CVE Vulnerability Catalog

W jądrze Linuxa rozwiązano podatność dotyczącą systemu plików btrfs, która polegała na wywoływaniu błędu (BUG) w przypadku nieoczekiwanego typu opóźnionej referencji w funkcji run_one_delayed_ref(). Zamiast tego, możliwe jest zwrócenie błędu i zapisanie komunikatu o błędzie.

In the Linux kernel drm/amd/display driver, the check for whether the DMUB HW lock is needed differs from the check for whether it must be unlocked. This causes a hang when the HWSS fast path is used on ASICs without FAMS support.

In the Linux kernel, a bug in the btrfs subsystem causes a kernel BUG during read repair when the filesystem flips to read-only due to an ENOSPC error in a critical path. The btrfs_repair_io_failure() function contains an ASSERT() that assumes the filesystem is not mounted read-only, leading to a crash when this condition is violated.

In the Linux kernel, the amdgpu DRM driver's VCN v2.5 teardown path attempts to release the VCN poison IRQ even though it was never enabled on a virtual function (VF). This triggers a kernel warning and call trace during driver deinitialization.

In the Linux kernel, a flaw was fixed in mm/vmalloc where freeing KASAN shadow pages during vmalloc cleanup caused prolonged CPU holding. With CONFIG_PAGE_OWNER enabled, each page free triggered expensive stack unwinding under RCU read lock, leading to RCU stalls and potential OOM when processing large purge_list entries.

A Linux kernel issue in kexec was fixed where kexec_load_purgatory() derived image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check could match more than once and trigger a WARN. The fix derives the entry section from the purgatory_start symbol when present, keeping the e_entry fallback.

In the Linux kernel's ext4 filesystem, a vulnerability causes a kernel panic when mounting a partition with quota and project features enabled. The issue arises from using an uninitialized per-CPU counter during block bitmap validation when the DOUBLE_CHECK macro is defined. The fix moves the initialization of the counters before the block allocator initialization.

A Linux kernel issue was fixed where DRM_IOCTL_MODE_CREATEPROPBLOB allowed userspace to allocate arbitrary-sized property blobs in kernel memory without accounting them to the allocating process's memory cgroup. This let unprivileged users trigger unbounded kernel memory consumption and potentially system-wide OOM. The fix marks the allocation with GFP_KERNEL_ACCOUNT so memory is charged to the caller's memcg.

go-git is a pure Go git implementation library. Prior to versions 5.18.0 and 6.0.0-alpha.2, it may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Prior to version 2.2.0, the /api/auth/login endpoint in Sync-in Server contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time.

In the Linux kernel, the drm/tests shmem tests did not hold the GEM object's reservation lock around vmap/vunmap operations. The tests used vmap_locked variants, causing kernel warnings in drm_gem_shmem_helper.c. The fix acquires and releases the reservation lock around vmap/vunmap and exports the new helpers only for Kunit tests.

In the Linux kernel, the spi: cadence-quadspi driver has a bug in the probe() error path that can cause duplicate clock disables. This occurs when the device tree (DT) description for attached flashes is missing or broken, triggering warnings from the clock subsystem. The fix moves flash parsing to the controller property parsing stage.

In the Linux kernel, DRM shmem tests called the madvise operation without holding the GEM object's reservation lock, causing warnings in drm_gem_shmem_madvise_locked(). The new helper drm_gem_shmem_madvise() is exported only for Kunit tests.

In the Linux kernel, the rtw88 Wi-Fi driver for the 8822b chip allows rtw8822b_set_antenna() to be called from userspace while the chip is powered off. In that case, reading RF registers returns an unexpected value, triggering a WARNING in rtw8822b_config_trx_mode(). The fix calls rtw8822b_config_trx_mode() only when the chip is powered on.

In the Linux kernel, DRM shmem tests called the purge operation without holding the GEM object's reservation lock, causing warnings in drm_gem_shmem_purge_locked(). The new helper drm_gem_shmem_purge() is exported only for Kunit tests.

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users can exceed allocation limits configured for their accounts/domains. This can be used to degrade infrastructure resources and lead to denial of service. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later.

The CloudStack Backup plugin has improper access logic in versions 4.21.0.0 and 4.22.0.0. Any authenticated user with access to specific APIs can create new VMs using backups of any other user.

The CloudStack Backup plugin has improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Any authenticated user with access to specific APIs can list backups from any account, but cannot see the contents.

The latest demo version of the Cradle eCommerce platform contains an open redirection vulnerability in the login form endpoint. The 'returnUrl' parameter allows redirection because the application accepts a URL as a parameter without proper validation, enabling redirection of users from the legitimate website to external pages.

A vulnerability in BC-LTS and BC-FJA libraries from Legion of the Bouncy Castle Inc. on X86_64 with AVX and AVX-512f extensions on Linux. The issue involves program files gcm128w, gcm512w, gcm128w.C, and gcm512w.C.