CVE Vulnerability Catalog

In Fullstep V5, inadequate access control in the registration process could allow unauthenticated users to obtain a valid JWT token to interact with authenticated API resources.

PackageKit versions 1.0.2 through 1.3.4 contain a TOCTOU race condition on transaction flags, allowing unprivileged users to install packages as root. The vulnerability stems from three code issues: unconditional flag overwrite, silent state-transition rejection, and late flag reading at execution time.

Atakujący może wysłać żądanie powiadomienia, które powoduje dodanie nowej domeny podrzędnej do backendu BIND, ale jednocześnie aktualizuje konfigurację backendu do nieprawidłowej, co uniemożliwia jego uruchomienie po następnym restarcie.

Klient może wywołać błąd dzielenia przez zero, co prowadzi do awarii, wysyłając odpowiednio skonstruowane zapytanie DNSCrypt.

A use-after-free vulnerability exists in the Linux kernel's cxl_detach_ep() due to missing lifetime guarantee for the parent_port. During CXL device removal, the parent port may be freed before operations on it complete, leading to memory corruption or lock debugging warnings.

In the Linux kernel, the perf subsystem incorrectly uses event->pmu instead of pmu_ctx->pmu when inheriting group events. This causes the wrong PMU's transaction handlers to be used when the group leader is a software event, potentially leading to an out-of-bounds memory access in x86_pmu_del() during group rollback.

W jądrze Linuxa zidentyfikowano podatność związaną z infrastrukturą driver_override w rdzeniu sterowników. Podczas próby podłączenia sterownika przez __driver_attach() wywoływana jest funkcja match() bez trzymania blokady urządzenia, co może prowadzić do sytuacji użycia po zwolnieniu (UAF).

In the Linux kernel BPF interpreter, undefined behavior occurs in signed 32-bit division and modulo handlers for S32_MIN. Using the abs() macro on S32_MIN returns the same value, causing do_div() to compute wrong results and creating a verifier/interpreter mismatch that can be exploited for out-of-bounds map value access.

A race condition exists in the Linux kernel xfrm subsystem. An XFRM_MSG_NEWSPDINFO request can queue the policy_hthresh.work item, which is not synchronized during network namespace teardown, potentially leading to a use-after-free.

In the Linux kernel, l2cap_ecred_conn_req() (Bluetooth L2CAP) contains a stack-out-of-bounds read. When an attacker sends an Enhanced Credit Based Connection Request with more than 5 SCIDs, rsp_len retains an oversized value and l2cap_send_cmd() reads past the 18-byte pdu buffer, triggering a KASAN panic.

In the Linux kernel Bluetooth MGMT subsystem, a dangling pointer bug exists in mgmt_add_adv_patterns_monitor_complete. An incorrect condition check causes mgmt_pending_free(cmd) to kfree(cmd) without unlinking it from the list first, leaving a dangling pointer and leading to use-after-free on subsequent list traversal.

In the Linux kernel's openvswitch module, a vulnerability allows releasing a network device before its unregistration completes. The issue occurs when ovs_netdev_detach_dev() clears the IFF_OVS_DATAPATH flag and gets preempted (e.g., on PREEMPT_RT kernels), enabling netdev_destroy() to finish and free the device prematurely.

In the Linux kernel's SMC (Shared Memory Communications) module, a double-free vulnerability was found in smc_spd_priv structure when duplicating a pipe buffer via tee(). The .get callback for pipe buffers did not handle the smc_spd_priv pointer, causing both original and cloned buffers to share the same object. When both pipes were released, kfree() was called twice on the same object, leading to use-after-free (UAF) and kernel panic.

The Linux kernel's iavf driver (Intel Ethernet Adaptive Virtual Function) incorrectly uses real_num_tx_queues and num_active_queues in ethtool functions. When changing channels (ethtool -L) and reading statistics (ethtool -S) simultaneously, an out-of-bounds write can occur. The fix uses the immutable num_tx_queues value in all related functions.

A vulnerability was found in the Linux kernel's fanout mechanism for packet sockets. The `packet_release()` function does not zero `po->num` within the `bind_lock` section, allowing a concurrent `NETDEV_UP` event to re-register the closing socket into the fanout group's `arr[]` array. This leaves a dangling pointer in the array, leading to a Use-After-Free condition.

In the Linux kernel, a type confusion vulnerability in team_setup_by_port() for non-Ethernet ports. Copying header_ops pointers from a lower port can lead to incorrect interpretation of the net_device private structure, causing a crash.

W jądrze systemu Linux zidentyfikowano podatność związana z obsługą błędów w module Bluetooth btintel. Funkcja btintel_hw_error() wykonuje dwa wywołania __hci_cmd_sync() bez odpowiedniego zablokowania, co prowadzi do wyścigu z inną funkcją, co może skutkować błędem użycia po zwolnieniu pamięci.

In the Linux kernel's macb network driver, a vulnerability was found causing an out-of-bounds (OOB) write when retrieving statistics via ethtool. The issue arises from a mismatch between the number of active queues and the maximum number of queues used when copying statistics data.

In the Linux kernel, the RDMA/efa driver was fixed for use of completion context after free; admin queue completion handling printed data from an already freed context.

W jądrze Linuxa naprawiono podatność związaną z użyciem po zwolnieniu pamięci (use-after-free) w funkcji migracji. Problem występował, gdy wskaźnik danych nie był ustawiony na NULL po wystąpieniu błędu, co mogło prowadzić do błędów w kolejnych wywołaniach .write().