CVE Vulnerability Catalog

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.

A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further information is available.

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

The Infineon Airoc Wi-Fi driver has a buffer leak vulnerability in the airoc_mgmt_send() function. On every failed packet transmission, a buffer from the small fixed pool is not released, leading to pool exhaustion. Once the pool is exhausted, both transmit and receive paths fail, causing permanent loss of Wi-Fi connectivity until the device is rebooted.

In the Linux kernel, in the gpio: pca953x driver, the function pca953x_irq_bus_sync_unlock did not hold the i2c_lock during regmap calls, which could lead to incorrect register read/write under concurrent access. A previous patch only protected the write to the interrupt mask register, not the read from the direction register.

In the Linux kernel, in the DRM/AMD Display subsystem, the function dce110_set_avmute called is_tg_enabled without checking if it is implemented in the ops table for older DCE timing generators. This caused a NULL pointer dereference on Southern Islands GPUs when turning the display off over HDMI.

In the Linux kernel, in sched_ext, when a sub-scheduler enable fails before scx_link_sched(), the cleanup still runs the full scx_sub_disable(), which can race with root disable and lead to use-after-free. The fix skips the cgroup ownership reset and task walk if the scheduler was never linked.

In the Linux kernel, in NFS, the FREE_STATEID operation could be delayed, leading to a use-after-free of the 'struct nfs_server' object. The fix bumps the refcount of this object for the duration of the FREE_STATEID call to prevent cleanup while operations are in flight.

In the Linux kernel, in the soc: aspeed: lpc-snoop driver, the snoop_file_read function can cause a usercopy overflow due to lack of synchronization between the producer (IRQ) and consumer (file). The fix adds a per-channel spinlock to serialize kfifo access.

In the Linux kernel, in XFS, the function xfs_buf_free calls folio_put on a NULL pointer when backing memory allocation fails, leading to a kernel crash. The fix skips folio_put when bp->b_addr is NULL.

A race condition in the Linux kernel's ovpn subsystem between peer deletion and rehashing operations can resurrect already-removed peers in hash tables, leading to a use-after-free (UAF) vulnerability.

In the Linux kernel bonding driver (ALB mode), bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing promiscuity on the active slave. In that window the active slave can change, leading to a null-pointer dereference (kernel panic) or an underflow of the promiscuity counter, leaving the interface in IFF_PROMISC.

In the Linux kernel, in the enic driver, enic_remove does not cancel the tx_hang_reset work, which can lead to use-after-free after free_netdev(). The fix uses disable_work_sync() instead of cancel_work_sync() to block re-scheduling of the work.

In the Linux kernel, in IPVS, the function ip_vs_nat_icmp can write out of bounds because the ihl field in the IPv4 header is read multiple times, and a local attacker can modify the packet during processing. The fix reads ihl only once and uses ciph->len as the offset to the transport header.

A vulnerability in the Linux kernel's btrfs filesystem was found in LZO decompression for inline extents. A crafted btrfs image can trigger an out-of-bounds read (KASAN: slab-out-of-bounds) when reading a file, leading to a system crash or potential security compromise.

A memory leak was found in the Linux kernel's btrfs filesystem in the btrfs_do_encoded_write() function. During encoded write operations (ioctl), allocated extent_changeset structures are not freed before returning from the function, leading to memory leaks. The issue was discovered during local fuzzing on version 6.12.94.

In the Linux kernel, the amdxdna_insert_pages() function in the accel/amxdna driver has two error paths that incorrectly call vma->vm_ops->close(vma) before returning an error code. This causes premature resource release, and later unmapping by the process leads to a double close and reference count underflow.

In the Linux kernel BPF subsystem, when handling scalar += pointer in adjust_ptr_min_max_vals(), copying only selected fields of pointer state is fragile because pointer provenance is tracked by several bpf_reg_state fields. The fix uses the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state.

In the Linux kernel net/smc module, the smc_llc_event_handler() function lacks a check for an already pending qentry before storing a new one for CONFIRM_LINK and ADD_LINK_CONT. A malicious or buggy peer can send a second request, causing the pointer to be overwritten without freeing the previous allocation, leading to a memory leak (kmalloc-96).