CVE Vulnerability Catalog

In the s3c64xx SPI driver in the Linux kernel, a NULL pointer dereference occurs on driver unbind. A change moving DMA channel allocation from probe() to s3c64xx_spi_prepare_transfer() did not remove the corresponding deallocation from remove(). The fix drops the bogus DMA channel release from remove().

A bug was found in the Linux kernel's KVM for x86, where __kvm_apic_update_irr skips scanning IRR when PID.ON is set but PIR is empty. This triggers a false WARNING in vmx_check_nested_events() and causes unnecessary L2 VM-Enter/VM-Exit cycles.

In the Linux kernel, the PM domain (genpd) framework is missing a pm_runtime_disable() call when detaching virtual devices. This leaves runtime PM enabled for those devices, potentially causing critical errors like NULL pointer dereference or unnecessary performance state votes.

In the Linux kernel, the CAAM cryptographic driver's hash_digest_key() function uses print_hex_dump() to display HMAC keys, potentially leaking sensitive data when CONFIG_DYNAMIC_DEBUG is enabled. The fix changes this to print_hex_dump_devel(), which is safer.

A vulnerability was found in the Linux kernel's handling of page faults during EFI runtime calls. A change in FPU code (d02198550423) causes kernel_fpu_begin() to disable softirqs via local_bh_disable(), setting SOFTIRQ_OFFSET in preempt_count. This makes efi_crash_gracefully_on_page_fault() incorrectly treat the context as an interrupt, leading to a panic() instead of graceful EFI_ABORTED recovery, resulting in a hard system freeze.

In the txgbe driver for copper NICs with external PHY, a missing RTNL lock during PHY disconnection on module removal triggers an RTNL assertion warning in phylink_disconnect_phy().

In the Linux kernel, the QCOM LPG LED driver lacks an array bounds check when selecting high-resolution values. A 3-bit register field is used to index an array with only 5 elements, potentially causing out-of-bounds reads and setting incorrect values.

In the Linux kernel, the hugetlb module crashes during early boot if kernel command-line parameters (hugepages, hugepagesz, default_hugepagesz) are specified without the '=' separator. This passes NULL to hugetlb_add_param(), which dereferences it in strlen(), causing a system crash.

In the Linux kernel, the TPM driver's tpm_dev_release() function uses kfree() instead of kfree_sensitive() to free the auth structure containing sensitive cryptographic data (HMAC session keys, nonces, passwords). Other code paths use kfree_sensitive(), leading to inconsistency and leaving sensitive data in memory.

In the Linux kernel, the IIO ADMV1013 driver may leave the str variable uninitialized if device_property_read_string() fails. The code then calls strcmp(str, ...) on an uninitialized pointer, leading to a NULL pointer dereference.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the Imagination (powervr) DRM driver when updating the ftrace mask. The issue is caused by passing incorrect data to a debugfs entry, leading to a segfault and system crash.

In the Linux kernel, the AMDGPU driver on RDNA4 (GFX 12) cards lacks GDS, GWS, and OA memory. The function amdgpu_ttm_init_on_chip() is called with zero size, leading to drm_mm_init(mm, 0, 0) and triggering a DRM_MM_BUG_ON assertion, causing a kernel crash during amdgpu module load.

In the fabric-chaincode-java library (Hyperledger Fabric chaincode shim API) from version 2.3.1 to before 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with log access could recover the password and, if also obtaining the private key, impersonate the chaincode server.

A vulnerability in the cowlib library (from version 2.9.0 onward) involves improper neutralization of CRLF sequences in HTTP headers, enabling HTTP response splitting attacks. The cow_http_struct_hd:escape_string/2 function in cowlib only escapes \ and ", passing all other bytes through verbatim, creating an encoder/decoder asymmetry. An attacker can inject \r\n into the serialized header, allowing new headers to be added and potentially splitting the HTTP response.

OpenBullet2 up to version 0.3.2 on Windows has a credential disclosure vulnerability. A remote attacker can configure a proxy source with a UNC path pointing to an attacker-controlled server, causing the application to attempt SMB authentication and leak the NTLMv2 hash of the process user.

A flaw in the 389 Directory Server's Content Synchronization persistent search plugin causes unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Race conditions in plugin thread lifecycle can also cause crashes during connection teardown or shutdown.

In imvks786 student_management_system up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46, a vulnerability exists in the Student Deletion Endpoint (/see.php) due to improper authorization. Manipulation of the del argument leads to unauthorized access. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The product uses rolling release, so no version details are available. The project was informed but has not responded.

A weakness has been identified in imvks786 student_management_system up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46. An unknown function in the file /add.php of the Student Record Handler component is affected. Executing a manipulation can lead to improper access controls. The attack may be performed remotely. The exploit has been made public and could be used for attacks. The project uses a rolling release system, so version information is not disclosed. The project was informed but has not responded.

Flowise prior to version 3.1.2 does not strip the encryptedData field from API responses when fetching credentials with a credentialName filter. Without the filter the field is omitted, but with the filter it is not, leading to leakage of encrypted data.

Apache HTTP Server 2.4.67 and earlier has an Improper Privilege Management vulnerability that allows local .htaccess authors to read files with the privileges of the httpd user.