CVE Vulnerability Catalog

A vulnerability exists in the Linux kernel's tun driver where the rate of printing illegal packet contents is not limited. When vhost_worker receives too many illegal packets, tun_do_read continuously dumps packet contents, causing excessive CPU time consumption and soft lockup detection when the console is enabled.

In the Linux kernel, a memory leak (memleak) occurs in netfilter nf_tables when handling maps from the abort path. A combination of delete element and delete set from the abort path can result in restoring the refcount of the mapping twice, leading to a kernel warning and potential memory issues.

A deadlock exists in the Linux kernel net/sched subsystem. When the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to self, the same qdisc lock is acquired recursively on the same CPU. The fix adds an owner field (CPU id) to struct Qdisc and drops the packet when re-entered from the same CPU.

A deadlock (ABBA) exists in the Linux kernel clock (clk) subsystem. A thread disabling unused clocks calls clk_pm_runtime_get() while holding prepare_lock, while a device resume thread calls clk_prepare() trying to acquire the same lock. This leads to hung tasks and boot/system hangs.

In the Linux kernel, the sysfs_break_active_protection() routine has a reference leak in its error path. If the call to kernfs_find_and_get() fails, kn will be NULL, so the reference to kobj acquired at the start of the function is never released.

In the Linux kernel, the fat_encode_fh_nostale() function in the FAT filesystem encodes a file handle without a parent using only the first 10 bytes, while the handle length must be a multiple of 4 (actually 12 bytes). The last two bytes remain uninitialized, potentially leaking uninitialized information to userspace.

In the Linux kernel, in the DRM subsystem for AMD Display, a NULL check was added for the dc_state pointer before releasing it in dc_state_release. The fix prevents a potential NULL pointer dereference during state release.

In the Linux kernel on ARM, a bug in cache flush handling can lead to a kernel panic. The issue involves pages marked as reserved (PG_reserved) but not mapped by the kernel, as exposed during uio tests. The fix checks the PG_reserved flag before performing the flush operation.

In the Linux kernel, the drm/i915/gt component fails to reset queue_priority_hint when parking the GPU engine. This can trigger a BUG_ON assertion in __engine_park and cause a kernel BUG. The issue is caused by a preempt-to-busy race triggered by the heartbeat.

A regression in the Linux kernel SCSI subsystem causes the procfs host directory to not be removed in certain error paths, such as when the usb-storage driver fails during probe. This leads to warnings in dmesg and a leak of the SCSI host proc structure. The fix restores a conditional call to scsi_proc_hostdir_rm() in scsi_host_dev_release() guarded by the SHOST_CREATED state check.

In the Linux kernel, the SCSI qla2xxx driver has a memory leak in __qlt_24xx_handle_abts(). A previous fix added an early return when a command was not found but failed to free the allocated memory for the management command.

In the Linux kernel, the gma500 graphics driver (drm/gma500) has a bug where a destroyed mutex object is used during psb_gem_unpin(). This triggers a WARN_ON(lock->magic != lock) warning and may lead to system instability. The fix moves the drm_gem_object_release() call after the unpin operation.

Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.

Incorrect access control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the UART interface.

The Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.

A CSV Injection vulnerability in the Asus RT-N12+ router allows an administrator to inject arbitrary commands or formulas into the client name parameter. When exported to CSV format, the injected code can be executed in another user's session upon opening the file.

A flaw in the RESTEasy Reactive implementation in Quarkus causes security checks for some JAX-RS endpoints to be performed after serialization, consuming more processing resources during HTTP request checks. In certain configurations, an attacker knowing POST, PUT, or PATCH request paths can potentially overload vulnerable endpoints, leading to denial of service.

A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database connection.

A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.

A flaw in SAML client registration in Keycloak allows an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission.