Podatności

Dereferencja wskaźnika NULL w btrfs może prowadzić do awarii systemu.

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

Przepełnienie bufora w jądrze Linux w sterowniku BMC150 umożliwia zdalne wykonanie kodu.

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

Brak sprawdzenia długości nagłówka w jądrze Linux może prowadzić do nieprzewidzianego zachowania.

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

Błąd w jądrze Linuxa w lpc32xx_adc prowadzi do paniki systemu przez nieinicjalizowany wskaźnik.

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text is already writable") gated the core_kernel_text() branch of patch_map() on…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size and passes it to alloc_pages_exact() without checking it. For size == 0 nr_pages is 0,…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery, display commit work can call the…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in sched_cpu_wait_empty() until nothing else is left, and the only thing…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size only tells the periodic collector to reclaim entries after…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devm_request_irq() enables the interrupt before it returns, so the handler may run while probe is still initializing the device. Initialize the MMIO address and…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait sctp_wait_for_connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released.…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rpfilter: reject routes without inet6_dev ip6_route_lookup() can return an error-free route whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears down its inet6_dev while…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key path and…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and always_valid evicted lists were already handled in amdgpu_vm_validate. Without this, BOs that were…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfs_trim_fs() aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes me realize that is_in_v2_mode() may be called in a context where a new cgroup…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init_cids() overrides…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check() picks a random byte address within the region and stores it in r->sampling_addr. damon_va_mkold() passes it into a page…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka