CVE Vulnerability Catalog

In the Linux kernel's ath12k Wi-Fi driver, a vulnerability was found due to missing packet length validation before processing in ath12k_dp_rx_h_undecap_nwifi. Hardware may deliver packets exceeding the maximum native Wi-Fi header length, leading to invalid data access and potential memory corruption.

In the Linux kernel, a vulnerability was found in the trace event format verifier. The verifier ignored formats containing "%*p..", which could lead to references to memory that was freed before the event was read, causing a kernel crash. The fix extends verification to cover these cases.

A vulnerability was found in the Linux kernel's PEBS (Precise Event-Based Sampling) mechanism for KVM guests. During VM-Entry, the MSR_IA32_PEBS_ENABLE value was not masked with the guest's desired value, potentially enabling PEBS unexpectedly. This caused a flood of page faults (#PF) and guest crashes.

In the Linux kernel, a vulnerability in Btrfs causes tree log corruption on machines with 64k page size and 16k node size. The issue is due to incorrect subpage bitmap bit calculation during metadata block writeout, leading to skipped writes of dirty blocks.

W jądrze Linuxa zidentyfikowano podatność związaną z użyciem po zwolnieniu (UAF) w funkcji ksmbd_session_rpc_open. Problem ten wynika z warunków wyścigu między ksmbd_session_rpc_open() a __session_rpc_close(). Wprowadzono blokadę rpc_lock, aby zabezpieczyć sesję.

In the Linux kernel, a vulnerability in the trace_seq_to_buffer() function allows an out-of-bounds write. The function may copy more data than the buffer size, leading to memory corruption.

In the Linux kernel, the VXLAN driver (vxlan) has a bug where the default FDB entry is deleted without holding the hash lock when deleting a VNI in vnifilter mode. This triggers a lockdep warning and potential synchronization issues.

In the Linux AF_XDP generic RX path, a race condition occurs when multiple sockets share the same xsk_buff_pool in umem mode. The rx_lock is moved from xsk_socket to xsk_buff_pool to protect both queues.

In the Linux kernel's btusb Bluetooth driver, a vulnerability was found leading to a NULL pointer dereference in skb_dequeue() when processing a QCA firmware crash dump. The handle_dump_pkt_qca() function returned 0 instead of a negative error code, causing double processing of the packet and a NULL dereference.

In the Linux kernel's mtk-star-emac driver, a spinlock recursion bug occurs during RX/TX polling when DMA interrupts are re-enabled. This causes a deadlock on the same spinlock, leading to system hangs.

In the Linux kernel's DRR (Deficit Round Robin) network scheduler, a vulnerability was found causing a double addition of a class to the active list when a netem child qdisc causes reentrant enqueue in the parent. This leads to memory corruption. The fix adds a check whether the class is already on the active list before adding.

In the Linux kernel, the ETS queuing discipline (net_sched: ets) has a double list add bug when netem is a child qdisc. Reentrancy in enqueue causes the class to be added twice to the active_list, leading to memory corruption.

In the Linux kernel, a double list addition of a class to the active list was found in the QFQ network scheduler when netem is used as a child qdisc. This causes memory corruption.

In the Linux kernel's bnxt_en driver, a vulnerability was found during ethtool -w operation where memory corruption occurs due to out-of-bounds memcpy(). The __bnxt_get_coredump() function may copy DMA data exceeding the destination buffer size, causing memory corruption.

In the Linux kernel, a bug in unaccount_slab() fails to clear slab->obj_exts when memory allocation profiling is disabled at runtime or due to an error, causing bad page state and cgroup charge warnings.

In the Linux kernel, a race condition was found between io_uring_cmd_complete_in_task and ublk_cancel_cmd in the ublk driver. Canceling a command may conflict with scheduled task work, leading to a kernel crash. The fix prevents cancellation if the ublk block request has already started.

In the AMD GPU driver (amdgpu) in the Linux kernel, a use-after-free vulnerability was found in the HDCP code. Pointers to amdgpu_dm_connector objects are copied without incrementing kref reference counts, so when a USB-C dock is unplugged, the objects are freed, leaving dangling pointers that are later dereferenced, causing a crash.

In the Linux kernel, the irqchip/qcom-mpm driver lacks a GPIO_NO_WAKE_IRQ check, causing a crash when handling interrupts for non-wake GPIOs. This occurs on Qualcomm chipsets where not all GPIOs have a corresponding MPM pin.

In the Linux kernel, in ksmbd, there is a use-after-free vulnerability during session logoff. The sess->user object can be in use by another thread, for example when another connection sends a session setup request to bind to the session being freed. The patch fixes this issue.

Serwer vCenter zawiera podatność na wykonanie polecenia z autoryzacją. Złośliwy aktor posiadający uprawnienia do tworzenia lub modyfikowania alarmów oraz uruchamiania akcji skryptowych może wykorzystać tę lukę do uruchamiania dowolnych poleceń na serwerze vCenter.