CVE Vulnerability Catalog

In the Linux kernel's remoteproc subsystem, a bug was found where ida_free is called for an ID that was not previously allocated by ida_alloc. The issue occurs in the rproc_alloc function when an error happens before ida_alloc is called, and then in the release path (rproc_type_release) an attempt is made to free an unallocated ID, triggering a kernel warning.

W systemie zarządzania rezerwacjami AtaksAPP występuje podatność na atak typu Cross-Site Scripting (XSS) z powodu niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych. Problem dotyczy wersji przed 4.2.3.

A flaw in the romfs module of GRUB2 allows integer overflow during buffer size calculation based on user-controlled filesystem geometry parameters. A crafted filesystem can cause a smaller-than-expected buffer allocation, leading to out-of-bounds writes in grub_romfs_read_symlink() and potentially arbitrary code execution.

A buffer overflow vulnerability was found in the jfs filesystem module of GRUB2. The grub_jfs_lookup_symlink() function writes beyond the allocated buffer when a specially crafted jfs filesystem is used. This can corrupt critical internal GRUB data and potentially lead to arbitrary code execution.

A flaw in GRUB2's reiserfs module allows integer overflow during symlink buffer size calculation, leading to heap out-of-bounds write and potential arbitrary code execution.

A stack overflow vulnerability was found in the BFS file system support in GRUB2. A crafted BFS filesystem image can trigger an uncontrolled loop, causing GRUB2 to crash.

A flaw was found in grub2 when reading tar files. The function allocating a buffer for the file name does not properly check for integer overflows, which can lead to a heap out-of-bounds write. This allows an attacker to bypass secure boot protections.

An integer overflow vulnerability was found in the BFS file system driver in GRUB2. When reading a file with an indirect extent map, GRUB2 fails to validate the number of extent entries, leading to a heap out-of-bounds read.

A flaw in the OpenSSH package causes each received ping packet to allocate a pong packet in memory, stored in a queue until key exchange completes. A malicious client can send such packets continuously, leading to uncontrolled memory consumption on the server.

A vulnerability in Minut M2 with firmware version #15142 allows extraction of cryptographic keys from internal flash. Physically proximate attackers can inject modified firmware into any other Minut M2 product via USB.

In the Linux kernel, a vulnerability was found where a potential deadlock can occur during sysfs ->store() calls. The issue arises when store callbacks (e.g., update_nr_requests, wbt, scheduler) allocate memory with GFP_KERNEL, which may trigger direct reclaim and deadlock while the queue is frozen. The fix marks the context with GFP_NOIO around sysfs ->store().

In the Linux kernel, a vulnerability was found where the ->enable callback is called unconditionally without checking if it is implemented. Some drivers (e.g., ptp_s390, ptp_vclock, ptp_mock) do not define this callback, leading to NULL pointer dereference.

A deadlock vulnerability (ABBA) was found in the Linux kernel's block layer when modifying queue limits via sysfs. The issue occurs when a user changes a limit (freezing the queue) while a device driver (e.g., SCSI sd) simultaneously revalidates limits, causing mutual blocking.

In the Linux kernel's HNS3 network driver, a vulnerability was found causing an Oops when unloading hclge and hns3 drivers in parallel. The issue occurs when hclge unload tries to disable SR-IOV for ae_dev nodes while hns3 unload removes those nodes, leading to memory corruption.

Stack-based Buffer Overflow in libmodbus v3.1.10 allows overflow of the buffer allocated for Modbus response if the function tries to reply to a request with unexpected length.

Wersje pakietu io.pebbletemplates:pebble od 0 do przed 4.1.0 są podatne na zewnętrzną kontrolę nazwy pliku lub ścieżki za pomocą tagu include. Atakujący z wysokimi uprawnieniami może uzyskać dostęp do wrażliwych lokalnych plików, tworząc złośliwe szablony powiadomień, które wykorzystują ten tag do dołączenia plików takich jak /etc/passwd lub /proc/1/environ.

In the Linux kernel, a subsystem refcount leakage of the @block_class was discovered in the blkcg_fill_root_iostats() function. The function iterates over devices using class_dev_iter_(init|next)() but does not end the iteration with class_dev_iter_exit(), causing a refcount leak.

In the Linux kernel HID multitouch driver (mt_input_configured), the return value of devm_kasprintf() is not checked. This can lead to a NULL pointer dereference when memory allocation fails.

In the Linux kernel, the safesetid module lacked size validation for data written to sysfs. An attacker could send an oversized buffer, triggering a warning in kmalloc and potentially destabilizing the system.

In the Linux kernel, the int3472 driver for x86 platforms lacked a check for a NULL adev (ACPI device) pointer. This could theoretically occur when a user manually binds the driver to an i2c/platform device via sysfs, leading to a possible NULL pointer dereference in skl_int3472_get_acpi_buffer().