CVE Vulnerability Catalog

The Xen privcmd driver allows user-space processes to issue arbitrary hypercalls, which under secure boot lets a root process modify kernel memory and breaks the secure boot feature. The fix restricts privcmd usage in an unprivileged domU to the target domain obtained from Xenstore.

In the Linux kernel, the Bluetooth L2CAP stack accepts multiple L2CAP_ECRED_CONN_REQ requests without checking the command identifier. This can mark multiple requests as pending (FLAG_DEFER_SETUP) and allocate more than L2CAP_ECRED_MAX_CID (5) channels in l2cap_ecred_rsp_defer, causing an overflow.

In the Linux kernel bridge/cfm subsystem, a race condition during peer MEP deletion was fixed. br_cfm_frame_rx() running in softirq context could re-schedule ccm_rx_dwork after cancel_delayed_work_sync() returned, leading to a use-after-free. cancel_delayed_work_sync() was replaced with disable_delayed_work_sync() in both peer MEP deletion paths.

In the Linux kernel netfilter/nf_tables subsystem, a use-after-free vulnerability was found in the error path during flowtable registration. After hook registration fails, the flowtable is freed without RCU grace period synchronization, potentially allowing access to freed memory via packet path or nfnetlink_hook control plane.

A vulnerability was found in the Linux kernel's netfilter xt_CT module, where templates can be removed while packets are still pending in the nfqueue. This can cause issues on helper module removal or timeout policy deletion. The patch flushes these enqueued packets when the template rule is removed.

In the Linux kernel, the dma_map_sg tracepoint could trigger a perf buffer overflow when tracing large scatter-gather lists because array sizes exceeded PERF_MAX_TRACE_SIZE. The fix caps dynamic arrays at 128 entries and adds a truncation flag.

In the Linux kernel, the Squashfs filesystem function squashfs_read_metadata does not validate that the metadata block offset is within range. A corrupted index table can produce a negative offset, leading to an out-of-bounds access in squashfs_copy_data.

In the Linux kernel, the pinctrl cirrus cs42l43 driver's cs42l43_pin_probe() function contains a double-put because devm_add_action_or_reset() already invokes the action on failure, and the explicit put causes a double-put. This can lead to memory corruption.

In the Linux kernel BPF JIT compiler for arm64, the JIT buffer was only 4-byte aligned, so the u64 target field in struct bpf_plt could be misaligned. This caused UBSAN misaligned-access warnings and risked a torn read during concurrent update via WRITE_ONCE(), potentially making the JIT jump to a corrupted address.

In the Linux kernel, the net/sched/act_ife module has a vulnerability where replacing the metalist appends new metadata instead of replacing old data. This unbounded growth can cause a slab-out-of-bounds error during the encode operation, as shown by a KASAN report.

In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown. In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references.

A vulnerability related to MAC comparison was identified in the Linux kernel, which could lead to timing attacks. It has been resolved by replacing the memcmp() function with the appropriate crypto_memneq() function.

In the Linux kernel's mt76 wifi driver (mt7925), the mt7925_mac_write_txwi_80211() function lacks a frame length check before accessing management fields. This can lead to an out-of-bounds access.

In the Linux kernel PCI dwc ep driver, a race exists between the MSI-X write (writel) and unmapping of the ATU entry. Since PCI posted writes have no completion, the write may not reach the destination before the unmap, potentially corrupting host memory or causing IOMMU errors. The fix performs a readl of the same address to flush the write before unmapping the ATU entry.

In the Linux kernel, a stack-out-of-bounds write vulnerability was found in the get_upper_ifindexes() function in devmap. The function iterates over all upper network devices and writes their indices into an array without bounds checking, potentially causing a stack buffer overflow.

W jądrze Linuxa rozwiązano podatność związaną z niewłaściwym użyciem funkcji array_index_nospec() w kontekście spekulacyjnego bezpieczeństwa. Problem dotyczy sytuacji, w której wartość uznawana za bezpieczną może być narażona na przewidywania pamięci, co prowadzi do potencjalnych luk w zabezpieczeniach.

A Use-After-Free vulnerability was found in the Linux kernel's netfilter pipapo set type. The issue arises from prolonged garbage collection (GC) in a non-preemptible context under a large number of expired elements, causing soft lockups and RCU stalls. The fix splits GC into unlink and reclaim phases to prevent access to freed memory.

W jądrze systemu Linux rozwiązano podatność związaną z inicjalizacją kolejki w module drm/xe. Brak odpowiedniego wywołania funkcji fini po nieudanej inicjalizacji kolejki może prowadzić do usunięcia kolejki z listy GuC, co skutkuje uszkodzeniem i odniesieniem do nieprawidłowej pamięci.

In the Linux kernel, the crypto: ccp driver contains a use-after-free on the error path of sev_tsm_init_locked(). The code calls pr_err() accessing fields of structure 't' after it has been freed by kfree().

A vulnerability in the Linux kernel's XDP subsystem causes incorrect calculation of tailroom due to mismatched frag_size in network drivers (e.g., ixgbevf). Negative tailroom is stored as unsigned, leading to uncontrolled tail growth and memory corruption, resulting in segfaults and general protection faults.