In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
Kernel fault injection test reports null-ptr-deref as follows:
BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: 0010:cfg802154_netdev_notifier_call+...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix not cleanup led when bt_init fails
bt_init() calls bt_leds_init() to register led, but if it fails later,
bt_leds_cleanup() is not called to unregister it.
This can cause panic if the argument "bluetooth-power" in...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Get user_ns from in_skb in unix_diag_get_exact().
Wei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed
the root cause: in unix_diag_get_exact(), the newly allocated skb does not
have sk. [2]
We must...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+2)
In the Linux kernel, the following vulnerability has been resolved:
xen-netfront: Fix NULL sring after live migration
A NAPI is setup for each network sring to poll data to kernel
The sring with source host is destroyed before live migration and
new sring with target host is setup after live migra...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: Fix potential memory leak in otx2_init_tc()
In otx2_init_tc(), if rhashtable_init() failed, it does not free
tc->tc_entries_bitmap which is allocated in otx2_tc_alloc_ent_bitmap().
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
NFC: nci: Bounds check struct nfc_target arrays
While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:
memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (siz...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
net: mvneta: Prevent out of bounds read in mvneta_config_rss()
The pp->indir[0] value comes from the user. It is passed to:
if (cpu_online(pp->rxq_def))
inside the mvneta_percpu_elect() function. It needs bounds checkeding
to...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
gpio/rockchip: fix refcount leak in rockchip_gpiolib_register()
The node returned by of_get_parent() with refcount incremented,
of_node_put() needs be called when finish using it. So add it in the
end of of_pinctrl_get().
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
ravb: Fix potential use-after-free in ravb_rx_gbeth()
The skb is delivered to napi_gro_receive() which may free it, after calling this,
dereferencing skb may trigger use-after-free.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: iosm: fix memory leak in ipc_mux_init()
When failed to alloc ipc_mux->ul_adb.pp_qlt in ipc_mux_init(), ipc_mux
is not released.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
The skb is delivered to napi_gro_receive() which may free it, after
calling this, dereferencing skb may trigger use-after-free.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
net: mdio: fix unbalanced fwnode reference count in mdio_device_release()
There is warning report about of_node refcount leak
while probing mdio device:
OF: ERROR: memory leak, expected refcount 1 instead of 2,
of_node_get()/of_n...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
The skb is delivered to napi_gro_receive() which may free it, after
calling this, dereferencing skb may trigger use-after-free.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions()
When dsa_devlink_region_create failed in sja1105_setup_devlink_regions(),
priv->regions is not released.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
ethernet: aeroflex: fix potential skb leak in greth_init_rings()
The greth_init_rings() function won't free the newly allocated skb when
dma_mapping_error() returns error, so add dev_kfree_skb() to fix it.
Compile tested only.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove()
The cmd_buff needs to be freed when error happened in
dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove().
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
ipv6: avoid use-after-free in ip6_fragment()
Blamed commit claimed rcu_read_lock() was held by ip6_fragment() callers.
It seems to not be always true, at least for UDP stack.
syzbot reported:
BUG: KASAN: use-after-free in ip6_d...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+4)
In the Linux kernel, the following vulnerability has been resolved:
net: thunderbolt: fix memory leak in tbnet_open()
When tb_ring_alloc_rx() failed in tbnet_open(), ida that allocated in
tb_xdomain_alloc_out_hopid() is not released. Add
tb_xdomain_release_out_hopid() to the error path to release...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: fix use-after-free in hsci
KASAN found that addr was dereferenced after br2dev_event_work was freed.
==================================================================
BUG: KASAN: use-after-free in qeth_l2_br2dev_worke...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
rtc: cmos: Fix event handler registration ordering issue
Because acpi_install_fixed_event_handler() enables the event
automatically on success, it is incorrect to call it before the
handler routine passed to it is ready to handle...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
PCI: mt7621: Add sentinel to quirks table
Current driver is missing a sentinel in the struct soc_device_attribute
array, which causes an oops when assessed by the
soc_device_match(mt7621_pcie_quirks_match) call.
This was only exp...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
The bounds checks in snd_soc_put_volsw_sx() are only being applied to the
first channel, meaning it is possible to write out of bounds values to the
second chann...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix perf_pending_task() UaF
Per syzbot it is possible for perf_pending_task() to run after the
event is free()'d. There are two related but distinct cases:
- the task_work was already queued before destroying the event;
-...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
igb: Initialize mailbox message for VF reset
When a MAC address is not assigned to the VF, that portion of the message
sent to the VF is not set. The memory, however, is allocated from the
stack meaning that information may be lea...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: Prevent buffer overflow in setup handler
Setup function uvc_function_setup permits control transfer
requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE),
data stage handler for OUT transfer uses memcpy...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix u8 overflow
By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases
multiple times and eventually it will wrap around the maximum number
(i.e., 255).
This patch prevents this by adding a boundary...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 8,
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
udf: Fix preallocation discarding at indirect extent boundary
When preallocation extent is the first one in the extent block, the
code would corrupt extent tree header instead. Fix the problem and use
udf_delete_aext() for deletin...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+6)
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
When ident_pud_init() uses only GB pages to create identity maps, large
ranges of addresses not actually requested can be included in the resulting
table; a 4...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
In the Linux kernel, the following vulnerability has been resolved:
ext4: dax: fix overflowing extents beyond inode size when partially writing
The dax_iomap_rw() does two things in each iteration: map written blocks
and copy user data to blocks. If the process is killed by user(See signal
handlin...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix access to uninitialised lock in fc replay path
The following kernel trace can be triggered with fstest generic/629 when
executed against a filesystem with fast-commit feature enabled:
INFO: trying to register non-static...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
exfat: fix memory leak in exfat_load_bitmap()
If the first directory entry in the root directory is not a bitmap
directory entry, 'bh' will not be released and reassigned, which
will cause a memory leak.
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: Avoid a bad reference count on CPU node
In the parse_perf_domain function, if the call to
of_parse_phandle_with_args returns an error, then the reference to the
CPU device node that was acquired at the start of the functi...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item
There is no links_num in struct snd_soc_acpi_mach {}, and we test
!link->num_adr as a condition to end the loop in hda_sdw_machine_select().
So an empty item in struct...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
exec: don't WARN for racy path_noexec check
Both i_mode and noexec checks wrapped in WARN_ON stem from an artifact
of the previous implementation. They used to legitimately check for the
condition, but that got moved up in two com...
AFFECTED_PRODUCTS:
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it
and return in case of error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
Replace one-element array with a flexible-array member in
`struct host_cmd_ds_802_11_scan_ext`.
With this, fix the following warning:
elo...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
ALSA: asihpi: Fix potential OOB array access
ASIHPI driver stores some values in the static array upon a response
from the driver, and its index depends on the firmware. We shouldn't
trust it blindly.
This patch adds a sanity ch...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
Fuzzing reports a possible deadlock in jbd2_log_wait_commit.
This issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require
synchronous updates because the file de...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
In the `mac802154_scan_worker` function, the `scan_req->type` field was
accessed after the RCU read-side critical section was unlocked. According
to RCU usage...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35
[WHY & HOW]
Mismatch in DCN35 DML2 cause bw validation failed to acquire unexpected DPP pipe to cause
grey screen and system hang. Remove Enhanced...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix system hang while resume with TBT monitor
[Why]
Connected with a Thunderbolt monitor and do the suspend and the system
may hang while resume.
The TBT monitor HPD will be triggered during the resume procedure...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType parameter in edit_type.php
AFFECTED_PRODUCTS:
Codeastro Membership Management System
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRS...
AFFECTED_PRODUCTS:
Cilium Cilium,
Cilium Cilium
Multiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /doctor/edit-profile.php and adminremark parameter in /admin/query-details.php.
AFFECTED_PRODUCTS:
Phpgurukul Hospital Management System
Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /admin/add-doctor.php and /admin/edit-doctor.php
AFFECTED_PRODUCTS:
Phpgurukul Hospital Management System
CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the address parameter in add_members.php and edit_member.php.
AFFECTED_PRODUCTS:
Codeastro Membership Management System
In the Linux kernel, the following vulnerability has been resolved:
static_call: Handle module init failure correctly in static_call_del_module()
Module insertion invokes static_call_add_module() to initialize the static
calls in a module. static_call_add_module() invokes __static_call_init(),
whi...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix error path in multi-packet WQE transmit
Remove the erroneous unmap in case no DMA mapping was established
The multi-packet WQE transmit code attempts to obtain a DMA mapping for
the skb. This could fail, e.g. under...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+4)