CVE Vulnerability Catalog

A use-after-free vulnerability was discovered in the Linux kernel's tipc_conn_close() function within the TIPC module. During network namespace dismantle, tipc_topsrv_stop() releases the IDR lock before calling tipc_conn_close(), allowing a concurrent worker thread to free the tipc_conn structure, resulting in a read-after-free.

A vulnerability in the Linux kernel's TCP stack involves incorrect signedness in the calculation of remaining space in an skb. A type promotion bug causes the 'copy' variable to become a large positive value, leading to overflow of 'sk_forward_alloc' and potential memory exhaustion.

A TOCTOU (time-of-check time-of-use) vulnerability was found in the vsock module of the Linux kernel during transport assignment. The transport assignment could race with module unloading, leading to use of a stale pointer.

In the Linux kernel's ATM CLIP subsystem, the function to_atmarpd() is called without RTNL lock, leading to potential NULL-pointer dereference. RTNL protection of atmarpd is insufficient because calls may come from unsleepable contexts.

In the Linux kernel's IPMI subsystem (msghandler), the function ipmi_create_user() uses a list iterator "intf" that may be an invalid pointer if the correct intf->intf_num is not found. Calling atomic_dec(&intf->nr_users) on an invalid pointer leads to memory corruption.

A vulnerability in the Linux kernel's KVM for SVM allows migration of SEV{-ES} state between hosts while vCPU creation is in progress. This can result in an SEV{-ES} VM having a non-SEV{-ES} vCPU, leading to a system crash when freeing VMSA memory.

In the Linux kernel's io_uring/msg_ring subsystem, a use-after-free vulnerability was found. The issue occurs when msg_ring adds a task to the local work queue that has already been freed, potentially leading to system crashes or exploitation.

In the Linux kernel, a vulnerability in the DRM/GEM subsystem allows a GEM handle to be released while the GEM buffer object is still attached to a DRM framebuffer. This causes the dma-buf to be freed, leading to a segmentation fault when the framebuffer is used in mode-setting operations.

In the Linux kernel's mm/rmap subsystem, the batched unmap logic in try_to_unmap_one() may read past the end of a PTE table when a large folio's PTE mappings are not fully contained within a single page table, leading to out-of-bounds access.

In the Linux kernel, an out-of-bounds access was found in the dispmix_csr_clk_dev_data function of the i.MX clock driver. When num_parents is 4, __clk_register() reads beyond the parent_names array, triggering a KASAN error.

In the Linux kernel's mlx5e driver, a race condition exists between disabling DIM (Dynamic Interrupt Moderation) and calling net_dim(). If NAPI checks the DIM state bit and sees it as active, then DIM gets disabled, the pointer to the DIM context may already be NULL, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, the bnxt_en driver has a vulnerability where the DMA unmap length is incorrectly set to 0 for XDP_REDIRECT packets. This triggers a warning and potential issues on systems with IOMMU enabled.

W jądrze Linuxa zidentyfikowano podatność, która została naprawiona. Dotyczy ona potencjalnego błędu use-after-free w mechanizmie potwierdzania przerwania oplock/lease, który może wystąpić w przypadku błędu zwracanego przez ksmbd_iov_pin_rsp.

W systemie zarządzania biblioteką Koha w wersji 24.05 występuje podatność typu Cross-Site Scripting (XSS) w funkcji wyszukiwania OPAC. Niesanitizowane dane wprowadzone w polu wyszukiwania są odzwierciedlane w interfejsie historii wyszukiwania, co prowadzi do wykonania dowolnego kodu JavaScript w kontekście przeglądarki.

CloudClassroom-PHP Project v1.0 contains a SQL injection vulnerability via the viewid parameter. An attacker can exploit this flaw to execute unauthorized database queries.

In the Linux kernel for RISC-V with the xtheadvector extension, vector context save/restore is incorrect – only registers v0-v7 are handled properly, while v8-v31 are corrupted.

In the Linux kernel, a change setting TASK_SIZE_MAX to LONG_MAX to optimize access_ok() has been reverted. Addresses between TASK_SIZE and LONG_MAX, though not valid user addresses, were accepted by get_user_pages_fast(), causing issues (e.g., in futex). The fix restores the default TASK_SIZE, at the cost of performance.

In the Linux kernel NFSD, nfsd4_spo_must_allow() does not check if the request is a v4 compound. If not, examining cstate can yield undefined results.

In the Linux kernel MHI EP driver, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated pointer before the element is fully written, leading to data corruption.

W jądrze Linuxa rozwiązano podatność związaną z interfejsem i2c w kontekście odczytu blokowego SMBUS. Problem polegał na braku weryfikacji długości wiadomości, co mogło prowadzić do nieprawidłowego odczytu, gdy długość wiadomości wynosiła '0' lub była większa niż maksymalna dozwolona liczba bajtów.