703 results · Clear filters · Feed
-
Medium 5.3CVE-2022-2602 Public exploit
io_uring UAF, Unix SCM garbage collection
-
Medium 5.3CVE-2022-2588 Public exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the …
-
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
Medium 4.9
Possible deadlock in Linux kernel event handling
Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an eve…
-
Medium 5.5
Kernel: refcount leak in ctnetlink_create_conntrack()
A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.
-
Medium 4.4
Kernel: null pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service.
-
Medium 6.4
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …
-
Medium 4.7
Kernel: local dos vulnerability in scatterwalk_copychunks
A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to cras…
-
Medium 4.3
Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get
An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potenti…
-
Medium 4.3
The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unp…
-
Medium 5.5
Kernel: integer overflow in igmpv3_newpack leading to exploitable memory access
An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.
-
Medium 6.1
Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosu…
-
Medium 6.7
Kernel: netfilter: xtables out-of-bounds read in u32_match_it()
A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyon…
-
Medium 5.1
Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()
A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading…
-
Medium 6.5
Kernel: rsvp: out-of-bounds read in rsvp_classify()
A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to…
-
Medium 5.5
Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allo…
-
Medium 4.4
Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap
A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the syst…
-
Medium 5.5
Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()
A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service …
-
Medium 5.5
Kernel: jfs: null pointer dereference in dbfree()
A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.
-
Medium 6.5
Information exposure through microarchitectural state after transient execution in certain vector execution units for s…
-
Medium 5.5
Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid
A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is t…
-
Medium 5.5
Kernel: smsusb: use-after-free caused by do_submit_urb()
A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.
-
Medium 5.5
Kernel: cxgb4: use-after-free in ch_flower_stats_cb()
A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, ca…
-
Medium 5.5
Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …
-
Medium 4.4
Out-of-bounds read when setting hmac data
An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw exists within the processing of seg6 attributes. The issue results from the improper validation of user-supplied data, which can result in a read past th…
-
Medium 6.4
Use-after-free in nfc_llcp_find_loca in net/nfc/llcp_core.c
A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue.
-
Medium 4.7
Possibility of deadlock in libbpf function sock_hash_delete_elem
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
-
Medium 4.6
An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in …
-
Medium 6.5CVE-2023-3338 Public exploit
Crash due to a null pointer dereference in the dn_nsp_send function
A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.
-
Medium 5.5
A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a…
-
Medium 5.5
An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu…
-
Medium 6.7
A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this f…
-
Medium 5.5
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height gr…
-
Medium 5.5
A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a…
-
Medium 5.5
An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when c…
-
Medium 4.4
shiftfs lock unbalance in Ubuntu-specific kernels
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).
-
Medium 6.5
Copy_from_user Spectre-V1 Gadget in Linux Kernel
Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend u…
-
Medium 4.7
An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power…
-
Medium 6.4
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/e…
-
Medium 4.7
A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux …