CVE Vulnerability Catalog

In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In setRingtoneUri of VoicemailNotificationSettingsUtil.java, there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A vulnerability in the Linux kernel's netlink subsystem causes infinite retry looping in netlink_unicast(). The issue stems from an incorrect check of socket read memory constraints, leading to CPU stalls (RCU stall) and system unresponsiveness.

In the Linux kernel ftgmac100 driver, a potential NULL pointer access in ftgmac100_phy_disconnect was fixed. After phy_disconnect(), netdev->phydev is reset to NULL, so the phy_device must be cached before calling fixed_phy_unregister().

In the Linux kernel, the asix_devices driver for ASIX AX88772 USB Ethernet chips lacked a phy_mask setting for the MDIO bus. This caused up to 32 dummy PHY devices to be created, with only one binding to the network driver. During system suspend/resume, a NULL pointer dereference occurred in phy_state_machine(), leading to a crash.

A Linux kernel bug in jump offset calculation for tailcall on LoongArch BPF was fixed. The extra pass of bpf_int_jit_compile() skips JIT context initialization, leaving out_offset = -1, which results in an incorrect (negative) jmp_offset.

A reference count leak in ctnetlink_dump_table() in the Linux kernel's netfilter subsystem occurs when ct == last, causing a double increment that prevents conntrack object release. This blocks netns dismantle or conntrack module removal, leading to potential denial of service.

In the Linux kernel, the hibmcge network driver causes an rtnl deadlock during PCI reset. The driver acquires rtnl_lock in reset_prepare() and releases it in reset_done(), leading to double-locking when iterating devices during a bus reset.

In the Linux kernel hibmcge driver, a division by zero in hbg_get_queue_used_num() was fixed. When the network port is down, ring->len is 0; a check now returns 0 in that case.

A vulnerability in the Linux kernel's HFS filesystem was fixed, where the hfs_find_init() function can trigger a general protection fault if the tree pointer is NULL. The flaw is triggered when mounting a specially crafted HFS filesystem image, leading to a null pointer dereference and kernel crash.

In the Linux kernel, the hfsplus filesystem's hfsplus_create_attributes_file() uses BUG_ON(), which can be triggered when the volume header contains erroneous values indicating the attributes file is not yet created. The fix replaces BUG_ON() with an -EIO error and a message suggesting running fsck.

In the Linux kernel SMB server module (ksmbd), a deadlock occurs when smb2_create_link() is called with ReplaceIfExists set and the target name already exists. ksmbd_vfs_kern_path_locked() returns success with the parent directory locked, and then ksmbd_vfs_link() tries to lock the same parent again, causing a deadlock.

In the Linux kernel, a flaw was fixed in the loop driver where the block size of a loop device could be changed underneath a mounted filesystem. This caused a mismatch between the block device block size and the superblock block size, leading to confusion in places like fs/buffer.c. The fix acquires exclusive ownership of the loop device before changing its block size.

In the Linux kernel, snd_soc_remove_pcm_runtime() might be called with rtd == NULL, leading to a null pointer dereference and kernel crash. This can be reproduced with topology loading and marking a link as ignored due to a missing hardware component, then removing the module.

W jądrze Linuxa zidentyfikowano podatność, która została naprawiona. Problem dotyczy zapisu ciągu znaków bez ograniczników do sysfs gpu_od/fan_ctrl lub pp_power_profile_mode dla profilu CUSTOM, co prowadzi do dereferencji wskaźnika null.

In the Linux kernel ext4 filesystem, a BUG_ON was triggered in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. This can occur with a crafted filesystem image.

In the Linux kernel libiscsi, iscsi_conn->dd_data is initialized unconditionally even when no memory was allocated (dd_size == 0), e.g. on ib_fast_reg_mr allocation failure in iSER. This leads to an invalid pointer dereference during connection teardown and a panic.

W jądrze Linuxa zidentyfikowano podatność związaną z systemem plików JFS, która pozwala na uszkodzenie zwykłych plików poprzez zapisanie wartości ujemnej dla i_size. Wprowadzono poprawkę, która dodaje sprawdzenie podczas otwierania takich plików, aby uniknąć błędów w kolejnych operacjach.