CVE Vulnerability Catalog

W jądrze Linuxa zidentyfikowano podatność związaną z obsługą data_vault, gdy wartość jest ZERO_SIZE_PTR. W niektórych przypadkach GDDV zwraca pakiet z buforem o zerowej długości, co prowadzi do dereferencji wskaźnika NULL w funkcji data_vault_read().

An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code via crafted commands, enabling them to obtain the entire cluster's secrets and take over the cluster.

A vulnerability was found in Wildfly's management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.

The Windows kernel module 'ACE-BASE.sys' version 1.0.2202.6217 of Anti-Cheat Expert does not perform proper access control when handling system resources. This allows a local attacker to escalate privileges from regular user to System or PPL level.

In the Linux kernel, an unnecessary synchronize_net() call was removed from the ipv6_mc_down() function. This call caused delays from 200 microseconds to 5 milliseconds under load.

In the Linux kernel, a race condition in btrfs fiemap delalloc range detection was fixed. After the change that stopped locking the entire target range for the duration of fiemap, delalloc ranges for file regions that are currently holes may be missed, so the fiemap caller is not aware of data in those regions.

In the Linux kernel, a vulnerability was resolved in media: v4l2-tpg where tpg_alloc had memory leaks. Resources allocated in for loops were not deallocated in error-handling paths, as tpg_free is only called when tpg_alloc returns 0.

In the Linux kernel, a vulnerability was resolved in media: v4l2-mem2mem where v4l2_m2m_register_entity had a memory leak. The allocated entity->name was not freed in error-handling paths.

In the Linux kernel, the media: imx: csc/scaler module has a memory leak. Memory allocated by v4l2_ctrl_handler_init is not freed on release.

In the Linux kernel, the media: go7007 module has a memory leak in go7007_load_encoder. The boot_fw buffer is allocated without being freed afterwards, and after the go structure is freed the memory remains leaked.

In the Linux kernel, the media: usbtv driver removed unnecessary lock calls in usbtv_video_free() that could lead to a deadlock. The usbtv_stop() call was also removed since it is invoked when unregistering the device.

The isd200 sub-driver in the Linux kernel's usb-storage uses HEADS and SECTORS values from ATA ID information to compute cylinder and head values when building a CDB for READ or WRITE commands. If either value is 0, the division/modulus operation causes a kernel crash. This can occur with a flawed or subversive emulated USB device.

In the Linux kernel's ASoC SOF (ipc4-pcm) module, a workaround addresses crashed firmware during system suspend. If firmware crashes while audio is active, pipeline state changes fail with IPC errors, causing kernel/firmware state misalignment and audio resume failures.

In the Linux kernel, the phy_get_internal_delay function may attempt to access an empty array when a driver calls it without defining delay_values and rx-internal-delay-ps or tx-internal-delay-ps is set to 0 in the device-tree. This leads to a NULL pointer dereference and kernel oops.

In the Linux kernel, the amdgpu_dm_fini() function in the drm/amd/display driver may dereference a NULL pointer because 'adev->dm.dc' can be NULL before calling dc_enable_dmub_notifications(). The vulnerability was found by static analysis and fixed by adding proper NULL checks.

In the Linux kernel, the clk_core_get function can dereference a NULL pointer when __clk_get_hw() returns NULL. The missing IS_ERR_OR_NULL check before using hw->core leads to the fault.

In the Linux kernel, the f2fs filesystem may trigger a kernel panic during recovery when FAULT_BLOCK is on and f2fs_reserve_new_block() returns -ENOSPC. With a fault injection rate of 1, an infinite loop in block reservation is also possible.

In the Linux kernel, the nbd module lacks a check for the return value of nla_nest_start(), which may return NULL. The missing verification can lead to incorrect behavior.

In the Linux kernel, the SUNRPC module's gss_import_v2_context has a memory leak: the ctx->mech_used.data buffer allocated by kmemdup is not freed. The fix moves the freeing to gss_krb5_import_ctx_v2.