CVE Vulnerability Catalog

In the Linux kernel, the Bluetooth subsystem (hci_event) ignores multiple connection complete events for the same handle. Previously, this led to multiple device registration and memory corruption.

In the Linux kernel, the mt76/mt7921 driver has a crash vulnerability when the network interface fails to start. If startup fails, the scheduled reset_work may execute after memory cleanup, leading to a use-after-free. The fix cancels the work item before cleanup.

In the Linux kernel's SCSI libfc driver, there is a use-after-free vulnerability in fc_exch_abts_resp(). fc_exch_release(ep) decreases the reference count, and when it reaches zero, the object is freed, but it is still used in subsequent code, leading to use-after-free.

In the Linux kernel, the netfilter conntrack module has an issue with garbage collection autotuning. The change in gc behavior causes netlink event overflows when the hash table is large. The fix adjusts the gc schedule to avoid overflows.

In the Linux kernel's qede driver, a vulnerability exists where skb allocation is not confirmed before use. qede_build_skb() assumes build_skb() always works, but it can fail under memory pressure, causing a kernel panic. The fix adds a check for NULL return from build_skb().

In the Linux kernel, a NULL dereference crash in the svc_deferred_event trace class in SUNRPC was fixed, occurring when an svc_rqst is deferred while sunrpc tracing is enabled.

In the Linux kernel, in Hyper-V drivers (vmbus), sysctl_record_panic_msg is now deactivated by default in isolated guests. The panic page may contain guest-sensitive information, so it is no longer dumped to Hyper-V by default. Comments in hyperv_panic_event and hyperv_die_event were also updated.

In the Linux kernel IPv6 module, there is a kernel panic vulnerability when forwarding a packet if the input interface has no associated in6 dev. This can be triggered using tc commands with netem corrupt.

In the Linux kernel, the dm-integrity module has a memory corruption vulnerability when the tag_size parameter is smaller than the actual digest size. This can cause writes beyond the end of the ic->recalc_tags array, leading to memory corruption. The issue is fixed by increasing the tags array with sufficient padding.

In the Linux kernel, a vulnerability related to the BFQ scheduler was fixed, which could lead to use-after-free (UAF). The commit regarding honoring already-setup queue merges was restored after being reverted, as the bug was fixed in another commit.

Gradle to narzędzie do automatyzacji budowy, które na systemach podobnych do Unix może tworzyć katalog tymczasowy z otwartymi uprawnieniami. Wersje net.rubygrapefruit:native-platform przed 0.22-milestone-28 mogą być podatne na eskalację uprawnień lokalnych przez atakującego, który szybko usuwa i tworzy pliki w tym katalogu.

Obraz systemu NVIDIA Jetson Linux i IGX OS zawiera podatność w trybie rozruchowym UEFI firmware RCM, która pozwala nieuprzywilejowanemu atakującemu z fizycznym dostępem do urządzenia na załadowanie nieufnego kodu. Udany atak może prowadzić do wykonania kodu, eskalacji uprawnień, manipulacji danymi, odmowy usługi oraz ujawnienia informacji.

A use-after-free vulnerability was found in X.Org and Xwayland. When changing an alarm, the change mask values are evaluated sequentially, and if an error occurs, SyncInitTrigger() returns early without adding the new sync object. This can lead to use-after-free when the alarm eventually triggers.

A use-after-free vulnerability was found in X.Org and Xwayland. When a device is removed while frozen, queued events remain after the device is freed. Replaying these events causes a use-after-free.

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

An out-of-bounds write flaw was found in X.Org and Xwayland. The GetBarrierDevice() function returns the last element of the list instead of NULL when no matching device ID is found, leading to out-of-bounds memory access.

A buffer overflow flaw was found in X.Org and Xwayland. Calling XkbChangeTypesOfKey() with a 0 group resizes the key symbols table to 0 but leaves key actions unchanged. A later call with a non-zero group value causes a buffer overflow because the key actions are of the wrong size.

A heap overflow vulnerability was found in X.Org and Xwayland. The discrepancy in length calculation between XkbSizeKeySyms() and XkbWriteKeySyms() may lead to a heap-based buffer overflow.

A buffer overflow flaw was found in X.Org and Xwayland in the XkbVModMaskText() function. The function allocates a fixed-size stack buffer and copies virtual modifier names without bounds checking, potentially leading to overflow.

A use-after-free vulnerability was found in X.Org and Xwayland. The root cursor is stored as a global variable, and if a client frees it, the internal reference points to freed memory, causing a use-after-free.