CVE Vulnerability Catalog

In the Linux kernel, the RDMA/bnxt_re driver's destroy callbacks zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again even though the driver resource has already been freed. The fix moves ib_no_udata_io() before teardown and ib_respond_empty_udata() to the start of create and modify flows.

In the Linux kernel, the PCI/pwrctrl tc9563 driver parsing both functions of the integrated Ethernet MAC Endpoint under DSP3 caused an out-of-bounds access past the tc9563_pwrctrl->cfg array. The fix parses the Endpoint node under DSP3 instead of both functions.

In the Linux kernel, in the md/raid5-ppl module, the ppl_do_flush() function continues iterating after calling ppl_io_unit_finished(), which frees the io object. Subsequent access to io->pending_flushes leads to a use-after-free.

In the Linux kernel for powerpc architecture in the XIVE subsystem, when xive_init_ipis() fails, the global xive_ipis array is freed. However, xive_smp_probe() previously ignored this failure and called xive_setup_cpu_ipi(), which dereferenced the already-freed pointer, leading to a use-after-free.

A use-after-free vulnerability has been found in the Linux kernel's vxlan_mdb_flush() function used for VXLAN multicast database (MDB) management. The flaw allows freeing one MDB entry while iterating over another, leading to a write to freed memory during deletion operations.

The Linux kernel for the LoongArch architecture lacks a DIRECT_MAP_PHYSMEM_END definition, causing get_free_mem_region() and mhp_get_pluggable_range() to potentially return ZONE_DEVICE regions outside the vmemmap window. This can lead to page table corruption or system crashes, especially on CPUs with fewer physical address bits, such as the Loongson-2K series.

In the NFS server (nfsd), there is a missing read barrier in the rpc_status_get dumpit function, which on weakly-ordered architectures (ARM, POWER) can lead to an ineffective retry mechanism. This could result in reading inconsistent data. The fix adds smp_rmb() before the second counter check.

In the phy driver (fsl-imx8mq-usb), there is a leak of the typec switch when probe errors occur. The fix uses devm_add_action_or_reset() to ensure cleanup on both probe failure and driver removal.

A flaw was fixed in the Linux kernel's svcrdma module where a failed accept path called rpcrdma_rn_unregister() without a prior successful registration. This caused erasure of another caller's XArray slot and an unmatched reference release on the RDMA device, as well as a memory leak of the svcxprt_rdma structure on every failed accept.

A race condition exists in the Linux kernel's nfsd_net structure, where the boolean field grace_ended is read and written without synchronization from multiple threads. Two concurrent calls to nfsd4_end_grace() can both proceed to nfsd4_record_grace_done(), leading to a double-free and corruption of the reclaim_str_hashtbl list. The vulnerability is fixed by replacing boolean fields with a flags word and using the atomic test_and_set_bit() operation.

zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int.

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle.

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation.

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks.

An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the returned allocation as a complete te_expr object.

BentoPDF in 2.8.6 and earlier has a vulnerability in the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js that uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution used by fetch(targetUrl), allowing an attacker-controlled hostname to resolve to an internal or reserved destination after validation. A certificate-like path can satisfy ALLOWED_PATH_PATTERNS, and direct clients can forge the Origin header. Deployments without PROXY_SECRET skip the optional signature check.

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder.

RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 allow a monitoring-tagged user to delete or restart any dynamic shovel in any vhost they can see. The shovel management resource delegates authorization to a monitoring check even though DELETE should be restricted to the policymaker role. The issue is fixed in the listed versions.