CVE Vulnerability Catalog

A vulnerability in concurrent-ruby up to version 1.3.6 allows any thread to release a write lock without authorization, potentially breaking mutual exclusion. Additionally, release_read_lock can decrement the shared counter below zero, causing ResourceLimitError on read lock acquisition.

In concurrent-ruby up to version 1.3.6, a vulnerability allows incorrect granting of a write lock after one thread acquires the read lock 32,768 times. The lock stores thread-local read and write hold counts in one integer, where the low 15 bits are for read count and bit 15 is for WRITE_LOCK_HELD. After exceeding this threshold, the read count overflows into the write-lock bit, causing try_write_lock to incorrectly return true without setting the global RUNNING_WRITER bit.

The vulnerability in the concurrent-ruby library for Ruby causes the AtomicReference#update method to enter an infinite retry loop when the stored value is Float::NAN. This is because Float::NAN == Float::NAN always returns false, preventing the compare_and_set operation from succeeding.

A vulnerability in the Faraday library allows a DoS attack by sending a specially crafted nested query string. The NestedParamsEncoder does not enforce a maximum nesting depth, leading to stack overflow and crash of the thread or worker process.

In the Linux kernel's OMFS filesystem, a missing lower-bound check for s_sys_blocksize allows a crafted image with a value smaller than OMFS_DIR_START (440) to cause an unsigned integer underflow in omfs_make_empty(). This triggers a memset() with a length near 4 GiB, overwriting kernel memory beyond the block buffer.

A use-after-free vulnerability was found in the Linux kernel's mbcache mechanism. The mb_cache_destroy() function fails to cancel the pending c_shrink_work work item before freeing memory, potentially leading to access of already freed memory.

In the Linux kernel, the DRBD driver has an RCU call imbalance in drbd_adm_dump_devices(). The function calls rcu_read_unlock() without a preceding rcu_read_lock(), which can lead to incorrect RCU behavior.

A fix in the Linux kernel for a memory leak in blk_revalidate_disk_zones(). On zone revalidation error, memory allocated for args.zones_cond was not freed.

In the Linux kernel blkcg_maybe_throttle_current() function, a missing put_disk() call on the error path causes a disk reference leak. The disk will never be freed.

A deadlock was discovered in the Linux kernel's sysfs mechanism during the RAID array clear operation (array_state=clear). The issue stems from incorrect reference release ordering, leading to recursive locking and a potential deadlock warning.

A fix in the Linux kernel for ublk where the per-IO canceled flag was not reset after fetch, potentially preventing cancellation on server failure.

In the Linux kernel, the md (RAID) module has a deadlock during raid456 reshape. I/O operations waiting for reshape progress can block array suspend because reshape is frozen and active IO references are not released.

A deadlock was discovered in the Linux kernel's Btrfs subsystem between a reflink operation and a transaction commit when the flushoncommit mount option is used. The issue occurs when reflink copies an inline extent beyond the destination file's current i_size, causing threads to block each other.

In the Linux kernel amd-pstate driver, the amd_pstate_epp_cpu_init() function has a memory leak. On failure to set epp, the cpudata object is not freed.

In the Linux kernel's PCI subsystem, a use-after-free (UAF) vulnerability was found related to the driver_override field. When a driver is probed via __driver_attach(), the bus's match() function is called without holding the device lock, allowing concurrent access to the driver_override field without synchronization, leading to UAF.

In the Linux kernel's platform/wmi subsystem, a use-after-free (UAF) vulnerability was found related to the driver_override field. When a driver is probed via __driver_attach(), the bus's match() function is called without holding the device lock, allowing concurrent access to the driver_override field without synchronization, leading to UAF.

In the Linux kernel, the vdpa subsystem has a use-after-free (UAF) vulnerability during driver matching. The match() function is called without holding the device lock, allowing unprotected access to the driver_override field.

In the Linux kernel, the s390/cio subsystem has a use-after-free (UAF) vulnerability during driver matching. The match() function is called without holding the device lock, allowing unprotected access to the driver_override field.

In the Linux kernel, in the s390/ap subsystem, a potential use-after-free (UAF) occurs during AP mask updates. __ap_revise_reserved() accesses the driver_override field without locking, racing with driver_override_store().

In the Linux kernel, the fsl-mc bus has a use-after-free (UAF) vulnerability during driver matching. The match() function is called without holding the device lock, allowing unprotected access to the driver_override field.