Linux Kernel any version

mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()

ovpn: tcp - use cached peer pointer in ovpn_tcp_close()

power: supply: rt9455: Fix use-after-free in power_supply_changed()

of: unittest: fix use-after-free in of_unittest_changeset()

regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods

virtio-net: ensure the received length does not exceed allocated size

x86/tdx: Panic on bad configs that #VE on "private" memory access

NVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket. A successful exploit of this vulnerability may lead to denial of service and data tampering.

Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header

IBM Security Guardium privilege escalation

fs/ntfs3: Validate buffer length while parsing index

iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap

fs/ntfs3: Add length check in indx_get_root

vsock/virtio: Validate length in packet header before skb_put()

dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

bus: mhi: host: Range check CHDBOFF and ERDBOFF

bus: mhi: host: Detect events pointing to unexpected TREs

accel/qaic: tighten bounds checking in decode_message()

HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length

Local privilege escalation in NI-PAL

drm/mediatek: fix potential OF node use-after-free

qed: fix double free in qed_cxt_tables_alloc()

rpmsg: char: Fix use-after-free on probe error path

net: wwan: t7xx: fix potential skb->frags overflow in RX path

IBM InfoSphere Server Information command execution

net: pull headers in qdisc_pkt_len_segs_init()

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

KVM: x86: hyper-v: Bound the bank index when querying sparse banks

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable.

An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Broadcom brcmfmac driver is vulnerable to a heap buffer overflow

NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.

Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the command header of a Logical Link Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.

ksmbd: fix potencial out-of-bounds when buffer offset is invalid

ksmbd: validate zero num_subauth before sub_auth is accessed

CommServe Path Traversal

smb: Fix regression in writes when non-standard maximum write size negotiated

ksmbd: require minimum ACE size in smb_check_perm_dacl()