CVE Vulnerability Catalog

A vulnerability in the Linux kernel related to the SDMA block has been fixed, which caused a NULL pointer issue in buffer functions when the SDMA block was not enabled.

In the Linux kernel, a vulnerability exists in the drm/amdgpu/ras module where, in the rare event that the EEPROM contains only invalid address entries, the RAS data allocation is skipped. This leads to a NULL pointer dereference in amdgpu_ras_sysfs_badpages_read, causing a kernel oops and leaving negative values in the free space counter.

In the Linux kernel, in the bcm_vk_read() function of the bcm_vk driver, the entry pointer may be NULL, and when rc is set to -EMSGSIZE the code accesses entry->to_h_msg, entry->usr_msg_id and entry->to_h_blks, causing a null pointer dereference.

In the Linux kernel, the probe function of the ti_fpc202 driver had a potential memory leak related to an unreleased device node reference. The fix uses for_each_child_of_node_scoped() to automatically release the reference when the loop scope ends.

In the Linux kernel, the mtk-smi memory driver has a device reference leak. The reference taken when looking up the SMI device during common probe is not dropped on late probe failure (e.g. probe deferral) or on driver unbind.

In the Linux kernel, the mtk-smi memory driver has a device reference leak during larb probe. The reference taken when looking up the SMI device is not dropped on late probe failure (e.g. probe deferral) or on driver unbind.

In the Linux kernel, the MHI 'auto_queue' feature for IPCR DL channels was dropped because it introduced a race between client drivers and the MHI stack. The race could cause dl_callback to be invoked before the client driver's structures were initialized, leading to a NULL pointer dereference and boot failures on Qcom X1E80100 CRD machines. The QRTR driver now manages RX buffers manually.

W jądrze Linuxa rozwiązano podatność związaną z zarządzaniem pamięcią w funkcji rtw_set_supported_band(). Uproszczono kod poprzez zastosowanie alokacji pamięci zarządzanej przez urządzenie, co również naprawia wyciek pamięci w funkcji rtw_register_hw().

In the Linux kernel, the most_register_interface() function in the most subsystem did not correctly release resources on early failure (before registering the device), returning an error code immediately and leaking the memory allocated for the interface. The fix initializes the device early via device_initialize() and calls put_device() on all error paths, and switches from device_register() to device_add().

In the Linux kernel, the hfsplus filesystem conversion to the new mount API introduced a bug in the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc() but before hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info data, it is leaked. The fix frees sb->s_fs_info in hfsplus_kill_super().

A flaw was found in Keylime that allows an attacker with root access on an enrolled monitored machine to exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce instead of a cryptographically random value, enabling the attacker to stockpile valid TPM quotes and replay them to evade detection.

HCL DFXAnalytics is affected by an insecure security header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-src and base-uri, which could allow an attacker to exploit injection vectors such as Cross-Site Scripting (XSS).

A TCP client can perform a TLS handshake and present the server name extension with a server name accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where XYZ is a valid name can be used. The description does not identify a specific product or version.

In Apache Wicket, FolderUploadsFileManager does not validate or sanitize the uploadFieldId parameter or clientFileName before constructing file paths. This allows an unauthenticated attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server. The issue affects versions 8.0.0–8.17.0, 9.0.0–9.22.0, and 10.0.0–10.8.0.

In the Linux kernel Bluetooth stack (hci_sync), there is a data race on the hdev->req_status field. Multiple functions read/write this field without proper locking, potentially causing errors.

A bug was fixed in the Linux kernel's btrfs filesystem related to log replay. When an inode was previously logged with size 0 and then a new hard link or rename occurred, the log did not update the inode's size, leaving a non-zero size (e.g., 64K) despite an earlier truncate to zero.

In tiny SRCU, srcu_gp_start_if_needed() directly calls schedule_work(), which causes a lockdep splat when call_srcu() is called with a scheduler lock held. The fix uses irq_work to start GP and adds irq_work_sync() in cleanup_srcu_struct() to prevent a use-after-free.

In the Linux kernel, shstk_pop_sigframe() (x86 shadow stacks) does not check errors from mmap_read_lock_killable(). The lack of __must_check annotations on these functions prevented early detection of the issue.

In the Linux kernel, xfrm_get_ae() does not account for the XFRMA_IF_ID attribute size in message size calculations, potentially leading to -EMSGSIZE error and BUG_ON, causing a kernel panic. The issue affects states with if_id set.

W jądrze Linuxa zidentyfikowano podatność związaną z wyciekiem pamięci w tablicy BO w stanie zawieszenia. Tablica BO była alokowana osobno, ale nigdy nie była zwalniana, co prowadziło do wycieku pamięci.