CVE Vulnerability Catalog

In the Linux kernel, the nvmet-auth module has a heap out-of-bounds write vulnerability in nvmet_execute_auth_receive(). The function trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In SUCCESS1 and FAILURE1 states, a short buffer can lead to writing past the allocated memory.

In the Linux kernel, the nvmet-rdma module has an issue with handling inline data with a nonzero offset. The function nvmet_rdma_use_inline_sg() maps the host-controlled offset but assumes the data begins in the first inline page. For offsets larger than the page size, a length underflow can occur, leading to out-of-bounds reads.

In the Linux kernel, the dm-verity module has a buffer overflow in FEC calculation. The bug allows writing beyond the bounds of the lambda array in the RS decoder, which can corrupt the syndrome buffer. The fix addresses this overflow.

In the Linux kernel scsi: xen: scsiback driver, on error paths before command submission, there is a double-put of se_cmd with refcount 0, leading to refcount underflow and tag leak. The fix adds a helper that just returns the tag and sends the error response.

A vulnerability in the Linux kernel SCSI target subsystem affects parsing of PERSISTENT RESERVE OUT buffers. The TransportID parser was not given the buffer length, allowing out-of-bounds reads via a malformed iSCSI identifier. It is reachable through any fabric delivering PR OUT to an iSCSI TPG, including vhost-scsi.

A use-after-free vulnerability was found in the Linux kernel's SCSI target subsystem, affecting the REGISTER AND MOVE operation in Persistent Reserve Out. The issue arises from using a pointer to a mapped buffer after it has been unmapped, potentially leading to reads from freed memory.

In the Linux kernel, the RT locking mechanism has a use-after-free vulnerability due to incorrect RCU protection in rt_spin_unlock(). The function releases RCU protection before unlocking, enabling a race condition that leads to use of freed memory.

In the Linux kernel, the net: mana driver lacks validation of the packet length reported by the NIC in the RX CQE. The length is passed to skb processing without verification, which can lead to errors.

In the Linux kernel, the net: mana driver lacks DMA synchronization for page pool RX fragments in the receive path. When RX buffers are allocated from page pool fragments, they are not synced for CPU before being passed to the network stack, which can cause issues in configurations requiring explicit DMA sync.

A vulnerability in the Linux kernel's GVE (Google Virtual Ethernet) driver causes header buffer corruption when header-split and HW-GRO are enabled. The issue stems from incorrect indexing of header buffers by queue position instead of buffer ID, leading to wrong header reads and reuse of buffers still owned by the device when completions arrive out of order.

In the Linux kernel ESPINTCP subsystem, a vulnerability exists related to partial sends. Using sk_msg_free_partial() ensures skmsg consistency in each iteration, simplifying code and fixing bugs in skmsg accounting when not sending the full contents.

In the Linux kernel orangefs filesystem, a vulnerability exists where the directory entry size is stored in a 32-bit variable, which can wrap and bypass bounds checks, leading to out-of-bounds read and kernel panic.

In the Linux kernel, in the ip_vs_conn_new() function, the full ip_vs_seq structures are not reset, which can lead to use of uninitialized data from slab. The fix resets both struct ip_vs_seq members before publishing the connection to prevent TCP flow corruption.

In the Linux kernel's DRBD module, there is a vulnerability due to not rejecting data replies with an out-of-range payload size. A malicious or man-in-the-middle DRBD peer can send a reply with a negative size, leading to copying data beyond a bio page and corrupting kernel memory.

In the Linux kernel's IPVS, there are errors in calculating IPv6 transport offsets. The TCP app code assumed an IPv4 network header, which can cause issues with apps over IPv6. The ICMPV6 header offset was also corrected.

In the Linux kernel's IPVS, after calling skb_ensure_writable(), which may reallocate skb->head, the IP header pointer was not reloaded, potentially leading to use of a stale pointer.

In the Linux kernel ksmbd (SMB) server, FSCTL operations such as SET_SPARSE, SET_ZERO_DATA, and SET_COMPRESSION operate on an open SMB handle but call VFS helpers with the current ksmbd worker credentials. This can lead to revalidation of inode permissions, ownership, and LSM policy independently of the SMB handle access mask. The fix runs each operation with the credentials captured in the target file when the handle was opened.

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronize_session() function performs no validation, allowing unauthenticated attackers to log in as any user, including administrators.

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. The AJAX handler lacks verification, allowing unauthenticated attackers to log in as any existing user, including administrators.

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. Unauthenticated attackers can delete arbitrary files, potentially leading to remote code execution.