CVE Vulnerability Catalog

In the Linux kernel, the SMB server (ksmbd) has a use-after-free vulnerability during asynchronous oplock break notification. The pointer to the ksmbd_conn structure is stored in an async work without proper reference counting, which can lead to access to freed memory.

In the Linux kernel, the SMB client's parse_dfs_referrals() did not validate the PathConsumed value in DFS responses. A malicious response with an oversized PathConsumed can cause subsequent DFS path parsing to advance beyond the end of the path.

In the Linux kernel, the AMT (Automatic Multicast Tunneling) module has a use-after-free vulnerability. Several packet receive and transmit paths cache a pointer to the skb header and then call functions that can reallocate the head, leaving the pointer dangling. An attacker could exploit this to escalate privileges or leak information.

In the Linux kernel SCTP subsystem, sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, bypassing authentication verification. The fix checks sctp_auth_recv_cid() in such cases and drops the chunk if authentication is required.

In the Linux kernel, a vulnerability was found in the MPTCP implementation, involving a stale skb->sk pointer to a closing subflow. The backlog cleanup was performed without proper synchronization, which could lead to a use-after-free condition.

In the Linux kernel, SCTP UDP tunnel sockets were not closed during network namespace teardown, potentially leading to races and improper state. The fix closes these sockets in sctp_ctrlsock_exit() after unregistering the sysctl table.

In the Linux kernel, a pre-auth out-of-bounds read vulnerability was found in ceph_handle_caps(). An attacker or compromised MDS can set snaptrace_len to 0xFFFFFFFF, leading to reads beyond the message buffer and further out-of-bounds reads.

In the Linux kernel's libceph module, the length of pg_temp, pg_upmap, and pg_upmap_items lists was not bounded to CEPH_PG_MAX_SIZE, potentially leading to a stack out-of-bounds write. The fix rejects entries longer than 32 during decoding.

In the Linux kernel's libceph module, a multiplication overflow during osdmap decoding can lead to incorrect bounds checking and out-of-bounds reads. The fix uses check_mul_overflow() to detect overflow and reject corrupted messages.

In the Linux kernel's libceph module, after an authorizer update, the auth->authorizer_buf may point to freed memory, leading to a use-after-free. The fix refreshes these pointers after a successful authorizer rebuild.

In the Linux kernel's libceph module, CRUSH bucket type 0 was accepted, potentially leading to indexing the OSD weight array with a negative value. The fix rejects such types during CRUSH map decoding.

In the Linux kernel's phonet module (PEP subsystem), the function pep_get_sb() does not consider that pskb_may_pull() might have relocated the skb data, and continues to access the older pointer, leading to a use-after-free. The issue was confirmed by KASAN.

In the Linux kernel's net/x25 subsystem, there is a use-after-free vulnerability in x25_kill_by_neigh(). The function walks the global X.25 socket list but does not pin the socket's lifetime after dropping the list lock. A concurrent close can free the socket, and the function then uses the freed object. The fix takes a reference with sock_hold() and rechecks the connection.

A vulnerability in the Linux kernel's GRO (Generic Receive Offload) mechanism allows re-aggregation of packets marked with the flush flag. The lack of validation in skb_gro_receive_list() leads to corruption of the frag_list chain, potentially causing a kernel panic during packet transmission.

In the Linux kernel ILA module, after calling pskb_may_pull(), the IPv6 header pointer may become stale, leading to use-after-free. The fix reloads the pointer after each pskb_may_pull().

A vulnerability in the Linux kernel's MCTP serial driver allows zero-length frames to bypass validation and cause out-of-bounds writes. An attacker with CAP_NET_ADMIN can trigger a buffer overflow via the tty receive path.

In the Linux kernel openvswitch module, during GSO segmentation for userspace actions, a length underflow can occur, leading to incorrect skb_zerocopy() behavior. The fix stores the maximum preserved length and bounds consumers.

In the Linux kernel, the tipc_sk_create() function fails to clear sock->sk on the failed-insert path, leading to a use-after-free in the accept() path. The issue occurs when the socket hash table reaches its maximum size (about 2 million sockets per network namespace).

Zyxel Networks WAH7601 through 20072026 has an OS command injection vulnerability that allows an attacker to execute arbitrary commands on the system.

In the Linux kernel, the ksmbd (SMB) server has a vulnerability in path resolution in ksmbd_vfs_kern_path_create. An attacker can use '..' components to escape the shared resource, leading to privilege escalation or unauthorized access.