CVE Vulnerability Catalog

In the Linux kernel, macvlan interfaces do not inherit needed_headroom and needed_tailroom from the lower device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, the veth interface has a bug in veth_poll that uses an incorrect queue index to wake the peer TX queue. Without an XDP program, the index remains 0, which can lead to a permanent stall of the TX queue and loss of transmission.

In the Linux kernel, the ngbe driver has a NULL pointer dereference vulnerability when enabling interrupts in non-MSI-X mode. In such mode, wx->msix_entry is not allocated, and calling NGBE_INTR_MISC leads to a crash.

In the Linux kernel, the net/sched act_api module has a TOCTOU vulnerability leading to NULL pointer dereference on a->goto_chain. A concurrent operation can clear the pointer between two reads, causing a NULL dereference.

In the Linux kernel, the net/sched cls_u32 module has a slab-out-of-bounds read vulnerability in u32_bind_class(). The function does not check whether the object is an hnode, leading to invalid memory access.

In the Linux kernel, the regmap sdw-mbq module has a vulnerability of calling an unset readable_reg callback. When the callback is not set, calling it leads to a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel, the am65-cpsw-nuss driver has a bug in extracting the port ID from the source tag. It uses the full 16 bits, while only the lower 8 bits represent the port ID, which can lead to out-of-bounds memory access and system crash.

In the Linux kernel, the cls_bpf module did not verify that a device-bound (offloaded) eBPF program is bound to the same network interface to which the classifier is being attached. This allowed attaching a program intended for device A to device B, and after deleting device A it caused a system panic.

In the Linux kernel, in the L2TP modules (pppol2tp and l2tp_dfs), there is a reference leak for tunnels and sessions when closing seq_file files before reaching end-of-file. References stored in private data are not dropped, leading to memory leaks.

In the Linux kernel's firewire: ohci driver, a NULL pointer dereference vulnerability was found in ar_context_release(). The issue occurs during the error handling path of the probe function when the context was not initialized, and the devres cleanup mechanism triggers release. An attacker could exploit this to cause a kernel crash (system panic).

Http4s before versions 0.23.35 and 1.0.0-M47 has a DoS vulnerability via HTTP/2 in the Ember backend. The Hpack wrapper does not include indexed headers or per-header overhead in the header size limit, allowing a small block to expand into a large in-memory representation. Multiple malicious connections can exhaust process memory.

Starlette-Admin before 0.16.1 does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user can sort or filter on unintended fields, leading to limited information exposure and potential HTTP 500 errors.

IzPack version 5.2.6 and earlier has a path traversal vulnerability allowing writes outside the installation directory. The unpack() function does not normalize paths or enforce destination containment, allowing entries with '../' sequences to write to arbitrary locations.

kas, a setup tool for bitbake based projects, prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity.

Kyverno, a policy engine for cloud native platform engineering teams, from 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

LogTape before versions 1.3.11, 2.0.14, and 2.1.5 has a vulnerability in the @logtape/syslog package that allows injection of forged syslog records. The escapeStructuredDataValue() function does not neutralize control characters, and formatStructuredData() does not validate keys, enabling manipulation of frames and data elements.

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. It fails to validate the TLV data length before reading and writing a 10-byte ptp_timestamp structure, causing an out-of-bounds read and write of 8 bytes. The vulnerability is reachable by an adjacent attacker on the local PTP segment when CONFIG_PTP is enabled.

A vulnerability in the LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in Zephyr RTOS (subsys/lorawan/services/frag_transport.c) lacks validation of remaining payload bytes before each access. An attacker with session keys can cause an out-of-bounds read (up to ~232 bytes) past the RxPayload buffer, copying adjacent static memory into decoder buffers and the FUOTA flash image.

The LoRaWAN application-layer clock-synchronization service has an out-of-bounds read vulnerability in the AppTimeAns command handler. Missing length check causes up to 5 bytes to be read past the decrypted payload, potentially applying a garbage time correction.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.