CVE Vulnerability Catalog

In the Linux kernel, an out-of-bounds access was found in the dispmix_csr_clk_dev_data function of the i.MX clock driver. When num_parents is 4, __clk_register() reads beyond the parent_names array, triggering a KASAN error.

In the Linux kernel's mlx5e driver, a race condition exists between disabling DIM (Dynamic Interrupt Moderation) and calling net_dim(). If NAPI checks the DIM state bit and sees it as active, then DIM gets disabled, the pointer to the DIM context may already be NULL, leading to a NULL pointer dereference and kernel panic.

W jądrze Linuxa zidentyfikowano podatność, która została naprawiona. Dotyczy ona potencjalnego błędu use-after-free w mechanizmie potwierdzania przerwania oplock/lease, który może wystąpić w przypadku błędu zwracanego przez ksmbd_iov_pin_rsp.

W systemie zarządzania biblioteką Koha w wersji 24.05 występuje podatność typu Cross-Site Scripting (XSS) w funkcji wyszukiwania OPAC. Niesanitizowane dane wprowadzone w polu wyszukiwania są odzwierciedlane w interfejsie historii wyszukiwania, co prowadzi do wykonania dowolnego kodu JavaScript w kontekście przeglądarki.

In the Linux kernel for RISC-V with the xtheadvector extension, vector context save/restore is incorrect – only registers v0-v7 are handled properly, while v8-v31 are corrupted.

In the Linux kernel, a change setting TASK_SIZE_MAX to LONG_MAX to optimize access_ok() has been reverted. Addresses between TASK_SIZE and LONG_MAX, though not valid user addresses, were accepted by get_user_pages_fast(), causing issues (e.g., in futex). The fix restores the default TASK_SIZE, at the cost of performance.

W jądrze Linuxa rozwiązano podatność związaną z interfejsem i2c w kontekście odczytu blokowego SMBUS. Problem polegał na braku weryfikacji długości wiadomości, co mogło prowadzić do nieprawidłowego odczytu, gdy długość wiadomości wynosiła '0' lub była większa niż maksymalna dozwolona liczba bajtów.

In the Linux kernel, a bug in the order of stopping perf sampling during do_exit() caused crashes when accessing userspace after its teardown. The fix reorders operations to stop perf before mm destruction and hardens PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER.

In the lan743x network driver for PCI1xxxx devices, EEPROM and OTP sizes have been fixed. Maximum OTP size is 8 Kb and EEPROM 64 Kb. Size definitions and returned EEPROM length are adjusted per device, preventing out-of-bounds read/write.

In the amd-pmf driver (platform/x86/amd), memory allocations have been changed to device-managed to prevent a double free when smart PC setup fails. Previously, dev->buf was freed but not set to NULL, leading to a second free in amd_pmf_remove().

A vulnerability in ETSI Open-Source MANO (OSM) versions before 14.0.3, 15.0.2, and in 16.0.0 and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users component.

In the NFC NCI UART driver in the Linux kernel, there is a vulnerability where tty->disc_data is set before successful NCI device opening. This can lead to use of an invalid pointer if the device starts sending data before initialization completes.

A vulnerability has been identified in the Squashfs filesystem in the Linux kernel that may lead to a 'shift-out-of-bounds' error. The issue occurs when two processes attempt to mount the Squashfs filesystem on the same device simultaneously, resulting in incorrect block size settings.

In the virtio-net driver in the Linux kernel, a bug was found in the frame length check within the buf_to_xdp function for XSK (XDP Socket). For the first buffer, the frame length was incorrectly compared with a value including vi->hdr_len, potentially exceeding the allocated chunk size.

W jądrze Linuxa naprawiono podatność związaną z pobieraniem bloków danych WMI w wywołaniach sysfs. Wprowadzono sprawdzenie poprawności tych bloków przed dereferencją ich zawartości.

In genirq/irq_sim (interrupt simulation), work context pointers initialization has been fixed. Using kmalloc() instead of kzalloc() caused pointers to contain random data, leading to invalid dereferencing.

In nvmet (NVMe over Fabrics target), a memory leak related to bio integrity (bi_integrity) has been fixed. Since a kernel version requiring bio_uninit after bio_init, nvmet did not call bio_uninit for inline bios, causing continuous memory leak (kmalloc-128 slab).

In the mtk-sd driver, a failed DMA mapping does not stop the operation, leading to use of previous DMA settings and potential memory corruption. The fix stops the request after msdc_prepare_data() fails.

In the SCSI target subsystem (Linux kernel), a NULL pointer dereference bug in core_scsi3_decode_spec_i_port() has been fixed. In the error path, when dest_se_deve is not set, core_scsi3_lunacl_undepend_item() is called with NULL, leading to kernel panic.

In the Linux kernel, the spi-qpic-snand driver has a vulnerability due to out-of-bounds memory access. The issue arises from allocating BAM transaction structures before knowing the actual number of codewords for the NAND chip, causing memory corruption, swiotlb mapping failures, and system panics.