CVE Vulnerability Catalog

In the Linux kernel, KVM nVMX does not service local TLB flushes when a nested VM-Enter fails. This can lead to a missed TLB flush if L1 changes L2's VPID, then does a failed VM-Enter followed by a successful one.

In the Linux kernel, KVM for arm64 has an issue with incorrectly handling the end of the VA space during TLB invalidation. The range comparison does not account for address rollover, which can lead to failed TLB invalidation for the last page/block in the TTBR1 VA space.

In the Linux kernel, a KVM arm64 issue exists in VNCR invalidation. When one vcpu invalidates the VNCR TLB while another vcpu is faulting in the same page, a stale TLB entry can be inserted. The fix extends invalidate_vncr_va() to update the mmu_invalidate_seq counter so the fault is replayed.

In the Linux kernel, the global VNCR mapping counter in KVM arm64 was removed. This counter was used to decide whether a TLB invalidation was needed, but it had flaws: checking it could cause missed TLB invalidations, and an L1 vcpu invalidating its own TLB would not invalidate the VNCR pseudo TLB. Since it failed to provide required guarantees, it was removed entirely.

In the Linux kernel, the decode_range_tlbi() helper used for S1 range-based TLB invalidation in KVM arm64 omitted the required sign extension of the virtual address. This could lead to incorrect invalidation range calculation. The fix adds the missing sign extension and guards against PA bit overflow when used for S2 invalidation.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_ls_reject_iocb() function lacks qpair locking when allocating and sending NVMe LS reject, potentially leading to concurrent access and corruption of the request ring state, causing duplicated or dropped commands.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_async_iocb_timeout() could call sp->done() twice when the response ISR completed the same handle before the timeout handler. This led to a write into a freed stack frame (use-after-free).

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() did not bound rsp_info_len from the target's FCP response, causing par_sense_len underflow and an out-of-bounds sense-data read when a hostile or buggy target reported a large value. This could leak adjacent heap memory into the sense buffer.

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

In Apache Airflow Keycloak provider, the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. The lack of an allowlist allows credentials of another application to be valid Airflow login credentials.

In Apache Airflow Keycloak provider from version 3.3, the user identity is taken from the signed Airflow session token, but the Keycloak access and refresh tokens used for authorization come from separate, unauthenticated cookies and are never checked for consistency with the identity. This allows pairing foreign tokens with one's own session.

An unauthenticated P4Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. By crafting a malicious packet during session initiation, an attacker can obtain complete administrative control over the switch.

In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.

In the Linux kernel, ext4_read_inline_dir() has an out-of-bounds read. Directory iteration uses a larger extra_size than the actual inline_size buffer, allowing a dirent header to be read past the end of the buffer, potentially leading to information disclosure or crash.

In the Linux kernel, xfrm6_input_addr() has an out-of-bounds write due to an off-by-one depth check. When sp->len reaches XFRM_MAX_DEPTH, writing to sp->xvec[sp->len++] goes past the array, potentially causing a system crash.

In the Linux kernel, fs/ntfs3's ntfs_read_ea() does not verify that the EA record's ef->size is large enough to hold the record's name and value. A crafted NTFS image can set a small ef->size with a large elength, causing an out-of-bounds read past the allocated buffer and leaking kernel heap memory to userspace via getxattr().

A vulnerability in the Linux kernel's ISOFS filesystem related to zisofs compression has been found. The zisofs_uncompress_block() function returns an incorrect byte count for empty blocks, ignoring the poffset, leading to an out-of-bounds read of the page array when handling compressed files on ISO9660 images. A crafted Rock Ridge "ZF" record can trigger this bug during a normal file read.

In the Linux kernel's KVM for arm64, pgshift_level_to_ttl() does not handle negative levels (e.g. -127 indicating S1 MMU disabled), incorrectly computing the TLB invalidation size as 0. The fix handles negative levels and makes ttl_to_size() return SZ_1G when no valid TTL is present.

In the Apache Airflow FAB provider, changing a user's password via the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker holding a copy of the victim's session cookie retains full access after the password change.

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce (rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow.