Archive
28 December 2024
Vulnerabilities first published on this day (UTC), newest first.
20 results · Clear filters · Feed
-
High 7.8
EDAC/igen6: Avoid segmentation fault on module unload
In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Avoid segmentation fault on module unload The segmentation fault happens because: During modprobe: 1. In igen6_probe(), igen6_pvt will be allocated with kzalloc() 2. In igen6_regi…
-
High 7.8
s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex Reservation of the PMU hardware is done at first event creation and is protected by a pair of mutex_lock() and mutex_unlock(…
-
High 8.4
9p/xen: fix release of IRQ
In the Linux kernel, the following vulnerability has been resolved: 9p/xen: fix release of IRQ Kernel logs indicate an IRQ was double-freed. Pass correct device ID during IRQ release. [Dominique: remove confusing variable reset to 0]
-
High 7.5
ipv6: Fix soft lockups in fib6_select_path under high next hop churn
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix soft lockups in fib6_select_path under high next hop churn Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using th…
-
High 7.8
drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()'
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()' The `kfd_get_cu_occupancy` function previously declared a large `cu_occupancy` array as a local variable,…
-
High 7.8
brd: defer automatic disk creation until module initialization succeeds
In the Linux kernel, the following vulnerability has been resolved: brd: defer automatic disk creation until module initialization succeeds My colleague Wupeng found the following problems during fault injection: BUG: unable to handle page fault for address: …
-
High 7.5
bpf: fix recursive lock when verdict program return SK_PASS
In the Linux kernel, the following vulnerability has been resolved: bpf: fix recursive lock when verdict program return SK_PASS When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventu…
-
High 7.8
f2fs: fix to do sanity check on node blkaddr in truncate_node()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node blkaddr in truncate_node() syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_i…
-
High 7.5
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
In the Linux kernel, the following vulnerability has been resolved: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport Since transport->sock has been set to NULL during reset transport, XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the xs_t…
-
High 8.4
mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() It should be size of the struct clk_bulk_data, not data pointer pass to devm_kcalloc().
-
High 7.8
crypto: bcm - add error check in the ahash_hmac_init function
In the Linux kernel, the following vulnerability has been resolved: crypto: bcm - add error check in the ahash_hmac_init function The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example…
-
High 7.8
powerpc/mm/fault: Fix kfence page fault reporting
In the Linux kernel, the following vulnerability has been resolved: powerpc/mm/fault: Fix kfence page fault reporting copy_from_kernel_nofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read vi…
-
High 7.8
powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
In the Linux kernel, the following vulnerability has been resolved: powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() During early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE, since pageblock_order is still zero and it gets initializ…
-
High 7.3
Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerabili…
-
High 7.5
Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may c…
-
High 7.5
Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data. Successful exploita…
-
High 7.7
Some Huawei wearables have a permission management vulnerability.
-
High 7.8
GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)
Software installed and run as a non-privileged user can trigger the GPU kernel driver to write to arbitrary read-only system files that have been mapped into application memory.
-
High 7.8
Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.8
GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.