CVE Vulnerability Catalog

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206 involving hard-coded credentials in the /etc/shadow file. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The exploit is publicly available.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0, where SQL injection in /edit_teacher.php via the ID argument can lead to SQL injection. The attack can be performed remotely, and the exploit is publicly disclosed.

In @fastify/multipart, a multipart form-data parser for Fastify, versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects during processing. An unauthenticated client can repeat this to cause persistent disk consumption and denial of service. The issue is fixed in version 10.1.1.

In @fastify/multipart, versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client aborts the connection before sending the terminating boundary, saveRequestFiles() never settles, and the temporary file is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in version 10.1.1.

In @fastify/jwt, a JSON Web Token plugin for Fastify, versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret. Applications using different keys for different authorization domains may accept tokens signed with the global key on routes requiring another key, allowing an ordinary authenticated user to cross a key-based trust boundary. The issue is fixed in version 10.2.2.

A vulnerability in the Linux kernel leads to unbounded recursion in the memory free path of the slab allocator. Cycles between obj_exts arrays of different kmalloc caches can cause stack overflow and system crash.

In the Linux kernel, the Thunderbolt subsystem has a use-after-free vulnerability in XDomain delayed work during disconnect. The tb_xdp_handle_request() function may queue delayed work after tb_xdomain_remove() cancels it synchronously but before the xdomain object is freed, leading to work executing on freed memory. The fix adds an xd->removing flag and synchronization via xd->lock.

In the Linux kernel, the dmaengine idxd driver has a cleanup issue after fdev setup failure in idxd_cdev_open(). The failed_dev_add and failed_dev_name paths drop the file-device reference while holding wq->wq_lock, which can deadlock if put_device() triggers idxd_file_dev_release() trying to reacquire the same lock. Additionally, these paths fall through to later ctx cleanup labels that may operate on freed context. The fix moves idxd_wq_get() before possible failure and unlocks wq->wq_lock before put_device().

In the Linux kernel, a deadlock was found in the btrfs subsystem for zoned filesystems between metadata writeback and transaction commit. The issue occurs when metadata writeback holds the zoned_meta_io_lock and then tries to activate a zone, which requires waiting for a transaction commit that needs the same lock. The fix releases the lock before calling btrfs_zone_finish_one_bg() and re-acquires it afterwards.

In the Linux kernel, the keys subsystem has an out-of-bounds read vulnerability in keyring_get_key_chunk(). For description-level chunks, the read pointer is advanced by level * sizeof(long) past the inline prefix but only the prefix is bounds-checked, allowing reads past the allocated memory for long key descriptions.

In the Linux kernel, netfilter nf_tables has a use-after-free vulnerability due to a global rhltable for nft objects. This allows access to objects being dismantled from other network namespaces, potentially leading to use-after-free.

In the Linux kernel, netfilter xt_hashlimit has a vulnerability due to uninitialized access to the burst field in the union of the dsthash_ent structure when XT_HASHLIMIT_RATE_MATCH mode is used by fewer than two rules referring to the same hashtable. Additionally, this mode is rejected for revisions less than 3.

In the Linux kernel, RDS/TCP has a use-after-free vulnerability in rds_tcp_laddr_check(). The function obtains a pointer to an IPv6 interface, drops the RCU lock, and then uses that pointer in ipv6_chk_addr(), which can lead to reading freed memory if the interface is deleted.

In the Linux kernel's nexthop module, there is a race condition during nexthop replacement. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk the f6i_list without holding the nh->lock, while IPv6 RTM_NEWROUTE/RTM_DELROUTE operations mutate that list under the same lock. This leads to a use-after-free condition that could be exploited for code execution or system crash.

In the Linux kernel's nexthop module, there is a race condition in the nh_rt_cache_flush() function, which walks the f6i_list without holding the nh->lock. IPv6 route add/delete operations mutate that list under the lock and can free fib6_info entries, leading to a use-after-free. An attacker could exploit this to escalate privileges or cause a system crash.

In the Linux kernel's libiscsi (SCSI) library, there is a vulnerability involving stale-data leak into the sense buffer. The iscsi_scsi_cmd_rsp() function copies sense data from a SCSI response, but the bounds check does not account for the 2-byte sense length prefix. A target can return a response with datalen equal to senselen, causing a read up to two bytes past the data and copying them into the sense buffer, which is returned to userspace.

In the Linux kernel, the ath12k driver had an out-of-bounds error in ath12k_mac_dp_peer_cleanup(), where indexing the free_ml_peer_id_map bitmap used peer_id with the ATH12K_PEER_ML_ID_VALID bit (BIT(13)) set, leading to writes beyond the bitmap memory (256 bits). This caused memory corruption and exhaustion of ML peer IDs.

In the Linux kernel, the hwmon nzxt-smart2 driver had an output buffer not aligned to DMA boundaries, which on architectures with non-coherent caches (e.g., ARM, MIPS) led to memory corruption during DMA mapping. The fix aligns the buffer to ARCH_DMA_MINALIGN.

In the Linux kernel network stack, when peer entry allocation (inet_getpeer_v4/v6) fails, functions sending ICMP/NDISC Redirects sent packets without rate limiting, potentially leading to a packet storm. The fix prevents sending redirects when peer is NULL.

In the Linux kernel, the hwmon nct6775-core driver for the NCT6116 chip has weight register arrays with only 3 elements, but the driver iterates up to 5 PWM channels, leading to out-of-bounds reads (KASAN) and invalid hardware register access. The fix extends the arrays with zeroed fields to mark unsupported registers.