CVE Vulnerability Catalog

An information disclosure vulnerability in the Azure Identity Library for .NET. Technical details are not provided in the description.

A NullPointerException was discovered in JGraphT Core version 1.5.2 within the compare method of the ToleranceDoubleComparator class. However, multiple third parties dispute the existence of this vulnerability, suggesting the report may be based on an insufficiently robust tool.

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service. This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

In the Linux kernel's vfio/pci module, exclusive INTx IRQ is auto-enabled for devices requiring masking at the irqchip (those without DisINTx support). The IRQ is enabled in request_irq() and then disabled to match the masked status, creating a window where the interrupt can fire and increment the disable depth twice. This is unrecoverable for the user because the masked flag prevents nested enables through vfio. The fix inverts the logic using IRQF_NO_AUTOEN.

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

A kernel-infoleak-after-free vulnerability exists in the Linux kernel's __skb_datagram_iter function. netlink_to_full_skb() creates a new skb and copies data using a length based on skb->end (which includes uninitialized tailroom) instead of skb->len, leading to a leak of uninitialized memory to userspace.

In the Linux kernel, a bug in the mmc: mmci: stm32 driver causes unbalanced dma_map_sg and dma_unmap_sg calls. On error in mmci_cmd_irq, dma_unmap_sg is not called, leading to DMA mapping leaks and warnings when CONFIG_DMA_API_DEBUG_SG is enabled.

In the Linux kernel, a bug was found in wakeup_kswapd() called with an invalid zone index (-1) on NUMA systems without local memory on a node, causing a page fault and system crash.

In the Linux kernel, the fbdev sis driver does not check pixclock before using it as a divisor in sisfb_check_var(). A userspace program can pass zero via ioctl(), causing a divide-by-zero error.

In the Linux kernel net/sched act_mirred module, redirecting traffic from egress to ingress may reach the same socket whose lock is still held, causing a deadlock. The fix puts packets into the Rx backlog instead of running the Rx path inline for all egress->ingress reversals.

W Mbed TLS w wersji 3.5.x przed 3.6.0 odkryto problem związany z negocjacją wersji TLS po stronie serwera. Może on przejść do implementacji TLS 1.2, nawet jeśli została ona wyłączona, co prowadzi do nieskończonej pętli w przypadku klienta TLS 1.2 próbującego połączyć się z serwerem obsługującym tylko TLS 1.3.

W Mbed TLS w wersjach 3.5.x przed 3.6.0 odkryto problem, który występuje podczas resetowania kontekstu SSL za pomocą API mbedtls_ssl_session_reset(). Maksymalna wersja TLS do negocjacji nie była przywracana do skonfigurowanej, co pozwalało atakującemu na zablokowanie nawiązywania połączeń TLS 1.3.

A Cross Site Scripting (XSS) vulnerability in CA17 TeamsACS version 1.0.1 allows a remote attacker to execute arbitrary code via a crafted script in the errmsg parameter.

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. Attackers can send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.

In the Linux kernel, inet_recv_error() read the sk->sk_family field without holding the socket lock. An IPv6 socket could be mutated to IPv4 via the IPV6_ADDRFORM socket option, triggering a KCSAN data race warning.

In the Linux kernel's rxrpc subsystem, delayed ACK construction incorrectly set the reference serial number, even though they cannot be used as RTT references. The fix removes this setting.

In the Linux kernel blk-mq layer, a race around sbitmap wakeup can lead to an I/O hang. In blk_mq_mark_tag_wait(), operations may be reordered so that __sbitmap_queue_wake_up() does not observe the waiting thread and wakes nothing, while the driver tag cannot be obtained.

The Linux kernel fixed an issue in the ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround for ARM Cortex-A520 (erratum 2966298) and Cortex-A510 (erratum 3117295). The workaround (TLBI+DSB) was placed before the last explicit memory access (LDR) instead of after it, immediately before the ERET instruction.

In the Linux kernel, the drm/amd/display driver has an issue where the 'panel_cntl' structure can be NULL, and dereferencing it leads to a null pointer access. The fix adds a NULL check in dcn21_set_backlight_level().