst_inst[] on failed socket loading, potentially leading to a NULL dereference. The fix adds a NULL check for consistency with other places.

In the Linux kernel, the platform/x86 ISST driver lacked validation of the logical CPU ID and CLOS ID used by the core power feature. Values exceeding the supported maximum were not rejected even though they are used to calculate the MMIO offset.

In the Linux kernel, the platform/x86 int1092 driver did not free the memory allocated for device_mode_info in parse_package() on some error paths in sar_probe(). This caused a memory leak.

In the Linux kernel, the panasonic-laptop driver has an out-of-bounds write past the pcc->sinf[] array. The function acpi_pcc_retrieve_biosdata() writes a sentinel value at index equal to the SINF package count, which when num_sifr equals that count results in a one-element overflow (a silent 4-byte heap overflow). This occurs on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements.

The Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 allows inclusion of functionality from an untrusted control sphere. Crafted repository content can modify the workspace settings file, redirecting the Kiro Powers registry request to an attacker-controlled endpoint and sending workspace data when the Powers panel is opened.

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. A user permitted to add entries to one Express object could create entries in a different Express object outside their authorization scope.

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type is updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), allowing a signed-in dashboard user to modify Page Types outside their assigned authorization boundary.

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a link on the site's own domain that sends a user to an arbitrary external site after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow.

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Relocating a group under a new parent causes its members to inherit the parent's permissions.

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request only against the target board instance and then persists the client-supplied selectedTemplateOption[collection] verbatim, allowing a user with permission to edit board contents to store a forged summary object with a JavaScript-bearing HTML payload in the description field. The default summary template renders the description field without output encoding.

In the Linux kernel, the platform/x86 think-lmi driver's multi-certificate support allows the system authentication object to store ->signature and ->save_signature, which leak when the driver is removed. This causes a memory leak.

In the Linux kernel, the platform/chrome sensorhub driver did not validate the EC-reported sensor number (in->sensor_num) in cros_ec_sensorhub_ring_handler(). A value equal to or greater than sensor_num caused an out-of-bounds read and write of the batch_state[] array.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_stb_s2d_init() discarded the return values of several S2D SMU commands and the S2D_PHYS_ADDR_LOW/HIGH values. On failure the physical address was left uninitialized and passed to devm_ioremap(), potentially mapping physical address 0.