CVE Vulnerability Catalog

In the Linux kernel, the tracing module's trace_module_add_events() function ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers(). If event registration fails, it can lead to a use-after-free.

In the Linux kernel, the scsi_debug module's resp_report_zones() function has an underflow vulnerability in alloc_len calculations, which on 32-bit systems can lead to an out-of-bounds write and kernel panic.

In the Linux kernel, the SCTP module's sctp_assoc_add_peer() function increments the 16-bit transport_count, which can wrap to zero after adding 65,536 unique peers. This can lead to an out-of-bounds write in SCTP diagnostics (sock_diag).

In the Linux kernel, the s390/qeth module lacks a CAP_NET_ADMIN check for private ioctls (SIOCDEVPRIVATE), allowing unprivileged users to invoke these commands.

A use-after-free vulnerability was found in the Linux kernel's Open vSwitch module. The issue occurs when attaching a newly created meter: attach_meter() can make the meter visible to other CPUs but still fail afterwards. On failure, ovs_meter_cmd_set() frees the meter without waiting for RCU readers, leading to use-after-free.

In the Linux kernel, in the i2c: imx driver, a problem was found where the hrtimer was not canceled before clearing the slave pointer. In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts, but a pending interrupt might have already started the hrtimer. If the hrtimer fires after slave is set to NULL, it can lead to use-after-free or NULL pointer dereference. The fix cancels the hrtimer and waits for it to complete before clearing the slave pointer.

In the Linux kernel, the peak_usb driver for CAN bus fixed a double free of the transfer buffer in peak_usb_start() on URB submit error. The buffer is freed explicitly by kfree(buf) and then again by usb_free_urb() due to the URB_FREE_BUFFER flag, leading to a double free.

In the Linux kernel, the drm/vc4 graphics driver fixed a bug where BPOS was set to the whole binner BO size instead of the overflow slot size. This allows the PTB to write tile lists outside the intended area, leading to memory corruption by GPU DMA, GPU hangs, and system crashes.

In the Linux kernel, the drm/vc4 graphics driver added zeroing of the Tile State Data Array (TSDA) before each BIN job. Previously, binner slots were reused without clearing, which could cause the PTB to act on stale data and lead to GPU hangs.

In the Linux kernel, the drm/panthor graphics driver added rejection of firmware sections with oversized data. Previously, the data size to copy was not validated against the allocated section size, which could lead to heap buffer overflow and massive out-of-bounds zeroing of kernel memory.

In the Linux kernel, the drm/panthor graphics driver added validation of firmware interface structure sizes. The iface_fw_to_cpu_addr() function only checked that the MCU virtual address points inside the shared section, but did not check that the entire structure fits, which could lead to out-of-bounds accesses.

In the Linux kernel, the amdgpu driver has a use-after-free vulnerability in amdgpu_dpm_get_pp_table(). The function returns a pointer to the power table after dropping the mutex, and a concurrent pp_table write can free the memory during the copy, leading to use-after-free. The fix copies data into caller-provided storage while holding the mutex.

In the Linux kernel, the amdgpu display driver has a divide-by-zero vulnerability in calculate_mcache_setting when the viewport has zero area. This causes a kernel panic and potential underflow on num_mcaches. The fix changes the function to return bool and adds guards to reject the mode when values are zero.

In the Linux kernel, the amdkfd driver has a uint32_t overflow vulnerability in EOP ring buffer size alignment. A user-supplied size of 0xFFFFF001 wraps to 0, bypassing the size check and allowing acceptance of any BO. This can lead to out-of-bounds writes and GPU faults.

In the Linux kernel, the amdkfd driver has a race condition in kfd_criu_checkpoint_events(). The counting and walking of events are not protected by event_mutex, which can lead to out-of-bounds writes or use-after-free. The fix holds the mutex during both operations.

In the Linux kernel, the vmwgfx driver has a vulnerability where the DRAW_PRIMITIVES header size is not validated before division. A small header size causes unsigned subtraction to wrap, leading to an out-of-bounds read. The fix rejects undersized headers.

In the Linux kernel, the vmwgfx driver has a vulnerability where the DMA command body size is not checked against the suffix pointer. This can cause the suffix pointer to underflow and overwrite verified fields of a previous command, enabling a TOCTOU attack. The fix rejects the command if the body is too small.

In the Linux kernel, the drm/xe driver's exec IOCTL did not wait on kernel fences for external BOs, potentially causing a race and memory corruption during moves. The fix adds kernel fence dependencies for all objects locked by the exec.

Apache Struts is vulnerable to uncontrolled resource consumption. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.

Apache Struts is vulnerable to uncontrolled resource consumption. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. Applications that do not collect violation reports are not affected.