CVE Catalog

A vulnerability in the Linux kernel's zram swap handling can lead to user processes being corrupted by unexpectedly receiving zeroed (invalid) data. This issue arises under CLONE_VM cloning, where one CPU may read zeroed data after another CPU has deleted a zram entry, creating a synchronization problem. The vulnerability has been addressed by modifying the swap handling to ensure that correct data is mapped to user space, although this may increase memory consumption.

A vulnerability in the Linux kernel's AQC111 USB driver has been identified, involving multiple out-of-bounds accesses in the RX fixup function. These accesses can be triggered by a malicious or defective USB device, leading to out-of-bounds reads and, on big-endian systems, out-of-bounds endianness flips. The vulnerability allows a packet to overlap the metadata array, causing data corruption in a cloned SKB that has already been processed by the network stack. Additionally, a crafted packet SKB can extend beyond its allocated tail, exposing out-of-bounds heap data as if it were part of the SKB's data.

A vulnerability in the Linux kernel's handling of the Renesas RPC interface has been addressed. The issue involved a memory leak of the flash platform device when registration failed during the probe process. This vulnerability could potentially lead to resource mismanagement or exhaustion.

A vulnerability in the Linux kernel's handling of memfd_secret files can cause a kernel panic when an attempt is made to grow the file's size using ftruncate. This issue arises because memfd_secret pages are not mapped through the direct map, rendering the address returned by page_address() ineffective. As a result, the normal truncation process, which involves zeroing out memory, fails and triggers a panic. The vulnerability affects Linux kernel versions prior to 5.17.0.

A kernel panic vulnerability has been identified in the Linux kernel's IPv6 forwarding function. This issue occurs when a packet is forwarded from an input interface that lacks an associated IPv6 device. The vulnerability was reproduced using traffic control commands that corrupted packet data on a specific virtual extensible LAN (VXLAN) interface.

A use-after-free vulnerability has been identified in the EP93XX clock subsystem of the Linux kernel. The issue arises in the 'ep93xx_clk_register_gate' function, where memory is accessed after it has been freed, potentially leading to undefined behavior.

A vulnerability in the Linux kernel's i2c subsystem has been addressed, which involved improper handling of device names. The issue arose because the function dev_set_name() was not properly checked for errors. If dev_set_name() failed, it could lead to a null pointer dereference when dev_name() was called. The vulnerability has been resolved by adding a check for the return value of dev_set_name() to prevent the null pointer dereference.

A memory corruption vulnerability has been identified in the Linux kernel's dm-integrity module. This issue arises when the 'tag_size' parameter is set to a value less than the actual digest size, causing dm-integrity to ignore part of the digest and write beyond the end of the 'ic->recalc_tags' array. The corruption occurs in the 'integrity_recalc' function, specifically within the 'integrity_sector_checksum' processing, where the 'crypto_shash_final' operation is applied.

A memory leak vulnerability has been identified in the Linux kernel's handling of AMD GPU metrics. The issue arises because memory allocated for the gpu_metrics_table in the renoir_init_smc_tables() function is not properly freed in the smu_v12_0_fini_smc_tables() function, leading to a potential memory leak.

A vulnerability in the Linux kernel's NTFS3 file system implementation has been addressed, which involved memory leaks occurring during error handling in the 'log_replay()' function. The issue arose because all error paths led to a common 'out' point where resources were properly freed, except for this particular path, causing leaks of several resources including 'log', 'ra', and 'log->one_page_buf'.

A vulnerability in the Linux kernel's handling of universal planes in the Direct Rendering Manager (DRM) can lead to a resource leak. The issue arises in the __drm_universal_plane_init() function, where a range check for the format_count parameter is currently positioned after the resource allocation. This oversight can cause the format_types array to be leaked and fail to properly unregister the mode object, resulting in a leak of the modeset identifier. By moving the range check to the beginning of the function, the vulnerability can be mitigated before allocating resources.

A memory leak vulnerability has been identified in the Linux kernel's AMD graphics driver. The issue arises in the 'renoir_init_smc_tables' function, where memory is allocated for the 'gpu_metrics_table' but not properly freed in the 'smu_v12_0_fini_smc_tables' function. This oversight can lead to a potential memory leak.

A vulnerability in the Linux kernel's virtio GPU driver can lead to a NULL pointer dereference. This issue arises in the 'virtio_gpu_array_put_free()' function, which can be called with a NULL 'objs' parameter if the 'virtio_gpu_object_shmem_init()' function fails. Such a failure could occur due to fault injection, as reported by syzbot.

A use-after-free vulnerability has been identified in the JFFS2 filesystem implementation of the Linux kernel. This issue arises when the filesystem is mounted and an error occurs while scanning the erase blocks. The error handling process improperly manages memory related to extended attributes, leading to a use-after-free condition. This vulnerability can be exploited to read freed memory, potentially causing undefined behavior or allowing for further exploitation.

A memory leak vulnerability has been identified in the Linux kernel's Venus video decoder component. The issue arises in the 'venus_helper_alloc_dpb_bufs()' function, where an error in the ID allocation process can lead to an early return without releasing previously allocated buffers. This flaw has been addressed by moving the buffer deallocation from the error-checking phase of the DMA allocation to a common failure path, ensuring that all allocations are properly released in case of an error.

A memory leak vulnerability has been identified in the Linux kernel's Landlock sample, specifically within the path list management. The issue arises in the 'sandboxer.c' file, where the 'path_list' variable is allocated memory in the 'parse_path()' function but is never properly freed, leading to a potential memory leak.

A use-after-free vulnerability has been identified in the Linux kernel's media subsystem, specifically within the Davinci VPIF driver. This issue arises because the driver allocates and registers two platform device structures during the probe phase, but fails to deregister them when the driver is unbound. As a result, the device structures, which are managed by the device resource management system, are freed by the driver core after the remove() function returns, leading to a use-after-free condition. The vulnerability has been addressed by adding the missing deregistration calls to the remove() callback and ensuring that the probe function fails on registration errors. It is important to properly release the platform device structures using a designated release callback to prevent resource leaks, such as lingering device names.

A null pointer dereference vulnerability has been identified in the Linux kernel's video framebuffer device (fbdev) subsystem, specifically within the smscufx driver. The issue arises in the 'ufx_usb_probe' function, where the framebuffer color map allocation can fail. If this happens, the error handling routine attempts to destroy the framebuffer modelist, which has not been properly initialized, leading to a null pointer dereference.

A vulnerability in the Linux kernel's RPM power domain management can lead to a null pointer dereference. This issue arises because the allocation function 'devm_kcalloc' may fail, leaving 'data->domains' as a null pointer. If this null pointer is later dereferenced, it can cause a crash. The vulnerability has been addressed by adding a check for null allocations, ensuring that -ENOMEM is returned without manually releasing data if the allocation fails.

A vulnerability in the Linux kernel's ASoC (ALSA System on Chip) component can lead to a null pointer dereference. This issue arises when the 'codec_dai' variable, which is derived from the card's DAI (Digital Audio Interface) link, is accessed without proper validation. If the DAI link's 'num_codecs' is zero, 'codec_dai' becomes null, causing an out-of-bounds error. The vulnerability is triggered during the registration of sound cards, a process invoked by various platforms.

A vulnerability in the Linux kernel's udmabuf implementation has been identified, where improper validation of user-supplied page count data can lead to a general protection fault. The issue arises because the page count is calculated from arguments provided by the user. If a user creates a udmabuf with a list size of zero, the resulting page count will also be zero. This condition causes the kmalloc_array() function to return a null pointer, leading to a general protection fault. The vulnerability has been addressed by adding validation to ensure the page count is greater than zero before passing it to kmalloc_array().

A memory leak vulnerability has been identified in the Linux kernel's Host1x component. The issue arises in the 'host1x_remove()' function, which lacks a necessary call to 'host1x_channel_list_free()' for proper memory management. This omission has been addressed by adding the missing call, similar to the existing error handling in the probe function.

A vulnerability in the Linux kernel's handling of PCIe clock sources can lead to a kernel panic. This issue arises because the clock source for 'pcie0_rchng_clk_src' is improperly configured, causing a NULL pointer dereference in the clock management code. The vulnerability has been addressed by correctly setting the clock parent data to include the necessary 'XO' reference, preventing the associated kernel oops and subsequent crash.

A use-after-free vulnerability has been identified in the Linux kernel's block layer, specifically within the Budget Fair Queueing (BFQ) I/O scheduler. This issue arises from a crash triggered by a commit that was intended to enhance queue merging but inadvertently introduced the use-after-free bug. Although the problematic commit was reverted, the reversion did not address the root cause of the issue. The vulnerability has since been resolved by a separate commit that corrects the underlying problem.

A vulnerability in the Linux kernel's media staging component, specifically within the Zoran driver, has been identified. The issue arises from an incorrect calculation of buffer indices when a certain condition is met, leading to a NULL pointer dereference. This vulnerability has been addressed by correcting the buffer calculation and adding a safeguard to prevent similar issues in the future.

A memory leak vulnerability has been identified in the Linux kernel's media staging area, specifically within the Zoran video device driver. The issue arises in the initialization function for the ZR36057 video device, where certain code can be optimized and reorganized into separate functions. This change not only improves code readability but also addresses the memory leak associated with the video device management.

A vulnerability in the Linux kernel's IR Toy component was introduced by improper memory management, specifically freeing memory before handling an error condition. This flaw could lead to a memory leak during error processing.

A buffer overflow vulnerability has been identified in the Linux kernel's Nvidia framebuffer (nvidiafb) driver. The issue arises from the use of 'strcpy' to copy names into a fixed-size buffer, potentially allowing for an overflow if the names exceed 48 characters. Although initial concerns suggested a possible overflow, a review of the function's call sites indicated that such an overflow was unlikely. The vulnerability has been addressed by replacing 'strcpy' with 'strscpy', which prevents the overflow by ensuring that the copied string does not exceed the buffer's capacity.

A vulnerability in the Linux kernel's Cirrus framebuffer driver can lead to a divide-by-zero error. This issue arises because the driver does not properly validate the 'pixclock' value. When 'pixclock' is zero, the driver attempts to round it up to derive a frequency close to the maximum allowed, which can cause a division error. This vulnerability was reported by Syzkaller.

A vulnerability in the Linux kernel's handling of the early shadow page table for PowerPC architecture has been addressed. The issue arose because the shadow's page table was not properly updated when the Page Table Entry (PTE) Resident Page Number (RPN) Shift was 24 and the Page Shift was 12. This discrepancy led to both false positives and false negatives in the Kernel Address Sanitizer (KASAN) checks. The vulnerability was resolved by correcting the logic that manages the early shadow page entries, ensuring accurate memory tracking and KASAN functionality.

A use-after-free vulnerability has been identified in the Linux kernel's KVM component, specifically within the TDP MMU (Two-Dimensional Page Table Memory Management Unit) handling for x86 architecture. The issue arises when unmapping a range of guest frame numbers (GFNs), as KVM fails to properly invalidate all roots, particularly during mmu_notifier callbacks. This oversight can lead to references being held to freed pages, causing use-after-free errors and other related problems.

A double free vulnerability has been identified in the Linux kernel's UBIFS (Unsorted Block Image File System) component. This issue arises during the rename whiteout operation, where the 'whiteout_ui->data' is allocated memory that gets freed twice. The vulnerability occurs if the space budget fails for the rename whiteout operation, leading to a double free condition. The first free happens manually, but the second free occurs automatically when the inode is being processed, causing memory corruption.

A deadlock vulnerability has been identified in the Linux kernel's UBIFS file system, specifically during concurrent operations of renaming whiteout files and writing back inode data. This issue causes hung tasks as the rename process waits for the writeback to complete, while the writeback process is stalled, leading to a deadlock situation.

A read out-of-bounds vulnerability has been identified in the Linux kernel's UBIFS (Unsorted Block Image File System) module. The issue arises in the function 'ubifs_wbuf_write_nolock()', which improperly handles buffer lengths that are not aligned to eight bytes. This misalignment can lead to the function accessing memory outside the intended bounds, potentially causing a slab-out-of-bounds error. The vulnerability can be triggered during normal write operations, where the unaligned length is not correctly managed before writing to the log-structured file system.

A vulnerability in the Linux kernel's UBIFS (Unsorted Block Image File System) has been identified, where the reference count of a page is not properly incremented after the page is marked as private. This oversight can lead to a kernel bug during page migration, as the migration process may incorrectly assume that the page is not in use by any other processes. The issue arises because the UBIFS file system fails to increase the page reference count after setting the private flag, causing a race condition between different processes that manage page references.

A race condition vulnerability has been identified in the Linux kernel's UBI (Unsorted Block Image) subsystem, specifically within the character device ioctl operations. This vulnerability creates a use-after-free condition, which can be exploited to cause memory corruption. The issue arises from a concurrency problem between two functions that handle UBI device management: 'ctrl_cdev_ioctl', which is responsible for attaching and detaching UBI devices, and 'ubi_cdev_ioctl', which manages UBI volumes. The race condition occurs because 'ctrl_cdev_ioctl' can modify UBI device states while 'ubi_cdev_ioctl' is concurrently accessing them, leading to a double-free vulnerability when UBI volumes are removed. The problem was introduced by a previous commit that altered the timing of UBI device availability, allowing for this unsafe concurrency.

A vulnerability allowing out-of-bounds writes has been identified in the Linux kernel's ath5k wireless driver. This issue arises in the 'ath5k_eeprom_read_pcal_info_5111' function, where the index can exceed the expected range, leading to memory corruption. The vulnerability was discovered through fuzzing, which revealed that when certain conditions are met, the index can go beyond the limit of available data curves, causing a write operation to an invalid memory address. This out-of-bounds write could be exploited to manipulate memory, potentially leading to arbitrary code execution or other malicious outcomes.

A vulnerability has been identified in the Linux kernel's PowerPC memory management that involves spinlock recursion in the 'change_page_attr()' function. This issue arises from a modification intended to safely handle concurrent accesses, which inadvertently reintroduced recursive locking. The recursion can lead to deadlocks, as indicated by kernel logs showing a spinlock recursion error on CPU#0.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's ARM DaVinci DA850 EVM configuration. This issue arises when booting the multi_v5_defconfig in QEMU under the palmetto-bmc machine, leading to a kernel panic. The problem occurs in the 'da850_evm_config_emac()' function, where the 'emac_pdata' pointer is NULL. This pointer is only populated on DaVinci machines, but the function is called on all machines during the device initialization process. As a result, the system encounters a NULL pointer dereference at a specific virtual address, causing an internal error.

A broken authorization vulnerability has been identified in Tenable Identity Exposure versions 3.77.8 and earlier. This vulnerability allows any authenticated user to download IOA script and configuration files, provided the URL for these files is known.

A credential disclosure vulnerability exists in Tenable Identity Exposure versions through 3.77.8, allowing administrators to extract stored SMTP account credentials due to a lack of encryption. This vulnerability could be exploited by accessing the application with administrative privileges and retrieving the unencrypted credentials.

A vulnerability in HCL MyCloud has been identified, characterized by improper access control that allows unauthenticated users to escalate privileges. This vulnerability could lead to unauthorized information disclosure and create opportunities for server-side request forgery (SSRF) and denial-of-service (DoS) attacks.

A SQL injection vulnerability has been identified in Seacms versions through 13.3. The issue resides in the admin_type_news.php file, allowing attackers to manipulate SQL queries and potentially access or modify database information.

A SQL injection vulnerability has been identified in Seacms versions prior to 13.3. The issue resides in the admin_pay.php file, allowing attackers to manipulate SQL queries and potentially access or modify database information.

A SQL injection vulnerability has been identified in Seacms versions through 13.3, specifically within the admin_zyk.php file. This vulnerability allows attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification.

A SQL injection vulnerability has been identified in Seacms versions through 13.3, specifically within the admin_reslib.php file. This vulnerability allows for the manipulation of SQL queries, potentially leading to unauthorized data access or modification.

A SQL injection vulnerability has been identified in Seacms versions through 13.3, specifically within the admin_paylog.php file. This vulnerability allows for unauthorized manipulation of SQL queries, potentially leading to unauthorized data access or modification.

A SQL injection vulnerability has been identified in Seacms versions through 13.3, specifically in the admin_collect.php file. This vulnerability allows authenticated attackers to exploit the database.

A SQL injection vulnerability has been identified in Seacms versions through 13.3. The issue resides in the admin_collect_news.php file, allowing attackers to manipulate SQL queries and potentially access or modify database information.

A SQL injection vulnerability has been identified in the JoomShopping component for Joomla, specifically in versions 1.0.0 prior to 1.4.3. This vulnerability allows authenticated administrators to execute arbitrary SQL commands in the country management area of the backend, using the 'ordering' parameter.