CVE Vulnerability Catalog

The Versa Director SD-WAN orchestration platform contains an argument injection vulnerability in the Java code handling file uploads. An attacker can bypass MIME type validation and upload arbitrary file types, allowing placement of a malicious file on disk.

The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept has been disclosed by third party security researchers.

The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. Versa Networks is not aware of any exploitation, but a proof of concept has been disclosed.

In the Linux kernel, the following vulnerability has been resolved: on arm64, UXN was not set on swapper page tables. On a system implementing FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs; as a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. The fix sets UXN on these PTEs.

In the Linux kernel, the following vulnerability has been resolved: arm64: set UXN on swapper page tables. On a system that implements FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. Fix it by setting UXN on these PTEs.

In the Linux kernel for the LoongArch architecture, a vulnerability causes a runtime warning when displaying /proc/cpuinfo if CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled. The issue arises from using NR_CPUS instead of nr_cpu_ids for CPU iteration, triggering cpu_max_bits_warn(). The fix uses nr_cpu_ids as the runtime limit.

In the Linux kernel for ARM64, the emulation_proc_handler() function could be called concurrently, leading to a NULL pointer dereference and an Oops. The fix changes data storage and adds a mutex.

W jądrze systemu Linux zidentyfikowano podatność, która prowadziła do zakleszczeń i głodzenia kanałów kontrolnych w ścieżce danych wychodzących. Wprowadzono dodatkową kolejkę danych kanału kontrolnego, aby zapobiec czasom oczekiwania i zawieszaniu się łączy podczas przeciążenia ldisc.

A reference count leak was discovered in the Linux kernel's p9_read_work() function in the 9p subsystem. When the rc.sdata field of the request structure is NULL, the p9_req_put call is missing, causing a temporary reference leak.

W jądrze Linuxa zidentyfikowano podatność polegającą na dereferencji wskaźnika NULL w funkcji dev_parse_header_protocol, gdy pole skb->dev jest puste. Problem ten występuje w sterowniku tap, gdzie wywołanie tap_get_user prowadzi do błędu, ponieważ skb->dev jest ustawiane dopiero po wywołaniu funkcji virtio_net_hdr_to_skb.

In the Linux kernel, the ASoC SOF subsystem for Intel CNL platforms may process IPC replies before firmware initialization, leading to a NULL pointer dereference.

In the Linux kernel, the ASoC SOF subsystem for Intel HDA IPC platforms may process IPC replies before firmware initialization, leading to a NULL pointer dereference.

In the Linux kernel, the f2fs filesystem's f2fs_new_node_page() could trigger a BUG_ON due to inconsistency between the NAT entry and NAT bitmap. The fix removes the use of f2fs_bug_on() and adds proper checks.

In the Linux kernel, the F2FS filesystem has a null-pointer dereference vulnerability in f2fs_get_dnode_of_data. The issue occurs during atomic write operations when a newly created cow_inode lacks a properly set cow_inode pointer, leading to a system crash.

In the Linux kernel, the udmabuf driver did not explicitly set the DMA mask for the device. This causes a warning and potential issues when userspace accesses the dma-buf via CPU. The fix sets the DMA mask and adds error handling for its configuration.

In the Linux kernel, the DRM/AMD Power Management driver for Sienna Cichlid lacks the fini_microcode interface, which may lead to a memory leak.

In the Linux kernel, gsmld_receive_buf() could call gsm->receive() without prior MUX initialization, leading to a NULL pointer dereference. The fix adds a sanity check to avoid calling the function when it is not initialized.

In the Linux kernel, the ASoC sma1307 component lacks a NULL check in sma1307_setting_loaded(). Pointers allocated by kzalloc and devm_kzalloc can be NULL, potentially leading to a NULL dereference.

In the Linux kernel, a NULL pointer dereference vulnerability exists in btrfs when performing a read-only scrub on a filesystem mounted with the rescue=idatacsums option. This option skips loading the checksum tree, and scrub does not check the NO_DATA_CSUMS flag, leading to a call to btrfs_search_slot() on a NULL pointer and a kernel crash.

In the Linux kernel, a vulnerability was resolved in x86/fred: system hang during S4 resume with FRED enabled. Upon wakeup from S4, the restore kernel initialized FRED MSRs, but the image kernel did not restore their pre-hibernation values, leading to a hang.