CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the mshv_vtl component occurs when registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, where the computed vmemmap_shift may exceed MAX_FOLIO_ORDER, leading to incorrect behavior.

A use-after-free vulnerability in SEV firmware allows a malicious hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than the migration agent, potentially leading to loss of integrity.

In the Linux kernel, a vulnerability was found in the F2FS filesystem involving uninitialized value access in the f2fs_sanity_check_node_footer function. The issue was reported by syzbot and may lead to unpredictable system behavior.

A vulnerability in SEV (Secure Encrypted Virtualization) firmware causes insufficient or incomplete data removal in a hardware component, resulting in incomplete IOMMU flushing. This can potentially lead to a loss of confidentiality and integrity in guest memory.

A vulnerability in CPython (from version 0 to 3.6.13, 3.7.0-3.7.10, 3.8.0-3.8.8, 3.9.0-3.9.2) allows Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs functions. An attacker can use a technique called 'parameter cloaking' to manipulate query parameters.

A vulnerability has been identified in the Linux kernel related to the failure to free memory in case of an error. Specifically, the screen buffer fbi->fb.screen_buffer is allocated using dma_alloc_coherent() but is not freed if an error occurs.

An improper access control vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware allows a malicious hypervisor to bypass RMP protections, potentially compromising SEV-SNP guest memory integrity.

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories.

A vulnerability in the tail utility of uutils coreutils allows exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting its contents.

The sort utility in uutils coreutils crashes (panics) when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and uses expect(), causing an immediate crash upon encountering valid but non-UTF-8 paths.

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original setuid/setgid bits.

An improper access control vulnerability in AMD SEV-SNP allows an admin privileged attacker to write to the RMP during SNP initialization, potentially leading to loss of SEV-SNP guest memory integrity.

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. It falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID instead of the source's metadata.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access can exploit this race condition.

The mongo-go-driver contains a heap out-of-bounds read vulnerability in the CGo implementation for GSSAPI (Kerberos) authentication on Linux and macOS. The issue arises from incorrect assumptions about string termination in the GSSAPI standard, potentially leading to data disclosure.

A TOCTOU vulnerability in the split utility of uutils coreutils allows an attacker to replace the output file between the check and use, potentially leading to data loss. The flaw occurs because the program checks file identity based on paths but later opens the file without re-verification.

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file before the permission change.

The 'id' utility in uutils coreutils incorrectly displays data in 'pretty print' mode when the real UID differs from the effective UID. The implementation mistakenly uses the effective GID instead of the effective UID when looking up the name of the effective user, leading to misleading output.

A TOCTOU vulnerability in the cp utility of uutils coreutils allows an attacker to bypass the intended no-dereference behavior. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644).