CVE Vulnerability Catalog

A vulnerability in the Linux kernel related to a shift-out-of-bounds in the iova_bitmap_offset_to_index() function has been resolved. This issue could lead to undefined behavior when the shift value exceeds 31 bits.

A vulnerability was found in the Linux kernel's XFRM (IPsec) subsystem in packet offload mode. When IP forwarding is enabled, the secpath entry is not removed after policy check, causing the packet to be re-processed by the network driver with xfrm_offload set. This leads to a NULL pointer dereference and kernel panic, as observed in the mlx5 driver.

In the Linux kernel ipmr module, a vulnerability exists where mr_mfc_uses_dev() is called for unresolved (unres) entries, causing a wild pointer dereference and system crash. This issue has been present since the initial implementation and can be exploited to trigger a kernel panic.

A vulnerability was found in the Linux kernel's ROSE protocol implementation. ROSE timers did not check if the socket was owned by a user thread, leading to a race condition and use-after-free.

In the Linux kernel, the mlx5e driver (Mellanox ConnectX) was missing a cpu_to_node call before passing the CPU ID to kvzalloc_node. Operations on a CPU with index greater than MAX_NUMNODES caused out-of-bounds access and kernel panic.

W jądrze systemu Linux zidentyfikowano podatność w funkcji bitmap_get_stats(), która może prowadzić do awarii systemu. Problem wynika z możliwości wywołania tej funkcji w momencie, gdy bitmapa została zniszczona lub nie została w pełni zainicjowana, co może spowodować błąd ochrony ogólnej.

A vulnerability in the Linux kernel's TCP implementation can cause permanent connection deadlock under extreme memory pressure. When a socket temporarily advertises a zero window and fails to update its window size after memory is freed, the peer stops sending data, blocking transmission.

In the Linux kernel, during dup_mmap() failure handling, the mm_struct may be left incomplete, creating a race condition. Setting MMF_OOM_SKIP and MMF_UNSTABLE flags prevents access to the partially initialized mm_struct by other components, including uprobe.

A use-after-free vulnerability was found in the Linux kernel's PPS (Pulse Per Second) subsystem. The bug occurs during device removal when pps_device_destruct() frees memory before file operations on open descriptors complete, leading to system crashes.

In the Linux kernel's rdma/cxgb4 driver, an integer overflow vulnerability was found on 32-bit systems. The user-controlled 'gl->tot_len' variable can cause wrapping in addition, leading to a potential security flaw.

Podatność w diagnostyce monitorowania zdrowia przełączników Cisco Nexus 3000 i 9000 w trybie NX-OS może pozwolić nieautoryzowanemu, sąsiedniemu atakującemu na nieoczekiwane przeładowanie urządzenia, co prowadzi do stanu odmowy usługi (DoS). Problem wynika z nieprawidłowego przetwarzania określonych ramek Ethernet.

W rozszerzeniu quarkus-resteasy znaleziono błąd, który powoduje wycieki pamięci przy żądaniach klientów z niskimi limitami czasowymi. W przypadku przekroczenia limitu czasu żądania, bufor nie jest poprawnie zwalniany, co prowadzi do zwiększonego zużycia pamięci i ostatecznego awarii aplikacji z powodu błędu OutOfMemoryError.

A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to inject malicious scripts or HTML via the title field in the article category section.

A cross-site scripting (XSS) vulnerability was found in Emlog Pro version 2.5.4. It allows an attacker to inject malicious JavaScript or HTML code into the article header via the admin panel at /admin/article.php.

In the Linux kernel, the i40e driver has a vulnerability causing a call trace and potentially a system panic. The issue occurs when after a PF reset and ethtool -t, the second i40e_vsi_close starts before the previous one finishes, leading to a crash.

In the Linux kernel, the tun driver has a vulnerability involving a race between tun file and device destruction. NAPIs in struct tun_file can be destroyed before the netdev, and the code does not explicitly delete the NAPI if the queue was detached first.

In the Linux kernel TIPC module, there is a NULL pointer dereference vulnerability. When creating a new node, the broadcast link is created after inserting the node into the hash table, creating a race window where an incoming packet can get the node without the link yet, leading to a kernel panic.

In the Linux kernel, a vulnerability was found in the drm/panfrost driver where calling the madvise IOCTL twice on a BO causes memory shrinker list corruption. This leads to the BO being added to the list twice, causing memory corruption and kernel crash.

In the Linux kernel, the IMA module has a vulnerability involving a potential integer overflow in ima_appraise_measurement. When ima-modsig is enabled, the rc value passed to evm_verifyxattr() may be negative, which can cause an integer overflow.

In the Linux kernel, a buffer overflow vulnerability was found in the be2net driver in the be_get_module_eeprom function. The function be_cmd_read_port_transceiver_data assumes a buffer of sufficient length, which is not always the case, potentially leading to out-of-bounds write.