CVE Vulnerability Catalog

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.

Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.

In the Linux kernel, the RDMA/rxe subsystem has a use-after-free vulnerability when modifying the IB_QP_MAX_DEST_RD_ATOMIC attribute. A local unprivileged user can race the free/realloc to cause a use-after-free in rxe_receiver(), leading to a local denial of service.

In the Linux kernel, in the RDMA/rxe subsystem, a vulnerability was found involving an out-of-bounds read/write in the free_rd_atomic_resources() function. The issue arises from updating the max_dest_rd_atomic attribute before freeing the old array, causing the freeing loop to walk past the allocated area, which can lead to memory corruption (detected by KASAN).

In the Linux kernel, the nvme-tcp driver has an issue with incorrect usage of page_frag_cache in a multi-threaded environment, leading to incorrect refcounting and premature free of pages. This can cause network warnings and random system panics.

In the Linux kernel, a vulnerability exists in the USB xHCI driver where xhci_gen_setup() reads the controller's capability register even when the controller is inaccessible (e.g., after power failure or bus removal). The read returns 0xFFFFFFFF, leading to an incorrect calculation of operational register addresses and causing an alignment fault on ARM64, resulting in a kernel oops. This affects controllers like Renesas uPD720201 that fail to resume from D3cold.

In the Linux kernel, the FUSE filesystem has a race between interrupt and resend that can trigger WARN_ON and potentially cause issues.

In the Linux kernel, the FUSE filesystem lacks a memory barrier when checking io-uring readiness, which can lead to a lock-order inversion deadlock.

In the Linux kernel, the FUSE filesystem publishes io-uring queues without release semantics, which can lead to data visibility inconsistencies for readers.

In the Linux kernel, the FUSE filesystem's abort_on_kill path does not wait for FR_FINISHED, which can lead to use-after-free during concurrent request processing.

In the Linux kernel, the FUSE filesystem has an invalidate lock leak on writeback failure in fuse_do_setattr(), which can block subsequent file operations.

In the Linux kernel, the FUSE filesystem leaks a write lock (rwsem) during an open with O_TRUNC for DAX files when fuse_dax_break_layouts() fails (e.g., -ERESTARTSYS). This causes later operations on the file to stall due to the unreleased lock.

In the Linux kernel, the USB gadget f_tcm driver has an issue where the port count (tpg_port_count) is decremented before LUN teardown completes, potentially leading to a race and use-after-free during session removal. An optional fabric_post_unlink() callback is added to keep the port count until core_dev_del_lun() finishes.

In the Linux kernel KVM subsystem for AMD SEV/SEV-ES on SNP-enabled hosts, the temporary buffer used for memory encryption/decryption operations was not allocated as a full 4KiB page. On SNP platforms, the page containing the buffer must be temporarily assigned to firmware, causing access by other kernel parts to trigger an RMP #PF fault, leading to a kernel panic.

A vulnerability in the Linux kernel's TLS device offload (tls_device.c) causes an out-of-bounds write in tls_append_frag(). When a TLS record remains open with a full fragment count and subsequent splice() calls with SPLICE_F_MORE add non-coalescing pages, the frags array is overrun, corrupting memory including a function pointer in destruct_work, which can lead to arbitrary code execution.

In the Linux kernel, the GTP module lacks serialization of PDP context updates, which can lead to double deletion of the same PDP context when GTP_CMD_DELPDP and RTM_DELLINK operations run concurrently. This results in a general protection fault and potential use-after-free.

A use-after-free vulnerability was found in the Linux kernel's tcp_ao_connect_init() function related to TCP-AO. A race between key validation and VRF membership change can lead to removal of the only key and subsequent direct freeing of tp->ao_info, while the receive path may still use the pointer. The issue was found during a static audit and confirmed by a reproducer triggering a KASAN report.

A use-after-free vulnerability was found in the Linux kernel's TCP-AO (TCP Authentication Option) module. The issue occurs during reconnection to another peer, where the current_key pointer may reference freed memory after call_rcu().

In the Linux kernel, the xfrm (ESP-in-TCP) module has a use-after-free (UAF) bug during close of espintcp sockets. espintcp_close() frees the skb without holding any socket lock, while the xfrm_trans_reinject work queue may still use the same skb. The fix adds synchronize_rcu() after resetting sk_prot.

In the Linux kernel, the TCP stack has an issue where route-derived advmss values can be smaller than 1, leading to a divide-by-zero in tcp_select_initial_window(). The fix introduces a tcp_dst_advmss() helper that clamps advmss to TCP_MIN_MSS.