CVE Vulnerability Catalog

In the lan743x network driver for PCI1xxxx devices, EEPROM and OTP sizes have been fixed. Maximum OTP size is 8 Kb and EEPROM 64 Kb. Size definitions and returned EEPROM length are adjusted per device, preventing out-of-bounds read/write.

In the amd-pmf driver (platform/x86/amd), memory allocations have been changed to device-managed to prevent a double free when smart PC setup fails. Previously, dev->buf was freed but not set to NULL, leading to a second free in amd_pmf_remove().

A vulnerability in ETSI Open-Source MANO (OSM) versions before 14.0.3, 15.0.2, and in 16.0.0 and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users component.

In the NFC NCI UART driver in the Linux kernel, there is a vulnerability where tty->disc_data is set before successful NCI device opening. This can lead to use of an invalid pointer if the device starts sending data before initialization completes.

A vulnerability has been identified in the Squashfs filesystem in the Linux kernel that may lead to a 'shift-out-of-bounds' error. The issue occurs when two processes attempt to mount the Squashfs filesystem on the same device simultaneously, resulting in incorrect block size settings.

In the virtio-net driver in the Linux kernel, a bug was found in the frame length check within the buf_to_xdp function for XSK (XDP Socket). For the first buffer, the frame length was incorrectly compared with a value including vi->hdr_len, potentially exceeding the allocated chunk size.

W jądrze Linuxa naprawiono podatność związaną z pobieraniem bloków danych WMI w wywołaniach sysfs. Wprowadzono sprawdzenie poprawności tych bloków przed dereferencją ich zawartości.

In genirq/irq_sim (interrupt simulation), work context pointers initialization has been fixed. Using kmalloc() instead of kzalloc() caused pointers to contain random data, leading to invalid dereferencing.

In nvmet (NVMe over Fabrics target), a memory leak related to bio integrity (bi_integrity) has been fixed. Since a kernel version requiring bio_uninit after bio_init, nvmet did not call bio_uninit for inline bios, causing continuous memory leak (kmalloc-128 slab).

In the mtk-sd driver, a failed DMA mapping does not stop the operation, leading to use of previous DMA settings and potential memory corruption. The fix stops the request after msdc_prepare_data() fails.

In the SCSI target subsystem (Linux kernel), a NULL pointer dereference bug in core_scsi3_decode_spec_i_port() has been fixed. In the error path, when dest_se_deve is not set, core_scsi3_lunacl_undepend_item() is called with NULL, leading to kernel panic.

In the Linux kernel, the spi-qpic-snand driver has a vulnerability due to out-of-bounds memory access. The issue arises from allocating BAM transaction structures before knowing the actual number of codewords for the NAND chip, causing memory corruption, swiotlb mapping failures, and system panics.

In the Linux kernel, the anon_inode_make_secure_inode() function was exported and a secretmem LSM bypass was fixed. The patch ensures proper security context for anonymous inodes used by KVM guest_memfd and removes the S_PRIVATE flag that bypassed LSM/SELinux checks in secretmem.

In the GPIO regulator in the Linux kernel, an out-of-bounds access to the drvdata::gpiods array was found. Memory was allocated for only one pointer, while config::ngpios can be greater than 1. The fix allocates sufficient memory.

A race condition in the Linux NFSv4/pNFS driver affects the NFS_LAYOUT_DRAIN bit. Tasks waiting on this bit in pnfs_update_layout() may never wake up even though plh_outstanding is zero, causing system hangs.

In ACPICA, calling a method with fewer arguments than expected leads to use-after-free. The fix makes ACPICA refuse to evaluate the method if arguments are missing.

In the Btrfs filesystem, during log replay, an iteration bug in extrefs processing causes an uninitialized victim_name.len field, leading to invalid memory access and potential security issues.

In the Linux kernel, a bug in the CIFS/SMB module causes a warning during channel reconnection. The smb2_reconnect_server() function passed an uninitialized dummy tcon to smb2_reconnect(), leading to an attempt to queue delayed work on an invalid object.

In the Linux kernel's ROSE protocol, two bugs in rose_rt_device_down() cause use-after-free due to incorrect iteration of the neighbour array, leaving dangling pointers.

In the virtio-net driver, the xdp_linearize_page function did not check if the received length exceeds the allocated size, leading to out-of-bound read. The fix adds the missing check.