CVE Vulnerability Catalog

A vulnerability has been identified in the Linux kernel in the convert_chmap_v3() function, which may lead to a potential endless loop due to a lack of validation of the descriptor length. A proper size check has been added to prevent this situation.

A vulnerability in the Linux kernel related to the mana_ib_create_qp_rss() function has been fixed, which could lead to a leak in mana_ib_cfg_vport_steering().

A vulnerability has been identified in the Linux kernel affecting the ASoC: qcom: q6apm-lpass-dai component. The issue allows multiple graph openings for the playback path, leading to memory leaks.

A vulnerability related to illegal access to the WX_CFG_PORT_ST register by VF has been fixed in the Linux kernel. Attempting to read this register during VF initialization leads to a system hang.

A vulnerability has been identified in the Linux kernel related to a memory leak in the XIVE code for the PowerPC architecture. The issue occurs during the allocation of MSI-X vectors for an NVMe device, where the xive_irq_data structure is not properly freed.

A vulnerability has been identified in the Linux kernel SMB client related to improper initialization of the security descriptor buffer. A change in the data structure caused the reserved field to remain uninitialized, leading to errors when attempting to use chmod.

A vulnerability has been identified in the Linux kernel related to the lack of mutex initialization in Thunderbolt registration. Improper mutex management leads to a NULL dereference, potentially causing system crashes.

A vulnerability has been identified in the Linux kernel within the rtnl_fill_vfinfo function that may lead to stack information leakage. The ifla_vf_broadcast structure was not initialized before use, resulting in the disclosure of up to 26 bytes of unallocated kernel stack memory.

A vulnerability has been identified in the Linux kernel related to checking nEPT/nNPT in slow hypercall flushes. The issue lies in the incorrect checking of guest mode, which may lead to improper functioning of address translation features.

A vulnerability has been identified in the Linux kernel related to the incorrect checking of the data size of the event message buffer response in the IPMI interface. The issue is that the size check occurs later, which may lead to improper processing of empty messages returned by some BMCs.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns a faulty reference to the uctx pointer in the ocrdma_copy_pd_uresp() function during error handling, which can lead to system crashes.

A vulnerability in the Linux kernel related to the mana_destroy_wq_obj() function in queue object management has been resolved. The issues pertain to bugs in the error unwind flow concerning the WQ table.

A vulnerability has been identified in the Linux kernel that leads to a null pointer dereference in the papr_hvpipe_dev_create_handle() function. A change introduced by commit 6d3789d347a7 caused the src_info pointer to be reused for adding it to the global list after calling retain_and_null_ptr(src_info), leading to a kernel panic.

A vulnerability has been identified in the Linux kernel related to a memory leak in the ulpi_register() function. If errors occur in ulpi_of_register() or ulpi_read_id() before device_register() is called, allocated memory is leaked.

In the Linux kernel, the IPMI SI driver has a vulnerability where a message allocation failure can leave the driver in an incorrect state. In such cases, the driver does not return to normal operation, potentially causing issues with hardware management.

In the Linux kernel, a race condition was found in the eventfs filesystem during remount operations. The eventfs_set_attrs() function recursively traversed the child list without proper locking, leading to use-after-free and data races.

In the Linux kernel, a vulnerability was found in SELinux where socket permission helpers (sock_has_perm and nlmsg_sock_has_extended_perms) directly dereferenced sk->sk_security, assuming the SELinux socket blob is at offset zero. In stacked LSM configurations, this assumption is invalid, potentially causing the wrong blob to be read and invalid SID and class values to be fed into AVC checks.

Podatność typu Relative Path Traversal w interfejsie REST API Apache Ignite pozwala uwierzytelnionym użytkownikom na odczyt dowolnego pliku na serwerze za pomocą polecenia 'cmd=log' oraz odpowiednio skonstruowanej ścieżki logu. Problem dotyczy wersji Apache Ignite od 2.0.0 do 2.17.0.

GitLab naprawił problem w GitLab CE/EE, który dotyczył wszystkich wersji od 18.9 przed 18.10.7, 18.11 przed 18.11.4 oraz 19.0 przed 19.0.1. W określonych warunkach zablokowany token dostępu do projektu mógł nadal uzyskiwać dostęp do prywatnych zasobów z powodu nieprawidłowego egzekwowania autoryzacji.

The PDF Embedder plugin for WordPress up to version 4.9.3 is vulnerable to sensitive information exposure via the enqueue_block_assets function. Authenticated attackers with contributor-level access or above can extract configuration data, including license keys if the premium add-on is installed.