CVE Vulnerability Catalog

In the Linux kernel, memory leaks were found in XDR decoding functions in the auth_gss module of the SUNRPC protocol. The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer() but fail to free it when a subsequent decode operation fails, leading to memory leaks. The leak in gssx_dec_ctx() is particularly critical because the caller initializes buffer length fields to non-zero values, forcing memory allocation.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the wm97xx power supply driver. The issue occurs when an interrupt (IRQ) is registered before the power_supply structure is initialized, potentially leading to the use of an uninitialized pointer in the power_supply_changed() function.

In the Linux kernel, a reference leak was detected in the pcs_add_gpio_func() function in the pinctrl-single driver. The of_parse_phandle_with_args() function increments the reference count for the gpiospec.np node, but the loop iterating through all handles never releases these references, leading to a memory leak. The issue was detected by a static analysis tool and confirmed during code review.

In the Linux kernel, the MCTP I2C driver did not initialize the event handler read buffer, causing uninitialized stack data to be returned. For i2c-aspeed and i2c-npcm7xx drivers this led to leakage of uninitialized values.

In the Linux kernel's NTFS3 filesystem, an infinite loop vulnerability was found when processing the range [valid : pos). If the valid value cannot be read correctly and remains the same, a process hang may occur, as reported by syzbot. A check was added to detect unchanged valid values and return -EINVAL.

A memory leak was found in the Linux kernel in the dw_i3c_master_i2c_xfers() function of the i3c dw driver. When pm_runtime_resume_and_get() fails, the allocated xfer structure is not freed, causing a memory leak.

In the Linux kernel, a vulnerability in the ext4 filesystem was found related to incorrect zeroing of allocation ranges when splitting a large unwritten extent. Under certain conditions, when the extent splitting operation fails due to lack of space, stale data may remain in the written range, compromising data integrity.

In the Linux kernel, a vulnerability was found in the csiostor driver where a null pointer rn is dereferenced in the error exit path via the CSIO_INC_STATS macro. The fix adds a new error return label after the macro usage.

In the Linux kernel, a vulnerability in the ATA subsystem (libata-scsi) can cause non-NCQ command starvation. When a device is under constant NCQ command load, non-NCQ commands may be repeatedly deferred, potentially preventing their execution entirely.

In the Linux kernel's inside-secure/eip93 crypto driver, a vulnerability exists where all cryptographic algorithms are unregistered regardless of which are actually implemented in hardware. This causes a system panic on platforms that do not have all options implemented in silicon.

In the Linux kernel, a vulnerability was found in the IPVS module where protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. The issue is fixed by using the iph->len field, which contains the appropriate offset.

In the Linux kernel, the mscc ocelot network driver lacks lock protection in ocelot_port_xmit_inj(). The function calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock, potentially causing races. The fix adds ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register injection path.

In the Linux kernel, a vulnerability was found in the AppArmor module where the aa_sock_file_perm function does not check for NULL pointers for sock and sock->sk. This can lead to a NULL pointer dereference (oops) during socket setup or teardown, especially for af_unix sockets.

In the Linux kernel, the WARN_ON_ONCE warning when accessing the forward path array has been removed. Support for IPIP tunnels increased the likelihood of hitting this warning if userspace builds a sufficiently long forward path.

A vulnerability in the Erlang OTP public_key library allows improper following of a certificate's chain of trust. A non-CA certificate can be accepted as an intermediate issuer, enabling certificate chain forgery.

IBM Cloud APM w wersji Base Private 8.1.4 oraz Advanced Private 8.1.4, a także IBM Db2 dla systemów Linux, UNIX i Windows, mogą pozwolić uwierzytelnionemu użytkownikowi na spowodowanie odmowy usługi z powodu niewłaściwego neutralizowania specjalnych elementów w logice zapytań danych w środowisku Fenced.

A flaw in Samba's vfs_worm module allows bypassing WORM (write-once, read-many) protections during file rename operations. An authenticated user with write access to a share can overwrite a protected file by renaming a newly created file over an existing WORM-protected file.

In libusb before version 1.0.30, a NULL pointer dereference vulnerability exists. An attacker can supply a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Consequently, any application iterating over endpoints may crash.

In the Linux kernel, a memory leak of the ntfs_mount_options structure was found in the NTFS3 filesystem. The issue occurs in ntfs_fill_super() where the fc->fs_private pointer is set to NULL without freeing the allocated memory first, causing ntfs_fs_free() to skip deallocation.

In the Linux kernel, the NTFS3 filesystem has a vulnerability involving the use of uninitialized folios. Newly allocated folios are not marked as uptodate, and the ni_read_frame() function is skipped when the caller expects the frame to be completely overwritten, leaving part of the memory uninitialized.