CVE Vulnerability Catalog

In the Linux kernel, a vulnerability was found in the ext4 filesystem that allows cycles in the h-tree stored inside a directory. A maliciously corrupted filesystem can lead to kernel corruption of tree nodes and access to unallocated memory. The issue is fixed by verifying that traversed block numbers are unique.

In the Linux kernel, in ip_gre, the check was revised to test csum_start instead of the transport header. This prevents overflow in lco_csum when GRE packets with TUNNEL_CSUM are processed.

In the Linux kernel, in the drm/etnaviv driver, a check was added for reaped mappings in etnaviv_iommu_unmap_gem. If the mapping is already reaped, the unmap is a no-op to avoid double removal and data structure corruption.

A use-after-free vulnerability was found in the Linux kernel's mt76 driver (for MediaTek Wi-Fi cards). The issue involves a wcid pointer in mt76_txq_schedule that was not protected by RCU, leading to a reference to freed memory during transmission scheduling.

In the Linux kernel, a fix was made for accessing tp->snd_cwnd in TCP, which could be set to an illegal value, leading to warnings and potential bugs.

In the Linux kernel, in the xprtrdma module, when an RDMA server returns a fault format reply, the NFSv3 client may treat it as a callback (bcall) when the bc service does not exist. This leads to a NULL pointer dereference in rpcrdma_bc_receive_call. The fix treats all calls as not a bcall when bc_serv is NULL.

In the Linux kernel, in ALSA OSS, the PCM OSS buffer allocation overflow was fixed. A 1MB limit for period size was added and array_size() and array3_size() are used for multiplications to prevent integer overflow.

In the Linux kernel, a vulnerability was found in the access_ok() function on three architectures, where checking the end of a user access against the address limit does not account for possible integer overflow. Passing a negative length or another overflow returns success when it should not.

In the Linux kernel, there is a vulnerability involving integer overflow on 32-bit systems in the operation 'len * sizeof(*p)' in the NFSD module. This could lead to incorrect behavior or potential exploitation.

In the Linux kernel, a bug in the OCFS2 filesystem caused a crash when mounting with quota enabled. The issue occurred during initialization of dqi_gqlock when the corresponding dqi_type and dqi_sb were not properly initialized. The bug was introduced by commit 6c85c2c72819, which aimed to avoid accessing uninitialized variables in error cases. The fix properly initializes global quota info.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the BFQ scheduler. The issue involves moving the oom_bfqq queue, which can lead to a write to freed memory during module removal.

In the Linux kernel, a bug in the memstick/mspro_block driver regarding read-only devices was fixed. Instead of checking for read-only state in ->open and leaking a reference in case of a read-only device, set_disk_ro is used to propagate the read-only state to the block layer.

A use-after-free vulnerability was found in the bfq_dispatch_request function of the BFQ scheduler in the Linux kernel. The issue occurs during normal SCSI-MQ testing and can lead to memory corruption.

In the Linux kernel for the parisc architecture, a vulnerability was found involving non-access data TLB cache flush faults. The fdc and fic instructions in flush_user_dcache_range_asm and flush_user_icache_range_asm cause faults that do not invalidate the cache line, potentially leading to memory corruption. The problem was hidden by nullification of the flush instructions.

In the Linux kernel, the F2FS filesystem lacked validation of the curseg->alloc_type value, which could lead to an out-of-bounds access to the sbi->block_count[] array when mounting a corrupted image, triggering a UBSAN error. The issue was reported by Wenqing Liu and affected kernel versions 5.17-rc4 and 5.17-rc6.

In the Linux kernel, the btrfs filesystem has a double bio completion issue during errors in compressed reads. The function btrfs_submit_compressed_read() may call bio_endio() on the bio, and then btrfs_submit_data_bio() does it again, leading to incorrect behavior.

In the Linux kernel, the imx-jpeg media driver has an out-of-bounds array access bug. During a JPEG parsing error, the slot is not yet acquired and may have the default value MXC_MAX_SLOTS, leading to out-of-bounds read and modification of adjacent data.

In the Linux kernel, a bug in the sm712fb driver (video: fbdev) caused a crash when writing three bytes to the framebuffer. The issue occurred in the smtcfb_write() function and was caused by an error in the endianness conversion code. The fix removes the open-coded endianness fixup-code.

In the Linux kernel, the SCSI qla2xxx driver incorrectly freed a pre-allocated structure during purex packet handling, causing a system crash during module load/unload tests. The fix skips that entry.

In the Linux kernel, the qla2xxx SCSI driver has a race condition between the timeout handler and the async completion function, leading to use-after-free and a NULL pointer dereference. The fix introduces a reference counter for the SRB structure to synchronize access.