CVE Vulnerability Catalog

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (SSH_TRUSTED_USER_CA_KEYS) and accepts arbitrary principals (SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.

POST /{owner}/{repo}/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

Requesting /{username}/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The issue affects the Exam::startExam function in exam.php of the Exam Module component, where manipulation of the topicid argument results in SQL injection. The attack can be executed remotely and the exploit is now public.

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment. cache_replay(), the writeback worker and the GC worker read a kset of get_kset_onmedia_size() bytes and advance the position by it. A forged key_num makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cache_pos_advance() BUG_ON.

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory. cache_key_decode() takes a key's logical off from the cache device and later indexes req_key_tree->subtrees[] by it in get_subtree(). An off past the device forms a subtree pointer outside the array, which rb_insert() writes through during replay.

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF. Add a sched_cache_grp pointer to task_struct so that scheduler code can access the cache group directly via the task, without going through mm->sched_cache_grp. This decouples the scheduler's hot-path accesses from the mm_struct. Each task holds its own refcount on the sched_cache_group, separate from the reference held by its mm_struct. The reference is acquired in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm(). This fixes the use-after-free when account_mm_sched() reaches the group through a task whose mm is being switched.

In the Linux kernel's sched_ext scheduler, ops.dequeue() was invoked while the source user DSQ lock was still held on the consume and move paths. A BPF scheduler that locks the source DSQ from ops.dequeue() would self-deadlock. The fix moves the invocation after the DSQ unlock on all three paths.

In the Linux kernel's sched_ext, a task could be found on a DSQ while still in SCX_OPSS_DISPATCHING state. The reenqueue paths did not wait for the state to clear, so ops.enqueue() set SCX_OPSS_QUEUED and the dispatcher's final store overwrote it with SCX_OPSS_NONE, dropping later dispatches of the task. The fix waits for SCX_OPSS_DISPATCHING to clear before dequeueing for reenqueue.

In KVM on x86, GET_NESTED_STATE_PAGES was not re-pended when fetching nested pages failed in the KVM_RUN path. If userspace re-ran the vCPU and vmcs02 held valid PFNs from the previous L2 run, KVM could re-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.

In the Linux kernel audit subsystem, kill_rules() removed mixed AUDIT_DIR and AUDIT_EXE rules when pruning an audit tree, dropping entry->rule.exe before removing the rule from RCU-visible filter lists. Removing the watched directory could race with another task evaluating the rule, causing a use-after-free in audit_mark_compare().

A vulnerability was fixed in the Linux kernel's fprobe mechanism where unregister_fprobe() and unregister_fprobe_async() relied on standard RCU grace periods that do not track preemption-disabled sections when RCU is not watching (e.g., in the idle loop or nohz_full extended quiescent states). This could lead to a use-after-free if the fprobe was freed immediately after unregistration. The fix ensures handlers exit early when !rcu_is_watching() and replaces guard(rcu)() and rcu_read_lock() with guard(rcu_sched_notrace)(), eliminating fast-path lockdep overhead.

In the Linux kernel HID BPF subsystem, the comparison of the return value from hid_bpf_hw_request against size did not cast size to ssize_t. When a transport driver returned a negative error code (e.g. -EPIPE), it was promoted to size_t and evaluated as a large positive number, making (ret > size) true. This silently converted the hardware error into a success and copied the unmodified buffer back.

In the Linux kernel, the HID multitouch driver's mt_remove() used timer_delete_sync() to stop the sticky-finger release timer. However, the timer could be rearmed by a report arriving after deletion, leading to a use-after-free when the timer fired after the driver was unbound. The fix replaces timer_delete_sync() with timer_shutdown_sync(), which also prevents any subsequent mod_timer() from rearming the timer.

In the Linux kernel io_uring with SQPOLL, the sqpoll thread could pop and complete a request as soon as mpscq_push() published it. If that was the last request holding the ring alive, io_ring_exit_work() freed the ctx, stopped the thread and tctx while io_req_normal_work_add() was still referencing them, causing a use-after-free. The fix holds an RCU read lock across the add and waits for a grace period before freeing the ctx.