CVE Vulnerability Catalog

In the Linux kernel, the ksmbd module has incorrect buffer length validation in smb2_set_ea(). It fails to check buffer length before accessing the next smb2_ea_info, potentially leading to out-of-bounds read.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup. ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_sess_setup().

In the Linux kernel, there is a vulnerability in ksmbd that involves missing validation of session ID and tree ID in compound requests. If the first operation in a compound request is SMB2 ECHO, validation is bypassed, which can lead to NULL pointer dereference and system crash.

In the Linux kernel, the ksmbd module has an out-of-bounds read vulnerability in the smb2_write function. The issue arises from lack of validation of the hdr->NextCommand field, which could allow oversized SMB2 write length and lead to out-of-bounds read.

In the Linux kernel, the ksmbd module now prevents guest users from using multichannel. If a session is bound to a guest, the server returns STATUS_NOT_SUPPORTED.

In the Linux kernel, the ksmbd server lacks a call to rcu_barrier() during module unload, which can lead to a race condition and unintended execution of kernel code locally, bypassing protections such as Kernel Lockdown.

Motyw Soledad dla WordPressa jest podatny na atak Local File Inclusion we wszystkich wersjach do 8.6.7 włącznie, poprzez parametr 'header_layout'. Umożliwia to uwierzytelnionym atakującym z dostępem na poziomie Contributor i wyżej do włączenia i wykonania dowolnych plików .php na serwerze.

Motyw Soledad dla WordPressa jest podatny na wykonanie dowolnego shortcode'a we wszystkich wersjach do 8.6.7 włącznie. Problem wynika z braku odpowiedniej walidacji wartości przed wykonaniem funkcji do_shortcode.

In the Linux kernel MPTCP stack, races between subflow failure and new subflow creation are fixed by adding a separate flag protected by the fallback lock, preventing additional subflow creation in certain socket states.

In the Linux kernel, there is a vulnerability in ipv6: mcast where a delayed put of pmc->idev in mld_del_delrec() could lead to a use-after-free. pmc->idev is still used in ip6_mc_clear_src(), so the reference should be put after ip6_mc_clear_src() returns.

The AXP717 ADC driver in the Linux kernel is missing a sentinel entry in its channel maps, triggering a KASAN warning.

In the am65-cpsw-nuss driver in the Linux kernel, memory for skb_shared_info was not allocated during the transition to build_skb(), causing incorrect skb size.

In the Linux kernel Appletalk protocol (net/appletalk), the atrtr_create() function did not release the old device reference before assigning a new one when updating an existing route entry, leading to a device refcount leak.

In the Linux kernel tracing subsystem, when adding trace events by a module, a write lock on the trace_event_sem semaphore was missing. When two modules are loaded simultaneously, this can corrupt the ftrace_events list and crash the kernel.

In the airoha driver in the Linux kernel, there is a potential use-after-free in airoha_npu_get() because np->name is used after calling of_node_put(np).

In the Linux kernel, the libwx network driver has an uninitialized 'dma' field in wx_rx_buffer, potentially causing DMA errors or use-after-free.

In the Linux kernel, a vulnerability in the libwx driver causes improper reset of Rx ring descriptors during device reset. Stale descriptor values can lead to malformed SKBs, resulting in a kernel BUG and system crash.

In the Linux kernel, the bprintf helpers (e.g., bpf_trace_printk) mishandled the "%p%" format sequence, causing a kernel warning at runtime because the second percent sign was skipped during %p processing.

A use-after-free vulnerability in the Linux kernel's SMB client (cifs) was found in cifs_oplock_break() due to a race condition during unmount. The cinode structure is accessed after the superblock is released, leading to memory corruption.

In the Intel Ethernet driver (ice), the function ice_lag_is_switchdev_running() can be called outside LAG event handler code, causing lag->upper_netdev to be NULL. Missing NULL check before dereference leads to a NULL-pointer dereference.