CVE Vulnerability Catalog

In the Linux kernel, the UDF filesystem has a vulnerability due to incorrect validation of the sparing table length. The function treats reallocationTableLen as a byte count, while it is actually a count of 8-byte entries, leading to out-of-bounds memory access.

In the Linux kernel, the AIX partition parser has a vulnerability due to missing bounds on the ppe array scan. The pp_count field from disk can be larger than 1016, leading to out-of-bounds read beyond the allocated buffer.

In the Linux kernel's isofs filesystem, a vulnerability was found in the handling of Rock Ridge symbolic links. An attacker can craft an ISO image that triggers an out-of-bounds read of up to 255 bytes of kernel memory, which is then copied to user space via readlink().

In the Linux kernel, the CAAM cryptographic driver has a vulnerability where sensitive key material is leaked via hex dumps in *_setkey() functions. Using print_hex_dump() without guard can expose keys in logs when CONFIG_DYNAMIC_DEBUG is enabled.

In the Linux kernel, the elliptic curve cryptography (ECC) implementation has a vulnerability due to a carry overflow bug in vli multiplication. The condition checking for overflow does not handle the case where r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and an additional carry exists from lower bits.

In the Linux kernel's pcrypt crypto subsystem, a bug was found where the original callback was not restored when falling back to direct AEAD invocation. As a result, an asynchronous completion could run the padata callback even though the request was never submitted to padata.

In the Linux kernel, the loongson-rng driver was removed due to multiple vulnerabilities, including lack of forward security and a use-after-free bug. The driver was unused and had no real purpose in the kernel.

In the Linux kernel's QAT (Intel) crypto driver, a synchronization bug was fixed where iterations over the service_table list were not protected by the service_lock. This could lead to list corruption or a use-after-free bug during concurrent service registration/removal operations.

In the Linux kernel's QAT (Intel) crypto driver, a bug was fixed where the lengths of CRT components (p, q, dp, dq, qinv) were not validated in qat_rsa_setkey_crt(). Overly long components could cause a DMA buffer overflow and memory corruption.

In the Linux kernel's perf/aux subsystem, a use-after-free vulnerability exists in map_range(). Two events sharing the same ring buffer can race between allocation and page mapping, leading to use of a freed physical page.

In the Linux kernel's tracing subsystem, an out-of-bounds read exists in glob matching. The regex_match_glob() function ignores field length and scans until a NUL byte, causing reads beyond buffer boundaries for non-NUL-terminated fields (e.g., dynamic char arrays in xfs tracepoints).

In the Linux kernel's NFSv4 client, an access authorization flaw exists for O_TRUNC operations. The nfs_open_permission_mask() function does not include O_TRUNC in the permission mask, allowing local file open with read-only mode and simultaneous truncation, violating POSIX.

In the Linux kernel's exfat filesystem, an out-of-bounds read/write exists in exfat_find_dir_entry(). When processing directory entries with short name fragments, the uniname pointer advances by a fixed amount while name_len grows slower, allowing writes beyond the p_uniname->name buffer.

In the Linux kernel's iommufd subsystem, a bug exists in iommufd_veventq_fops_read(). The bound check for the normal vEVENT path uses sizeof(hdr) instead of sizeof(*hdr), causing an undercount on 32-bit architectures and writing past the user-supplied buffer.

In the Linux kernel KVM for ARM64, a vulnerability was found due to missing clamping of used_lrs when copying vGIC state to the pKVM hypervisor. The host can provide a value exceeding the number of implemented list registers, leading to out-of-bounds access at EL2.

In the Linux kernel KVM for ARM64, a vulnerability was found due to not clearing __hyp_running_vcpu when copying vCPU context to the pKVM hypervisor. The host can provide a value that is then dereferenced at EL2.

In the Linux kernel KVM for x86, a vulnerability was found where fastpath userspace exits are handled before vendor-specific code runs. This can lead to missing operations such as flushing the PML buffer before returning control to userspace.

In the Linux kernel KVM guest_memfd component, a vulnerability was found where the memslot binding offset and size are treated as signed values instead of unsigned. This causes a false negative in overflow checking of offset+size against the file size, potentially allowing an absurdly large offset.

In the Linux kernel, a vulnerability in the svcrdma component causes threads waiting in svc_rdma_sq_wait() to hang indefinitely in TASK_UNINTERRUPTIBLE state during transport close. The lack of explicit wake-up prevents threads from checking the XPT_CLOSE flag, blocking svc_rdma_free() and resource release.

In the FPGA DFL-AFU driver, DMA mapping length from userspace via the DFL_FPGA_PORT_DMA_MAP ioctl is not validated. A large value can cause implicit truncation to int, leading to a buffer overflow.