CVE Vulnerability Catalog

In the Linux kernel, the CAAM cryptographic driver has a vulnerability where sensitive key material is leaked via hex dumps in *_setkey() and gen_split_key() functions. Using print_hex_dump() without guard can expose keys in logs when CONFIG_DYNAMIC_DEBUG is enabled.

In the Linux kernel, the chacha20poly1305 cipher implementation has a vulnerability due to missing validation of the poly1305 template argument. The chachapoly_create() function assumes the second template argument is always present, which can lead to dereferencing an error pointer in strcmp().

In the Linux kernel's ccp (AMD) crypto driver, a bug was fixed where SNP was unnecessarily initialized during SEV ioctls that do not require it. Previously, this could zero out MSR_VM_HSAVE_PA, risking host crash.

In the Linux kernel's ccp (AMD) driver, a bug was fixed where SNP was unnecessarily initialized during the SNP_COMMIT ioctl. This command does not require any specific firmware state, and prior initialization could lead to security issues.

In the Linux kernel's ccp (AMD) driver, a bug was fixed where SNP was unnecessarily initialized during the SNP_VLEK_LOAD ioctl. Previously, initialization was pointless because the firmware immediately deletes the key on shutdown. Now the operation is rejected if SNP was not previously initialized.

In the Linux kernel's ccp (AMD) driver, a bug was fixed where SNP initialization was unnecessarily retried during the SNP_CONFIG ioctl. Now the operation is rejected if SNP was not previously initialized, preventing potential security issues.

In the Linux kernel's DRBG (CTR_DRBG) random number generator, a bug was fixed where drbg_ctr_generate() sometimes returned success despite failure, leaving the output buffer uninitialized.

In the Linux kernel, the x86/mm function incorrectly frees PMD-sized vmemmap pages. The pagetable_free() function treats vmemmap pages as compound pages, freeing only the first page and leaking the remaining ones.

In the Linux kernel, the SCMI regulator driver has a device node reference leak. The scmi_regulator_probe() function fails to release the child node reference on error, leading to resource exhaustion.

In the Linux kernel's module decompression code, the return value of module_extend_max_pages() is not checked. On allocation failure, info->pages remains NULL and info->max_pages is 0, leading to dereference of ZERO_SIZE_PTR and a kernel oops.

A vulnerability was found in the Linux kernel's page_ext iteration API. The page_ext_iter_next() function fails to validate whether the PFN belongs to a valid section, which during memory hotplug can cause a NULL pointer dereference. The issue occurs when the iterator exceeds the page count and accesses uninitialized memory.

In the Linux kernel, the mincore() and madvise(MADV_PAGEOUT) functions have an ownership check flaw. The owner_or_capable() check uses nop_mnt_idmap, ignoring the mount's idmap, leading to incorrect authorization decisions.

In the Linux kernel iommufd subsystem, a vulnerability was found where memory for the event queue is allocated inside a spinlock. A user can allocate a very large queue, exhausting atomic memory reserves.

In the Linux kernel iommufd subsystem, a vulnerability was found due to missing upper bound on the event queue depth (veventq_depth). A user can allocate a very large queue, exhausting kernel memory.

In the Linux kernel iommufd subsystem, a vulnerability was found with an infinite loop in iommufd_fault_fops_read(). On a copy_to_user() failure, the inner loop breaks but the outer while retries, causing 100% CPU usage and holding the mutex.

In the Linux kernel iommufd subsystem, a vulnerability was found due to missing upper bounds on entry_num and entry_len in iommufd_hwpt_invalidate(). Large values can cause soft-lockup or CPU stall.

In the Linux kernel KVM for ARM64, a vulnerability was found with a NULL pointer dereference in the VNCR pseudo-TLB during invalidation. The function kvm_invalidate_vncr_va() does not check if the pseudo-TLB is allocated, potentially causing a crash.

In the Linux kernel KVM for AMD SEV, a vulnerability was found due to not pinning the source page for write when adding CPUID data for an SNP guest. KVM writes back corrected CPUID data, but if the page is read-only, it can clobber read-only memory.

In the Linux kernel, KVM for ARM64 leaks a PFN when kvm_translate_vncr() races with an MMU notifier. The early return does not release the reference to the faulted-in page.

In the imx-lpi2c I2C driver for i.MX platforms, the adapter is not marked as suspended during suspend/resume. In the window between suspend_noirq and actual suspend, and between resume and resume_noirq, I2C transfers may be initiated when hardware resources are unavailable, risking a system hang.