CVE Vulnerability Catalog

A vulnerability in the Linux kernel allows a possible NULL pointer dereference in the rt6_probe() function handling IPv6 routing. The issue occurs when __in6_dev_get() returns NULL, leading to a kernel crash (general protection fault). The vulnerability was discovered by syzbot and has been fixed.

In the Linux kernel, xfrm6_get_saddr() did not check the return value of ip6_dst_idev(), which can be NULL. This led to a NULL pointer dereference and kernel crash (general protection fault) while processing XFRM policies for IPv6, including via the WireGuard path.

In the Linux kernel, iommu_sva_bind_device() may return NULL instead of an ERR_PTR error pointer, potentially leading to a NULL pointer dereference. In practice, this does not cause problems because NULL is only returned when CONFIG_IOMMU_SVA is not enabled, and drivers do not call the function in that case.

In the Linux kernel mac80211 mesh (hwmp) code, mesh_preq_queue objects tracking paths needing resolution were not freed when a path or mesh interface was removed. This caused a memory leak detected by KASAN as unreferenced objects.

In the Linux kernel, the HID logitech-dj driver has a memory leak on the error path of logi_dj_recv_send_report() in logi_dj_recv_switch_to_dj_mode().

In the Linux kernel, a vulnerability was resolved in the drm/exynos HDMI driver where, upon EDID read failure and no available display modes, the DRM core added an artificial 1024x786 mode that some Exynos HDMI variants cannot handle. This caused errors and warnings, including vblank wait timeouts. The fix reports a safe 640x480 mode as a fallback instead.

A deadlock exists in the Linux kernel's ieee80211_sta_ps_deliver_wakeup() function. The function uses spin_lock() instead of spin_lock_bh(), which does not prevent softirq execution on the same CPU, allowing re-entry into the same critical section and causing a system hang.

A race condition exists in the Linux kernel's IPv6 function __fib6_drop_pcpu_from(). The compiler may read the pcpu_rt pointer more than once, and the second read could return NULL if another CPU clears the value in rt6_get_pcpu_route(). This leads to a general protection fault and kernel crash (null-ptr-deref).

In the Linux kernel, a vulnerability was resolved in the HID subsystem where the implement() function triggered a WARN_ON() when writing a value into a smaller-sized field in an output report. The warning was unnecessary because the value is already trimmed and hid_warn() prints a warning message. The WARN_ON() was removed to suppress future syzkaller triggers.

In the Linux kernel, the crypto: qat driver had a memory leak in ADF_DEV_RESET_SYNC because using completion_done did not guarantee the caller had finished and could lead to use-after-free. The fix forces cancel_work_sync and safe memory freeing.

In the Linux kernel, the seg6_hmac_init_algo function in the ipv6: sr module did not clean up previous allocations on failure, causing a memory leak and leaking crypto tfms. The fix modifies seg6_hmac_exit to free memory only when allocated.

A vulnerability was found in OpenJPEG similar to CVE-2019-6988, which allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

A flaw in Node.js allows bypassing network import restrictions by embedding non-network imports in data URLs. This enables an attacker to execute arbitrary code and compromise system security.

A vulnerability in Undertow requires enabling the learning-push handler in the server's config, which is disabled by default. With the default maxAge value of -1, the handler is vulnerable, but if someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

Podatność w ExtremePacs Extreme XDS pozwala na ominięcie autoryzacji poprzez klucz kontrolowany przez użytkownika, co umożliwia zbieranie danych dostarczonych przez użytkowników. Problem dotyczy wersji Extreme XDS przed 3928.

Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows for the leakage of kernel memory from both the stack and the heap.

Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 leaks driver logs containing addresses of kernel mode objects, weakening KASLR.

CPython 3.9 and earlier does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used. This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in practice.