CVE Catalog

A vulnerability in the Linux kernel's NFS server implementation (NFSD) has been addressed. The issue arose in the SECINFO_NO_NAME decoding process, where the decoder initialized a variable after decoding another, leading to potential errors. If the XDR stream was truncated, the decoder would return an error before properly initializing the variable, causing it to hold outdated information from previous operations. This problem was exacerbated by a change that reduced the clearing of certain data structures between RPC calls, allowing stale data to interfere with the decoding process. The vulnerability could result in improper handling of NFS requests, potentially leading to data corruption or other unintended consequences.

A vulnerability in the Linux kernel's NFS server implementation can lead to a memory leak of POSIX Access Control Lists (ACLs). This issue arises in the handling of SETACL operations for NFSv3, where the ACL decoder can leave allocated ACLs dangling if an error occurs during processing. The leaked ACLs persist for the lifetime of the server, potentially leading to increased memory usage and degradation of server performance.

A vulnerability in the Linux kernel's NFS server component (nfsd) has been identified, specifically within the NFSv4 ACL handling of the file creation process. The issue arises because the function responsible for converting NFSv4 ACLs to POSIX format discards error messages without proper handling. When this conversion fails, the file is created without an ACL, yet the client is incorrectly informed that the operation was successful. This behavior contradicts established NFS standards, which require the server to reject unsupported attributes during file creation. Additionally, when the file creation process encounters an error after ACL attributes have been set, the function fails to release the allocated POSIX ACLs, causing a memory leak. This vulnerability can be exploited by clients that send invalid filenames along with ACL attributes, triggering the issue repeatedly.

A vulnerability in the Linux kernel's NFS server implementation can cause unbounded slab exhaustion. This issue arises in the 'nfsd4_create' function, where the handling of POSIX ACLs (Access Control Lists) is flawed. When a client sends a request that includes both standard ACL and POSIX default or access ACL attributes, the server overwrites certain ACL values without properly releasing the originals. This oversight leads to a memory leak of ACL objects with each request, causing repeated requests to exhaust system memory.

A vulnerability in the Linux kernel's NFSv4.0 implementation can lead to a memory leak of pre-allocated open owner objects. This occurs when the function find_or_alloc_open_stateowner() encounters an unconfirmed owner, releases it, and sets the owner variable to NULL. The function then allocates a new owner without first checking if the previous allocation was freed, causing the old allocation to be lost. This issue arises from a race condition where two NFSv4.0 OPEN threads with the same owner string are active, allowing a concurrent thread to insert a new unconfirmed owner into the hash, creating a repeatable leak under specific conditions.

A vulnerability in the Linux kernel's NFS server implementation can lead to data loss by failing to properly manage the write verifier during deferred writeback errors. When the NFS server's write verifier is not updated after a writeback error, clients may incorrectly assume their data is safely stored, leading to the unintentional loss of data that did not successfully write back. This issue arises because the NFS server's write verifier is not rotated in response to certain errors, causing clients to commit unstable write data without realizing it has not been properly saved. The vulnerability affects the NFS server in the Linux kernel stable tree.

A vulnerability in the Linux kernel's NFSv4 flexfiles implementation allows for a null pointer dereference due to improper handling of filehandle version counts. The issue arises in the 'ff_layout_alloc_lseg' function, which decodes the filehandle-version array count from the flexfiles layout body. The current code only rejects null counts, allowing a zero count to be interpreted as a valid pointer size, leading to a null pointer dereference. This can cause a kernel panic. The vulnerability has been fixed by adding a check to reject zero filehandle version counts before allocation, ensuring that at least one version is present.

A vulnerability in the Linux kernel's NFSv4/pNFS implementation can lead to a NULL pointer dereference. This issue arises in the 'nfs4_decode_mp_ds_addr' function, which processes network address data from a GETDEVICEINFO multipath-DS message. The vulnerability is present in the stable branch of the Linux kernel. When the 'r_addr' opaque data is zero-length, it causes the decoder to mishandle the input, leaving a buffer reference NULL. This flaw can be exploited by any pNFS-flexfile client connected to a compromised metadata server, leading to a kernel crash.

A heap out-of-bounds read vulnerability has been identified in the Linux kernel's ksmbd component, specifically within the smb_check_perm_dacl() function. This issue arises because the function validates the size of the Access Control Entry (ACE) header and limits the number of sub-authorities in Security Identifiers (SIDs) to a maximum value. However, it fails to ensure that the ACE size is sufficient to accommodate the specified number of sub-authorities before dereferencing them. An attacker can exploit this oversight by crafting an ACE that manipulates the SID revision and authority bytes, forcing the function to read beyond the allocated memory, potentially leading to memory corruption or information disclosure.

A use-after-free vulnerability has been identified in the Linux kernel's TCP-AO (TCP Authentication Option) implementation. This issue arises in the asynchronous key deletion process, where certain validity checks are bypassed. Specifically, if a key is added while the socket is closed and then the socket is transitioned to the LISTEN state, the deletion can inadvertently free memory that is still in use. This flaw allows for the dereferencing of invalid memory, potentially leading to undefined behavior.

A use-after-free vulnerability has been identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem. The issue arises in the 'fuse_try_move_folio()' function, which improperly manages the locking of requests. Specifically, the function unlocks a request before successfully completing its operation, allowing 'fuse_chan_abort()' to terminate the request and free associated I/O arguments. This can occur while the function is still processing those arguments, leading to a use-after-free condition. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's VEML6075 light sensor driver can lead to out-of-bounds array access. The issue arises because the VEML6075_CONF_IT register can return values that exceed the valid range, causing the driver to read reserved values that should never be accessed. This vulnerability has been addressed by adding a bounds check to ensure the index remains within the appropriate range, thereby preventing potential errors from faulty devices or bus corruption.

A vulnerability in the Linux kernel's IIO ADC driver for the TI ADS1298 has been addressed. The issue arose because the 'ads1298_pga_settings' array, which contains 7 elements, could be accessed out-of-bounds. The 'ADS1298_MASK_CH_PGA' mask can produce values from 0 to 7, and values of 7 or higher lead to invalid array access. The vulnerability has been fixed by adding a bounds check that returns an error if the index is out of range.

A race condition vulnerability has been identified in the Linux kernel's virtual console screen driver, specifically within the 'vcs_write' function. This issue arises when the 'console_lock' is temporarily released to transfer data from userspace, potentially causing the 'vc_data' pointer to become outdated. If the associated virtual console has been deallocated before the pointer is re-validated, a null pointer dereference occurs in the 'vcs_notifier' function, leading to a crash. The vulnerability affects the Linux kernel stable tree.

A use-after-free vulnerability has been identified in the Linux kernel's 8250_dw serial driver. This issue arises during the port registration process, specifically within the dw8250_probe() function. When the function attempts to register a clock notifier and the registration fails, it returns an error but does not unregister the previously registered 8250 port. As a result, the port slot remains occupied until the device is rebound or the system is rebooted. Furthermore, the driver data allocated with devm is freed while the port still references it through saved callbacks, creating a use-after-free hazard. The vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's ksmbd component allows for improper session validation in compound requests. The issue arises because the function smb2_check_user_session() does not correctly verify the session state for non-first operations in a COMPOUND request. Instead, it reuses the session from the first operation, validates only the SessionId, and returns 'valid' without checking if the session is actually valid. This oversight can be exploited by initiating a SESSION_SETUP with an NTLM Type-1 blob, which creates a new session in progress. When this session is used in a compound request with a TREE_CONNECT operation, it leads to a NULL-pointer dereference and a kernel Oops, causing a denial of service by disrupting the ksmbd worker for all clients.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Vidtv driver. This issue arises in the 'vidtv_mux_push_si' function, where the 'vidtv_mux_get_pid_ctx' call can return NULL. The function fails to check for this before accessing the continuity counter, leading to a general protection fault by dereferencing a near-NULL address. The vulnerability is rooted in the 'vidtv_mux_pid_ctx_init' function, which does not properly verify the return value of 'vidtv_mux_create_pid_ctx_once' for PMT section PIDs. If the allocation fails, the PID context is not created, yet the function indicates success. Consequently, the 'vidtv_mux_push_si' call receives NULL and crashes.

A use-after-free vulnerability has been identified in the Linux kernel's virtiofs implementation, specifically related to the handling of submount unmounting. This issue arises when the 'iput()' function is called from 'fuse_release_end()', potentially leading to a system crash (Oops) if the superblock has already been destroyed. Typically, this situation is avoided by ensuring that the number of waiting requests drops to zero before initiating the superblock shutdown. However, this mechanism only works for the final submount instance, as the wait counter is connection-specific rather than superblock-specific. The vulnerability can be exploited by reverting to synchronous release requests for the auto_submounts case, which currently affects virtiofs only.

A vulnerability in the Linux kernel's handling of buffer lists in the Renesas Input Video Control (IVC) driver can lead to concurrent modification issues. The vulnerability arises because the buffer list is managed with a spinlock, but the removal of buffers from the list can occur without holding the lock. This flaw allows for the possibility of the list being altered simultaneously from different contexts, potentially leading to undefined behavior or data corruption.

A vulnerability exists in the Linux kernel's handling of the OV8856 camera sensor's control initialization. When the process of adding control parameters fails, the control handler is not properly released, leading to a potential memory management issue. This vulnerability is present in the stable version of the Linux kernel.

A vulnerability in the Linux kernel's handling of color operation state blob properties has been addressed. This issue, present in the stable branch, involved memory leaks during the duplication, destruction, and reset of state operations. The color operation implementation did not adhere to the established reference pattern used for DEGAMMA and GAMMA blob properties, leading to improper memory management. The vulnerability has been fixed by introducing a new helper function to correctly manage blob references, ensuring proper reference counting and alignment with the established practices in the DRM subsystem.

A vulnerability in the Linux kernel's DRM/MSM component affects the GPU recovery process. The issue arises because the recovery worker does not always trigger a recovery when the GPU hangs, instead relying on the GPU to automatically sleep and resume with new work. This can lead to the GPU remaining in a hung state, causing timeouts. The vulnerability is present in the stable Linux kernel.

A vulnerability in the Linux kernel's AMD KFD (Kernel Fusion Driver) has been addressed by adding an upper bound check for the number of nodes in the 'kfd_ioctl_get_process_apertures_new' function. This vulnerability could potentially lead to issues by allowing a process to request more resources than available, causing unexpected behavior or resource exhaustion.

A vulnerability in the Linux kernel's AMD GPU VCE driver could lead to incorrect address patching in firmware. This issue arises when only one of the low or high address components is valid, potentially causing a bad address to be written. The vulnerability affects the stable version of the Linux kernel.

A vulnerability in the Linux kernel's AMDGPU driver related to the Graphics Address Remapping Table (GART) has been addressed. The issue arose because the GART Translation Lookaside Buffer (TLB) is flushed after unmapping but not after mapping. The function 'amdgpu_bo_create_kernel()' failed to zero-initialize the buffer, leading to a situation where writing a single Page Table Entry (PTE) could cause the TLB to speculatively load other uninitialized entries from the same cache line. These garbage entries could be misinterpreted as valid, and a subsequent write to another PTE in the same cache line might result in the GPU using a stale, invalid PTE from the TLB. This vulnerability affects several versions of the Linux kernel.

A vulnerability in the Linux kernel's memory management system has been addressed. The issue arose in the Virtual Memory Area (VMA) handling, specifically when the 'mmap_prepare' function was invoked from the 'mmap' hook of stacked drivers, such as overlayfs and shared memory. In these cases, the VMA pointer was not fully established and detached, leading to errors when attempting to unmap it. This problem was unnecessary, as the 'mmap' handler would already clean up the VMA on error. The vulnerability has been resolved by modifying the 'mmap_action_complete' function to properly manage VMA cleanup based on how the 'mmap' action is completed, ensuring that detached VMAs are not incorrectly unmapped.

A cross-site scripting (XSS) vulnerability has been identified in the itsourcecode Courier Management System, specifically in version 1.0. The issue arises in the file index.php, where user-supplied input through the 'page' parameter is not properly sanitized before being reflected in the output. This flaw allows remote attackers to inject and execute arbitrary JavaScript in the context of the victim's browser session. The vulnerability requires no authentication and can be exploited by tricking a user into clicking a malicious link.

A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The issue arises in the '/edit_schoolyr.php' file, where insufficient input validation of the 'id' parameter allows attackers to inject malicious SQL queries. This vulnerability can be exploited remotely, leading to unauthorized database access, data manipulation, and potential leakage of sensitive information.

A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The issue resides in the '/edit_subject.php' file, where the 'id' parameter is manipulated to inject malicious SQL queries. This vulnerability can be exploited remotely, without requiring authentication.

A vulnerability in the Linux kernel's IOMMU (Input-Output Memory Management Unit) handling can lead to issues with PASID (Process Address Space ID) attachment in nested domains that have dirty tracking enabled. The kernel does not support dirty tracking for nested domains attached to PASID, and it fails the attachment process if the parent domain is configured for dirty tracking. This oversight can result in the loss of dirty pages.

A vulnerability in the Linux kernel's RDMA/Ionic component allows for an unbounded read from the sysfs node description. The issue arises because the node description in the 'ib_device' structure is not guaranteed to be null-terminated. The core InfiniBand sysfs handler uses a format specifier that expects a null-terminated string, but the 'node_desc_store' function can write up to the maximum node description length without adding a null terminator. This flaw can be exploited by user space applications, as the Ionic hardware component supports modifying the node description.

A vulnerability in the Linux kernel's handling of ACR (Architectural Performance Monitoring) masks has been addressed. The issue stemmed from incomplete validation of user space ACR masks, which could inadvertently include indices from other ACR event groups. Additionally, an early return on encountering an invalid ACR mask caused subsequent ACR groups to be skipped, and the stale hardware ACR mask was not cleared before applying a new one. The vulnerability affected the Linux kernel stable tree.

A vulnerability in the Linux kernel's handling of Universal Disk Format (UDF) descriptors has been addressed. The issue arose because the function 'udf_read_tagged()' failed to properly verify the Cyclic Redundancy Check (CRC) when the descriptor's CRC length, plus the size of the tag structure, exceeded the block size. This oversight allowed a maliciously crafted UDF image to bypass CRC validation by setting an oversized CRC length, with the descriptor being accepted based only on a recomputable 8-bit tag checksum. The vulnerability has been fixed by rejecting such descriptors instead of accepting them silently.

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) has been addressed. The issue arose because the function 'f2fs_need_dentry_mark()' accessed nat_entry flags without proper synchronization with the checkpoint process. This lack of mutual exclusion could lead to an incorrect marking state for inode blocks. The problem was identified when a file was created, written, and synchronized, followed by a checkpoint write. Although the inode had been checkpointed, it still retained a specific flag indicating it needed a directory entry mark, creating an inconsistency. The vulnerability has been fixed by moving the dentry mark setting into the node writing function and protecting it with a lock to ensure proper synchronization.

A vulnerability in the Linux kernel's SELinux implementation was introduced by a change that moved the per-task AVC cache to the task's security structure. The vulnerability arises because the cache was incorrectly saving and reusing the audited vector from a previous permission check, rather than recalculating it based on the current permissions requested. This flaw meant that some permission checks, particularly directory write permissions following a cached directory search, were not properly audited. The issue has been fixed by ensuring that the auditing process accurately reflects the current permission requests and distinguishes between denied and allowed cases.

A vulnerability allowing unrestricted file uploads has been identified in SourceCodester Pizzafy Ecommerce System version 1.0. The issue arises in the 'save_settings' function within '/admin/admin_class_novo.php', where the 'img' argument can be manipulated to upload files without restriction. This vulnerability can be exploited remotely.

A security vulnerability allowing for an out-of-bounds write has been identified in Snap7 versions prior to 1.4.3. The issue arises in the TSnap7Peer::NegotiatePDULength function within the file src/core/s7_peer.cpp. The vulnerability is triggered by manipulating the PDULength argument, leading to an out-of-bounds write. This flaw can be exploited remotely, and a public exploit is available.

A vulnerability allowing improper authorization has been identified in jxxghp MoviePilot versions through 2.13.5. The issue resides in an unknown function within the Application API component, specifically in the file /jxxghp/MoviePilot. This vulnerability allows for remote exploitation.

A server-side request forgery (SSRF) vulnerability exists in 1Panel CordysCRM versions through 1.4.1. The issue is located in the IntegrationConfigService.java file, specifically within the getSqlBotSrc function. The vulnerability arises because the application improperly validates the appSecret parameter, allowing remote attackers to manipulate it and cause the server to make unauthorized requests to external or internal resources.

A server-side request forgery (SSRF) vulnerability has been identified in 1Panel CordysCRM versions through 1.4.1. The issue arises in the TokenService component, specifically within the handling of the mkAddress parameter. This vulnerability allows remote attackers to manipulate the mkAddress argument, causing the server to make unintended HTTP requests to external or internal addresses. The lack of proper validation or sanitization of the mkAddress parameter creates a risk of internal network reconnaissance, data leakage, or further attacks.

A reflected cross-site scripting vulnerability has been identified in Code-Projects Online Examination System version 1.0. The issue arises in the file account.php when the quiz page is accessed with specific URL parameters. The application fails to properly sanitize user input, allowing attackers to inject malicious scripts that are executed in the context of the user's browser session.

A path traversal vulnerability has been identified in Croogo CMS versions prior to 4.0.7. The issue arises in the Admin File Manager component, specifically within the FileManager::isEditable function of FileManager/src/Utility/FileManager.php. The vulnerability allows authenticated users to manipulate file paths, potentially leading to arbitrary file writes and, if the files are executed via PHP, remote code execution.

A vulnerability exists in Hunvreus Devpush versions up to 0.4.6 within the Storage Reset Failure Handler component. The issue arises in the reset_storage function located in app/workers/tasks/storage.py, where exceptional conditions are not properly managed. This flaw can lead to a misleading storage status, allowing old data to be incorrectly considered as cleared. The vulnerability is associated with a high complexity level, making exploitation challenging.

An authorization bypass vulnerability has been identified in the Guohongze Adminset application, specifically in versions up to 0.61. The issue resides in the delivery deployment endpoint, where the 'project_id' argument is manipulated, allowing users to initiate deployments for projects they do not have permission to access. This vulnerability can be exploited remotely.

A cross-site request forgery (CSRF) vulnerability has been identified in Geex-Arts Django-Jet versions up to 1.0.8. The issue arises in the OAuth Handler component, where an unknown function can be manipulated to execute a CSRF attack. This vulnerability can be exploited remotely, and the public availability of the exploit increases the risk of potential attacks.

An authorization vulnerability has been identified in Geex-Arts Django-Jet versions up to 1.0.8. The issue resides in the OAuth Credential Revoke Handler, where missing authorization allows for unauthorized revocation of credentials. This vulnerability can be exploited remotely, and a public exploit is available.

An authorization bypass vulnerability has been identified in Geex-Arts Django-Jet versions through 1.0.8, specifically within the Dashboard Module. The issue arises in the file jet/dashboard/views.py, where an unknown function fails to enforce proper authorization checks. This vulnerability allows staff users to access and modify other staff users' dashboard modules by manipulating the module's primary key. Additionally, the Google Analytics and Yandex Metrika credential revoke endpoints can be accessed without authentication or ownership verification. The vulnerability can be exploited remotely, and public exploits are available.

A vulnerability exists in Fantomas42 django-blog-zinnia versions through 0.20 within the Protected Entry Password Handler component. The issue arises in the file zinnia/views/mixins/entry_protection.py

A race condition vulnerability has been identified in Awesto Django-Shop versions through 1.2.4, specifically within the Purchase Stock Handler component. The issue arises from a non-atomic read-modify-write process in the checkout flow, allowing concurrent purchases of the last available unit to be processed simultaneously, leading to overselling. This vulnerability can be exploited remotely and is considered to have high complexity, although a public exploit is available.

A race condition vulnerability has been identified in Allegro Ralph versions prior to commit bcf65b994ef29fb3fc2e10b660e6288723d5209e. The issue arises in the Hostname Allocation Handler, specifically within the AssetLastHostname.increment_hostname function in src/ralph/assets/models/assets.py. The vulnerability allows for concurrent asset creations to receive duplicate hostnames, which can lead to incorrect asset attribution or automation errors. This issue has been publicly disclosed.