CVE Vulnerability Catalog

A vulnerability exists in the Linux kernel's svcrdma module (RPC-over-RDMA). A client can request a reply without providing a Write list or Reply chunk, causing the linearization function to copy past the end of the sc_xprt_buf buffer and corrupt adjacent slab memory. The oversized length is then stored in sc_sges[0].length and posted, causing the device to read beyond the mapped region.

In the Linux kernel svcrdma module, the RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim. xdr_count_read_segments() checks only 4-byte alignment and never compares the position against the received inline body length, so in the single-chunk path a position past the inline body underflows the tail length and exposes adjacent slab memory, while in the multi-chunk path overlapping chunks cause unsigned underflows and copies past the receive buffer.

In the Linux kernel's ocfs2 (o2dlm) subsystem, the DLM_MIGRATE_REQUEST handler trusted the peer-supplied name length (namelen) without bounding it. dlm_init_mle() then copied that many bytes into the fixed 32-byte mname[] array of an o2dlm_mle slab object, allowing a heap out-of-bounds write of up to ~215 attacker-controlled bytes.

In the Linux kernel, the ocfs2 dlm_mig_lockres_handler trusted the num_locks and lockname_len fields from a DLM_MIG_LOCKRES message without validation. This led to an out-of-bounds read (BUG_ON panic) and a heap out-of-bounds write when copying the lock name into a fixed 32-byte object. Any node in the domain could trigger this.

A vulnerability was found in the Linux kernel's ocfs2 module due to missing validation of directory-index entry counts when reading metadata. The functions ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() do not bound the de_num_used and de_count fields against the block capacity, allowing a crafted on-disk image to set them to 0xffff and cause an out-of-bounds read past the 4KB metadata block. The flaw is reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted.

In the Linux kernel, lockd's nlm_traverse_files() pins the current file with f_count++ across a mutex unlock but does not pin the saved next pointer. A concurrent nlm_release_file() can free next during the unlock window, and the iterator dereferences freed memory on the next loop step. The fix pins both files and releases them after the iteration.

In the Linux kernel, the nvme-tcp driver accepted C2HData based solely on blk_rq_payload_bytes() without also checking req->data_len. For REQ_OP_WRITE_ZEROES, which has no physical segments but a non-zero blk_rq_bytes(), this causes data to be copied into an uninitialized iterator, triggering a KASAN wild-memory-access in _copy_to_iter().

A use-after-free vulnerability exists in the Linux kernel's SCTP handling. A remote peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK chunks in a single packet, causing the association and its transports to be freed, after which the endpoint loop writes to freed memory. This occurs when the packet is processed from the socket backlog in task context.

In the Linux kernel, sctp_rcv() resolves the transport once per packet and keeps it in chunk->transport until processing completes. An authenticated ASCONF DEL-IP can remove and free that transport via RCU in the meantime, and a subsequent delayed SACK then reads the freed transport's state. This results in a use-after-free.

In the Linux kernel, detect_intel_iommu() did not include tboot in the conditions for requesting ACS, potentially causing a misconfiguration with ACS disabled while IOMMU is later forced on by tboot_force_iommu(). The fix adds a tboot check in detect_intel_iommu().

In the Linux kernel, xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size, allowing the copied frame to occupy the page tail needed by skb_shared_info. This causes the skb to overlap skb_shared_info or be placed beyond the allocated page, resulting in a KASAN slab-out-of-bounds in skb_gro_receive.

In the Linux kernel, a flaw exists in net/smc where the peer rkey counts in SMC-Rv2 LLC messages are not bounded. On links with a device having max_recv_sge == 1, smc_llc_save_add_link_rkeys() reads the v2 extension beyond the allocated buffer, causing a slab-out-of-bounds read. This occurs on every SMC-Rv2 link addition regardless of what the peer sends.

In the Linux kernel, smc_llc_srv_add_link() in the net/smc subsystem contains a use-after-free flaw. The add_llc pointer references a queue entry that is freed by smc_llc_flow_qentry_del() and then used by smc_llc_save_add_link_rkeys() on a link without a shared v2 receive buffer. The issue has been fixed.

In the Linux kernel's net/smc subsystem, three connection state flags (killed, freed, out_of_sync) are single-bit bitfields sharing one byte of struct smc_connection. Because they are not written under a common lock, storing one flag performs a read-modify-write that corrupts the neighbouring bits, causing a race and inconsistent connection state.

A vulnerability exists in the Linux kernel's IPv6 segment routing (SRv6) handling. The decap_and_validate() function fails to reset the IPv6 control block (IP6CB) after decapsulation, allowing an unprivileged user to trigger a slab-out-of-bounds read in ip6_protocol_deliver_rcu().

In the Linux kernel, the iaa crypto driver has a bug during hardware decompression. On a hardware analytics error, the decompress path retries through the software fallback, which writes req->dst while it is still mapped as DMA_FROM_DEVICE. With SWIOTLB active, the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result.

A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.

GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php.

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera.