CVE Vulnerability Catalog

A vulnerability in the Linux kernel's VXLAN driver arms the ageing timer on a down interface due to a missing netif_running() check. This leads to a use-after-free when the interface is deleted, as the timer is still queued on freed memory. An unprivileged user can trigger this in a new user and network namespace.

In the Linux kernel, in virtio vsock, the RX, TX, and event workers read their virtqueue before checking the run flag, which can lead to use of a deleted queue after device suspend/resume.

A vulnerability in the Linux kernel's vsock/virtio driver allows the RX worker to refill the queue after teardown, leading to a use-after-free and kernel panic. The issue occurs when work is queued after virtio_vsock_vqs_del() has been called.

In the Linux kernel, in TLS, when the sk_msg ring is full, the full_record flag is not set, which can lead to pointer wrap and overwriting entries, then to a system crash (NULL pointer dereference).

A use-after-free vulnerability was found in the TIPC module of the Linux kernel. The tipc_node_link_down() function reads the link pointer before acquiring the lock, which can lead to dereferencing freed memory during concurrent link deletion. The issue was fixed by moving the pointer read inside the lock.

In the Linux kernel KVM/SVM subsystem, a synchronization issue was found with the owner and mirror lists. Concurrent move and copy operations of encryption context can corrupt the list or cause an incorrect kvm_put_kvm() call.

In the Linux kernel eventfs subsystem, a use-after-free vulnerability was found in eventfs_remove_rec(). During recursive removal, the list iterator may read a pointer after memory is freed, leading to security issues.

In the Linux kernel eventfs subsystem, an issue was found with using the list field as an RCU head and missing memory barriers. This could lead to reading corrupted data during iteration over the children list.

In the Linux kernel hwmon thermal driver, a commit was reverted that introduced a use-after-free in the error path of thermal_add_hwmon_sysfs(). The fix restores the removed validation.

In the Linux kernel ptp_ocp driver, an out-of-bounds read was found in the board ID field from EEPROM. The field is not NUL-terminated, which could lead to reading memory beyond the buffer.

A vulnerability was found in the Linux kernel's ring-buffer mechanism, where ring_buffer_swap_cpu() can swap per-CPU buffers during an ongoing write operation. The committing counter may temporarily drop to zero, allowing an unsafe buffer swap and leading to inconsistent state and RB_WARN_ON. The fix replaces the counter check with current_context checks, which are set at the start of the operation and remain valid throughout.

In the Linux kernel, the rt6_route_rcv() function has an incorrect validation of the Route Information option length (RFC 4191). Due to an off-by-one error, the kernel can read up to 8 bytes past the end of the option, potentially leaking data from adjacent memory into routes visible to userspace.

In the Linux kernel, the fscrypt_ioctl_set_policy() function uses nop_mnt_idmap instead of the mount's idmap when checking file ownership. On filesystems supporting idmapped mounts (e.g., ext4, f2fs), this can lead to incorrect denial of access to the actual owner or granting access to an unrelated caller.

A vulnerability in the Linux kernel's PSI (Pressure Stall Information) mechanism for cgroups was found. A race between psi_schedule_rtpoll_work() and psi_trigger_destroy() can lead to re-arming a timer after its deletion, resulting in a use-after-free when the timer fires on a freed group structure.

In the Linux kernel, the IMA mechanism lacks immediate reset of action cache flags (IMA_DONE_MASK) during truncate operations. The fix instantiates file_truncate and path_truncate hooks to force re-collection, re-measurement, re-audit, and re-appraisal on next access.

In the Linux kernel, the bpf_get_fsverity_digest() function has an issue with dynptr assumptions. Although the BPF verifier and dynptr abstraction ensure memory validity, they do not guarantee stability of contents. The function could crash if arg->digest_size was concurrently modified. The fix uses the known-good value hash_alg->digest_size and widens types to u64.

A use-after-free vulnerability has been found in the Linux kernel's BPF sockmap mechanism during send verdict processing. The issue occurs because tcp_bpf_send_verdict() copies a pointer to the destination socket without taking a reference, which can lead to use of freed memory under concurrent access. An attacker could exploit this flaw to escalate privileges or cause a system crash.

The Joomla extension Fabrik before version 4.7.2 contains an unauthenticated stored XSS vulnerability. The handling of user-supplied input in the jsactions feature leads to a stored XSS vector.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to disclose the list of database tables and the table prefix. The ajax_tables method of the elements model permits listing arbitrary database tables including their columns.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to list arbitrary directories on the server. The onAjax_getFolders method of the elements model permits arbitrary directory listings.