CVE Vulnerability Catalog

In the Linux kernel, the ksmbd module has incorrect buffer length validation in smb2_set_ea(). It fails to check buffer length before accessing the next smb2_ea_info, potentially leading to out-of-bounds read.

In the Linux kernel, there is a vulnerability in ksmbd that involves missing validation of session ID and tree ID in compound requests. If the first operation in a compound request is SMB2 ECHO, validation is bypassed, which can lead to NULL pointer dereference and system crash.

In the Linux kernel, the ksmbd module has an out-of-bounds read vulnerability in the smb2_write function. The issue arises from lack of validation of the hdr->NextCommand field, which could allow oversized SMB2 write length and lead to out-of-bounds read.

Motyw Soledad dla WordPressa jest podatny na atak Local File Inclusion we wszystkich wersjach do 8.6.7 włącznie, poprzez parametr 'header_layout'. Umożliwia to uwierzytelnionym atakującym z dostępem na poziomie Contributor i wyżej do włączenia i wykonania dowolnych plików .php na serwerze.

Motyw Soledad dla WordPressa jest podatny na wykonanie dowolnego shortcode'a we wszystkich wersjach do 8.6.7 włącznie. Problem wynika z braku odpowiedniej walidacji wartości przed wykonaniem funkcji do_shortcode.

In the Linux kernel, there is a vulnerability in ipv6: mcast where a delayed put of pmc->idev in mld_del_delrec() could lead to a use-after-free. pmc->idev is still used in ip6_mc_clear_src(), so the reference should be put after ip6_mc_clear_src() returns.

The AXP717 ADC driver in the Linux kernel is missing a sentinel entry in its channel maps, triggering a KASAN warning.

In the am65-cpsw-nuss driver in the Linux kernel, memory for skb_shared_info was not allocated during the transition to build_skb(), causing incorrect skb size.

In the Linux kernel Appletalk protocol (net/appletalk), the atrtr_create() function did not release the old device reference before assigning a new one when updating an existing route entry, leading to a device refcount leak.

In the Linux kernel tracing subsystem, when adding trace events by a module, a write lock on the trace_event_sem semaphore was missing. When two modules are loaded simultaneously, this can corrupt the ftrace_events list and crash the kernel.

In the airoha driver in the Linux kernel, there is a potential use-after-free in airoha_npu_get() because np->name is used after calling of_node_put(np).

In the Linux kernel, a vulnerability in the libwx driver causes improper reset of Rx ring descriptors during device reset. Stale descriptor values can lead to malformed SKBs, resulting in a kernel BUG and system crash.

In the Linux kernel, the bprintf helpers (e.g., bpf_trace_printk) mishandled the "%p%" format sequence, causing a kernel warning at runtime because the second percent sign was skipped during %p processing.

In the Intel Ethernet driver (ice), the function ice_lag_is_switchdev_running() can be called outside LAG event handler code, causing lag->upper_netdev to be NULL. Missing NULL check before dereference leads to a NULL-pointer dereference.

In the Linux kernel, a vulnerability in the RxRPC subsystem causes a warning in local_bh_enable() when rxrpc_assess_MTU_size() is called with interrupts disabled. This occurs during incoming call acceptance, leading to potential system instability.

A race condition was found in the rxrpc module of the Linux kernel between two recvmsg threads for a completed call. One thread could terminate and release the call while the other was still processing it, leading to a BUG.

In the CIFS client (smbdirect) in the Linux kernel, there is a vulnerability due to the packet area in smbd_response allocation not being marked as allowed for usercopy. When CONFIG_HARDENED_USERCOPY=y, copying data from the packet to a folioq buffer causes a kernel BUG.

In the AF_RXRPC subsystem of the Linux kernel, when a service socket is opened and bound but no preallocation of calls has been done, the rxrpc_backlog struct is not allocated. Calling rxrpc_alloc_incoming_call() then causes an oops.

A vulnerability enabling A-MSDU attacks in mesh networks has been fixed in the Linux kernel. The flaw allowed spoofing A-MSDU frames, potentially leading to traffic interception or modification. The patch detects attack attempts by analyzing Mesh Control headers.

In the drm/xe/pf driver in the Linux kernel, LMEM buffer objects are not cleared on allocation, potentially leaving stale data in LMTT PTEs, allowing a malicious VF to access other VFs' or PF's memory.