CVE Vulnerability Catalog

In the dwmac-tegra driver for MGBE controllers in the Linux kernel, a vulnerability was found where the IOMMU Stream ID (SID) is hardcoded to MGBE0's SID instead of being read from the device tree. This causes incorrect SID to be written to the MGBE_WRAP_AXI_ASID0_CTRL register for other controllers (e.g., MGBE1), leading to softirq timeouts and kernel panics.

In the Linux kernel, a vulnerability in the gpio-virtuser module was found due to missing cleanup of the lookup table after a failed virtual GPIO device probe. This leads to inability to retry the device and memory leaks.

In the Linux kernel, a vulnerability in the netdev module was found where NAPI IDs were not fully namespaced. The netlink interface must ensure that a NAPI instance belongs to the same network namespace as the genl socket owner.

W jądrze Linuxa naprawiono podatność związaną z obliczaniem adresu vmemmap w modelu sparse vmemmap. Problem polegał na tym, że przy inicjalizacji struktur stron, obliczany adres wirtualny mógł znajdować się poniżej VMEMMAP_START, co prowadziło do błędów w zarządzaniu pamięcią.

In the Linux kernel, in the RDMA/bnxt_re driver, there is an issue with the maximum number of SGEs for work requests. For Gen P7, 13 SGEs are reported, but the WQE software structure can only hold 6, leading to traffic failures and system crashes.

In the Linux kernel, in the gve driver, the XDP XMIT NDO callback lacks a guard to check for the existence of dedicated XDP queues. When no XDP program is installed or the interface is down, a divide-by-zero error or NULL TX pointer access can occur.

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 store web pages locally, allowing another system user to read them.

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 do not restrict domains in CORS, potentially allowing an attacker to perform privileged actions and retrieve sensitive information.

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 use weaker than expected cryptographic algorithms, potentially allowing an attacker to decrypt highly sensitive information.

WriteFreely w wersji do 0.15.1, gdy używa MySQL, pozwala lokalnym użytkownikom na odkrycie poświadczeń poprzez odczytanie pliku config.ini.

In the Linux kernel's io_uring/eventfd subsystem, a vulnerability was found where io_eventfd_do_signal() called from an RCU callback may directly free the io_ev_fd structure instead of deferring it to another RCU grace period. This could lead to use-after-free or other memory errors.

Nieprawidłowe ustawienia uprawnień w aplikacjach mobilnych (com.transsion.carlcare) mogą prowadzić do ryzyka wycieku informacji.

W module Shiprocket 3/4 dla OpenCart odkryto krytyczną podatność. Dotyczy ona nieznanej funkcjonalności pliku /index.php?route=extension/shiprocket/module/restapi w module REST API, gdzie manipulacja argumentem x-username prowadzi do wstrzyknięcia SQL.

In the Linux kernel, a vulnerability was found due to overly strict assertions (WARN_ON) when file handle encoding fails. These assertions are incorrect because encoding can fail for various reasons, and main users (nfsd, name_to_handle_at) are already prepared to handle errors.

A race condition was discovered in the Linux kernel when printing the CPU map (cpumap). Modifying the CPU mask during the print operation causes a mismatch in formatted string length, leading to a warning and potential error in kvasprintf. The fix caches the cpumask into a temporary variable before printing.

In the Linux kernel, in the HNS3 network driver, there is an issue with auto-enabling the misc interrupt vector. There is a time window between enabling interrupts and initializing the service task, during which an interrupt can trigger a warning and potentially incorrect behavior.

In the Linux kernel HNS3 network driver (hclge), hclge_fetch_pf_reg() does not account for the TQP BAR space split into two segments (TQPs 0-1023 and 1024-1279), leading to out-of-bounds BAR memory access when the number of TQPs exceeds 1024.

A vulnerability in the hns3 network driver for HIP08 devices causes a kernel crash. HIP08 devices do not register PTP devices, so the hdev->ptp pointer is NULL, but the transmit path still attempts to set hardware timestamp info with the SKBTX_HW_TSTAMP flag, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability in the netfilter conntrack module allows the hashtable size to exceed INT_MAX during resize, triggering a WARN_ON_ONCE in __kvmalloc_node_noprof() due to missing __GFP_NOWARN flag. This issue is limited to the init_netns namespace.

In the Linux kernel, a vulnerability was found in the sch_cake network scheduler due to an underflow of per-host bulk flow counters, leading to out-of-bounds memory access. Bounds-checking helper functions were added to prevent such issues.