CVE Vulnerability Catalog

W jądrze Linuxa zidentyfikowano podatność związaną z systemem plików JFS, która pozwala na uszkodzenie zwykłych plików poprzez zapisanie wartości ujemnej dla i_size. Wprowadzono poprawkę, która dodaje sprawdzenie podczas otwierania takich plików, aby uniknąć błędów w kolejnych operacjach.

In the Linux kernel, the MIPS stack_top() function can crash for tasks without an ABI or vDSO because it dereferences a NULL ABI pointer. This can happen, for example, when using kunit.

In the Linux kernel lpfc SCSI driver, if lpfc_sli4_read_rev() called from lpfc_sli4_hba_setup() fails, the cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may run before sli4_hba.hdwqs are allocated. This causes a NULL pointer dereference when accessing the first hardware queue.

In the Linux kernel DVB dib7090p driver, dib7090p_rw_on_apb() processes user-controlled data; when msg[0].buf is NULL and msg[0].len is zero, earlier checks pass and accessing msg[0].buf[2] causes a NULL pointer dereference. A similar issue affects msg[1].buf[0] and msg[1].buf[1].

In the Linux kernel DVB w7090p driver, w7090p_tuner_write_serpar and w7090p_tuner_read_serpar process user-controlled data; when msg[0].buf is NULL and msg[0].len is zero, earlier checks pass and accessing msg[0].buf[2] causes a NULL pointer dereference.

In the Linux kernel, a cluster chain loop check was added for directories in the exfat filesystem. Without this fix, a corrupted filesystem could cause infinite loops in functions such as exfat_count_dir_entries(), exfat_create_upcase_table(), exfat_load_bitmap(), exfat_find_dir_entry(), and exfat_check_dir_empty().

In the Linux kernel pNFS, on the third attempt to encode extents, ext_tree_prepare_commit() reallocates a larger buffer, but the layoutupdate_pages page array is initialized only after the retry loop. ext_tree_free_commitdata() called on every iteration dereferences uninitialized pointers. There is also no limit on maximum buffer size, which can produce a layoutcommit too large for the server.

In the Linux kernel's drm/xe/migrate driver, infinite recursion occurs when the stack-allocated bounce buffer is not aligned to XE_CACHELINE_BYTES, causing repeated function calls and stack overflow. The fix replaces the stack buffer with kmalloc respecting power-of-two alignment.

In the Linux kernel with CONFIG_X86_DEBUG_FPU, reading /proc/[kthread]/arch_status causes a warning and NULL pointer dereference because AVX-512 timestamp code uses x86_task_fpu() without NULL check for kernel threads. The fix stops outputting AVX-512_elapsed_ms for kernel threads.

In the Linux kernel, a crash in the userfaultfd UFFDIO_MOVE operation was fixed when the PMD is a migration entry. The missing check caused an attempt to access a folio even though the entry was of type swp_entry_t, leading to a crash. The missing check was added and an unnecessary folio check was removed.

In the Linux kernel net/sched ETS qdisc, ets_qdisc_change() purged unused DWRR queues using the new 'nbands' value instead of the old one, causing an inconsistent configuration and a NULL pointer dereference in ets_class_qlen_notify(). The flaw can be triggered by a local user able to configure qdiscs (e.g., via tc), resulting in a kernel oops.

A flaw in the Linux kernel's hv_netvsc driver moves the VF NIC to a new namespace when NETDEV_REGISTER is received on the netvsc NIC. During namespace deletion, this can cause a NULL pointer dereference and kernel panic (oops) in default_device_exit_batch.

A race condition vulnerability was found in the Linux kernel between ptdump_walk_pgd() and memory hot remove operations. While ptdump scans kernel page tables, concurrent modifications can cause use of freed memory, leading to potential security issues. The fix moves the memory hotplug lock inside ptdump_check_wx(), protecting both the dump and W+X page checking paths.

NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsafe debug access level. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access level. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA ConnectX contains a vulnerability in the management interface where an attacker with local access could cause incorrect authorization to modify configuration. Successful exploitation may lead to denial of service, privilege escalation, information disclosure, and data tampering.

NVIDIA Cumulus Linux and NVOS products contain a vulnerability where hashed user passwords are not properly suppressed in log files, potentially disclosing information to unauthorized users.

NVIDIA Mellanox DPDK contains a vulnerability in the Poll Mode Driver (PMD) where an attacker on a VM in the system may cause information disclosure and denial of service on the network interface.

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Stored XSS vulnerability in appRain CMF version 4.0.5 due to lack of input validation in 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/canvasjs. Requires authentication.