CVE Vulnerability Catalog

A vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin involves insecure deserialization due to the use of PHP's native unserialize() function without restrictions on allowed classes. An attacker who can write to the cache backend (e.g., Redis, Memcached) can inject crafted PHP objects and execute arbitrary code.

In the WibuKey driver for Windows below version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent kernel memory may be modified.

A bug was fixed in the Linux kernel xfrm subsystem where xfrm_trans_reinject(), after being converted from a tasklet to a workqueue, ran in process context without an RCU read lock. This caused suspicious RCU usage warnings and potential validity issues for dst and netdevice references of packets queued through the workqueue.

A vulnerability in the Linux kernel's ESP (IPsec) implementation was found on the out-of-place output path, where the skb frag array was mutated without downgrading managed zerocopy frags (SKBFL_MANAGED_FRAG_REFS). This breaks the managed-frag invariant, potentially leading to use-after-free of zerocopy pages and memory leaks.

In the Linux kernel, a vulnerability was fixed in the RDMA/siw driver in siw_accept(). If siw_qp_modify() fails, the QP's state_lock is released before error path cleanup, allowing a concurrent ibv_modify_qp() to transition the QP to ERROR and free the cep structure, leading to use-after-free. The fix clears qp->cep and drops the association reference under the held write lock.

In the Linux kernel's RDMA/rxe subsystem, a vulnerability exists where rxe_rereg_user_mr() reassigns the PD pointer before validating access flags. If validation fails, the MR remains in an inconsistent state, leading to a use-after-free of the PD memory.

In the Linux kernel xfrm subsystem, during bundle creation, a missing reference to net_device leads to a use-after-free when a concurrent interface deletion occurs. The fix reads dst->dev via dst_dev_rcu() and keeps the RCU read-side critical section active until xfrm_fill_dst() takes the required references.

In the Linux kernel RDMA/rxe subsystem, the HMM_PFN_WRITE check has been restored in ODP write paths. A previous fix removed the access permission test, allowing an unprivileged user to modify read-only pages (e.g., file cache) via RDMA operations, similar to Dirty COW. The fix requires HMM_PFN_WRITE for all write operations, preventing overwriting read-only files.

In the Linux kernel, the RDMA/rxe module contains a use-after-free vulnerability. The rxe_get_mcg() function publishes a newly allocated multicast group in the mcg_tree before the backing Ethernet multicast address is programmed via rxe_mcast_add(). If rxe_mcast_add() returns an error, the group is freed but remains in the tree, leading to a use-after-free when the same MGID is later looked up.

In the Linux kernel RDMA/core subsystem, ib_get_eth_speed() does not check the registration state of the net_device before invoking the ethtool callback, which can lead to use-after-free during interface unregistration. The fix adds a NETREG_REGISTERED check under RTNL and returns -ENODEV for devices being unregistered.

A use-after-free vulnerability exists in the Linux kernel's IB/isert module. isert_send_done() defers completion handling for certain control PDUs to the isert_comp_wq workqueue, but nothing orders that work against connection teardown, so the queued work can run against memory freed by isert_wait_conn() and iscsit_close_connection().

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short beacon and probe responses. Parsing functions assumed a full 36-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wrapped and caused out-of-bounds read.

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short association responses. libipw_handle_assoc_resp() reads fields from a 30-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wraps and causes out-of-bounds read.

In the Linux kernel, cfg80211 freed a driver-owned scan request when an interface went down during a scan. The driver still believed it owned the request, leading to a use-after-free in scan_done().

In the Linux kernel, cfg80211_update_assoc_bss_entry() filtered entries by BSS type when removing stale entries. An entry with a different capability bit (e.g. IBSS) remained, causing WARN_ON(!cmp) in cfg80211_rehash_bss().

In the Linux kernel's mac80211 subsystem, interfaces are not removed from the local->interfaces list when their netdev is unregistered without going through ieee80211_if_remove(). This can lead to a BUG in wiphy_to_rdev() during interface removal.

In the Linux kernel's cfg80211 subsystem, when a network namespace is destroyed, moving the wiphy to the initial namespace can fail, leaving a garbage netns pointer. This leads to a kernel fault when notifying about the wiphy.

In the Linux kernel, the pxa DMA engine driver had a double counting issue of hardware descriptors after conversion to kzalloc_flex(). The fix explicitly sets the nb_desc counter and removes the increment to avoid errors in processing loops.

In the Linux kernel, the netfilter flowtable module has an issue with premature release of conntrack reference, potentially leading to use of an invalid object. The fix holds the reference until flow release after RCU grace period and adds rcu_barrier() on module exit.

In the Linux kernel, the SMB client has a buffer overflow vulnerability when processing absolute native symlink targets. The fix validates the NT drive prefix before accessing fixed offsets to prevent memory overwrites.