CVE Vulnerability Catalog

In the Linux kernel, a bug in the order of stopping perf sampling during do_exit() caused crashes when accessing userspace after its teardown. The fix reorders operations to stop perf before mm destruction and hardens PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER.

In the lan743x network driver for PCI1xxxx devices, EEPROM and OTP sizes have been fixed. Maximum OTP size is 8 Kb and EEPROM 64 Kb. Size definitions and returned EEPROM length are adjusted per device, preventing out-of-bounds read/write.

In the amd-pmf driver (platform/x86/amd), memory allocations have been changed to device-managed to prevent a double free when smart PC setup fails. Previously, dev->buf was freed but not set to NULL, leading to a second free in amd_pmf_remove().

A vulnerability in ETSI Open-Source MANO (OSM) versions before 14.0.3, 15.0.2, and in 16.0.0 and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users component.

The Apwide Golive 10.2.0 Jira plugin is vulnerable to Server-Side Request Forgery (SSRF) via the test webhook function. An attacker can exploit this function to send requests to internal network resources.

In the NFC NCI UART driver in the Linux kernel, there is a vulnerability where tty->disc_data is set before successful NCI device opening. This can lead to use of an invalid pointer if the device starts sending data before initialization completes.

A vulnerability has been identified in the Squashfs filesystem in the Linux kernel that may lead to a 'shift-out-of-bounds' error. The issue occurs when two processes attempt to mount the Squashfs filesystem on the same device simultaneously, resulting in incorrect block size settings.

In the virtio-net driver in the Linux kernel, a bug was found in the frame length check within the buf_to_xdp function for XSK (XDP Socket). For the first buffer, the frame length was incorrectly compared with a value including vi->hdr_len, potentially exceeding the allocated chunk size.

W jądrze Linuxa naprawiono podatność związaną z pobieraniem bloków danych WMI w wywołaniach sysfs. Wprowadzono sprawdzenie poprawności tych bloków przed dereferencją ich zawartości.

In the Linux kernel, a double put of a request was found in the netfs subsystem. If a netfs request finishes during the pause loop, the IN_PROGRESS flag is cleared, but the subsequent wait loop may release the reference again, leading to incorrect behavior.

In genirq/irq_sim (interrupt simulation), work context pointers initialization has been fixed. Using kmalloc() instead of kzalloc() caused pointers to contain random data, leading to invalid dereferencing.

In nvmet (NVMe over Fabrics target), a memory leak related to bio integrity (bi_integrity) has been fixed. Since a kernel version requiring bio_uninit after bio_init, nvmet did not call bio_uninit for inline bios, causing continuous memory leak (kmalloc-128 slab).

In the mtk-sd driver, a failed DMA mapping does not stop the operation, leading to use of previous DMA settings and potential memory corruption. The fix stops the request after msdc_prepare_data() fails.

In the SCSI target subsystem (Linux kernel), a NULL pointer dereference bug in core_scsi3_decode_spec_i_port() has been fixed. In the error path, when dest_se_deve is not set, core_scsi3_lunacl_undepend_item() is called with NULL, leading to kernel panic.

In the Linux kernel, the spi-qpic-snand driver has a vulnerability due to out-of-bounds memory access. The issue arises from allocating BAM transaction structures before knowing the actual number of codewords for the NAND chip, causing memory corruption, swiotlb mapping failures, and system panics.

In the Linux kernel, the anon_inode_make_secure_inode() function was exported and a secretmem LSM bypass was fixed. The patch ensures proper security context for anonymous inodes used by KVM guest_memfd and removes the S_PRIVATE flag that bypassed LSM/SELinux checks in secretmem.

In the GPIO regulator in the Linux kernel, an out-of-bounds access to the drvdata::gpiods array was found. Memory was allocated for only one pointer, while config::ngpios can be greater than 1. The fix allocates sufficient memory.

A race condition in the Linux NFSv4/pNFS driver affects the NFS_LAYOUT_DRAIN bit. Tasks waiting on this bit in pnfs_update_layout() may never wake up even though plh_outstanding is zero, causing system hangs.

In ACPICA, calling a method with fewer arguments than expected leads to use-after-free. The fix makes ACPICA refuse to evaluate the method if arguments are missing.

In the Btrfs filesystem, during log replay, an iteration bug in extrefs processing causes an uninitialized victim_name.len field, leading to invalid memory access and potential security issues.