CVE Vulnerability Catalog

In the Linux kernel's drm/amdgpu driver, amdgpu_amdkfd_clear_kfd_mapping() assumes kfd_dev has a fully populated node array, which is not true when KFD initialization fails. This can lead to NULL pointer dereference during GPU reset. The fix requires the KFD initialization flag.

In the Linux kernel's drm/amdkfd driver, the EOP ring size calculation can underflow in logarithmic calculations, theoretically leading to incorrect configuration. The fix changes the formula to order_base_2(q->eop_ring_buffer_size / 8).

In the Linux kernel's drm/amdkfd driver, the EOP ring size calculation using ffs can underflow, theoretically leading to incorrect configuration. The fix changes the formula to ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4).

In the Linux kernel's SMB client, clean_demultiplex_info() does not cancel reconnect work, which can lead to use-after-free when the demultiplex thread exits. The fix cancels reconnect work before freeing the server.

In the Linux kernel's SMB client, the rlist in TCP_Server_Info is incorrectly initialized (NULL pointers instead of self-referencing), causing list_empty() to always return false and list_add() to dereference NULL. Additionally, a race can occur when cifs_signal_cifsd_for_reconnect() is called concurrently. The fix initializes the list correctly and synchronizes access.

In the Linux kernel SMB client, cifs_try_adding_channels() keeps a pointer to the next interface (niface) across the unlocked window while iface_lock is dropped during cifs_ses_add_channel(). A concurrent interface refresh can free that list entry, leading to a use-after-free when reading iface->rdma_capable/is_active and niface->iface_head.next.

In the Linux kernel SMB client, when an RDMA connection is established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g. kthread_create() error), the error path frees tcp_ses without first destroying the smbd_connection. This leaks the smbd_connection resource.

In the Linux kernel SMB client, receive_encrypted_standard() handling of compound encrypted frames has several issues: next_buffer is not cleared after assignment to server->bigbuf (use-after-free risk), pdu_length is not updated to the decrypted plaintext size, next_cmd values smaller than MID_HEADER_SIZE are not rejected, and there is an integer overflow in the upper bound check.

In the Linux kernel SMB client, move_smb2_ea_to_cifs() has an insufficient while (src_size > 0) loop condition that allows iteration when the remaining size is too small for a complete smb2_ea_info structure. This leads to out-of-bounds reads of ea_name_length and ea_value_length fields.

In the Linux kernel SMB client, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual server reply length when snapshot_array_size is smaller than GMT_TOKEN_SIZE. A short reply makes ret_data_len exceed retbuf size, and the subsequent copy_to_user() reads past the end of the buffer.

In the Linux kernel SMB client, cifs_query_reparse_point() only checks that the start pointer is within the response (start >= end) but does not verify there is enough space for the fixed 8-byte header of the reparse_data_buffer structure. If a server provides a DataOffset leaving less than 8 bytes, reads of ReparseTag and ReparseDataLength occur out-of-bounds.

In the Linux kernel SMB client, receive_encrypted_standard() leaves server->total_read at the full decrypted frame size while walking sub-PDUs of a compound encrypted frame. This causes cifs_handle_standard() to pass the full size to smb2_check_message(), allowing truncated non-last sub-PDUs to bypass length validation and leading to out-of-bounds reads in smb2_get_data_area_len().

A vulnerability in the Linux kernel's DRM/TTM subsystem causes swapped-out resources to remain in their bulk_move range, leading to a use-after-free and system crashes. The bug manifests after hibernation or during process exit/reboot.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority and contains no vulnerability description.

The vulnerability allows an unauthenticated attacker to bypass the login lockdown mechanism in versions up to and including 2.17.

Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation. This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.

The BEAR plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can gain unauthorized access to functions or data.

The cloak library from version 0.1.0-pre is vulnerable to bit-flipping attacks on encrypted data. AES-256 encryption in CTR mode lacks integrity checking (MAC), allowing an attacker with write access to the encrypted store to modify data so that it decrypts to a chosen value.

The Fluent Forms Pro Add On Pack plugin versions up to 6.2.13 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. This means an attacker without logging in can inject malicious scripts into the page.

The vulnerability in cloak_ecto and cloak libraries involves using a password hash with insufficient computational effort. An attacker who holds hashed values and the configured secret can brute-force low-entropy plaintexts much faster than configured.