admin/nvd-json-data-feeds
1
0 Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2026-10-29 00:00:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2025-11-19T19:00:12.577764+00:00

Browse Source
This commit is contained in:
cad-safe-bot committed 2025-11-19 19:04:01 +00:00
1 parent 5206f3db14
commit 5680c7e5c0
126 files changed
+8739 -567
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CVE-2022/CVE-2022-502xx/CVE-2022-50233.json
+61 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2022-50233",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-09T15:15:27.723",
"lastModified": "2025-08-11T18:32:48.867",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:13:46.420",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,11 +15,68 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: eir: Correcci\u00f3n del uso de strlen con hdev->{dev_name,short_name} No se garantiza que dev_name y short_name terminen en NULL, por lo que en su lugar se utiliza strnlen y luego se intenta determinar si la cadena resultante debe truncarse o no."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14",
"versionEndExcluding": "6.0",
"matchCriteriaId": "338236CA-28D7-4DF2-86CB-58B5159BA8A3"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/dd7b8cdde098cf9f7c8de409b5b7bbb98f97be80",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2024/CVE-2024-283xx/CVE-2024-28390.json
+3 -3
View File
@@ -2,7 +2,7 @@
"id": "CVE-2024-28390",
"sourceIdentifier": "[email protected]",
"published": "2024-03-14T04:15:09.640",
"lastModified": "2025-06-10T16:45:39.930",
"lastModified": "2025-11-19T18:03:52.397",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@@ -60,9 +60,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:advancedplugins:image_toolbox\\:_webp_compress\\,_regenerate_\\&_more_prestashop_module:*:*:*:*:*:prestashop:*:*",
"criteria": "cpe:2.3:a:advancedplugins:ultimateimagetool:*:*:*:*:*:prestashop:*:*",
"versionEndExcluding": "2.2.01",
"matchCriteriaId": "5B7B02CA-66F0-49F9-B130-570D1F929804"
"matchCriteriaId": "C438184A-8C0F-42A9-A6E6-3E788E879E16"
}
]
}
CVE-2024/CVE-2024-582xx/CVE-2024-58238.json
+72 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-58238",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-09T15:15:27.893",
"lastModified": "2025-08-11T18:32:48.867",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:20:58.210",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,82 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btnxpuart: resolver error de tiempo de espera de TX en la prueba de esfuerzo de ahorro de energ\u00eda Esto corrige el problema de tiempo de espera de TX observado al ejecutar una prueba de esfuerzo en btnxpuart durante un par de horas, de modo que el intervalo entre dos comandos HCI coincida con el valor de tiempo de espera de ahorro de energ\u00eda de 2 segundos. Procedimiento de prueba usando script bash: hciconfig hci0 up //Habilitar funci\u00f3n de ahorro de energ\u00eda hcitool -i hci0 cmd 3f 23 02 00 00 while (true) do hciconfig hci0 leadv sleep 2 hciconfig hci0 noleadv sleep 2 done Registro de errores, despu\u00e9s de agregar algunas impresiones de depuraci\u00f3n m\u00e1s: Bluetooth: btnxpuart_queue_skb(): 01 0A 20 01 00 Bluetooth: hci0: Establecer UART break: activado, estado=0 Bluetooth: hci0: btnxpuart_tx_wakeup() tx_work programado Bluetooth: hci0: btnxpuart_tx_work() dequeue: 01 0A 20 01 00 No se puede establecer el modo de anuncio en hci0: Se agot\u00f3 el tiempo de conexi\u00f3n (110) Bluetooth: hci0: comando 0x200a Tiempo de espera de TX: Cuando el mecanismo de ahorro de energ\u00eda activa la interrupci\u00f3n de UART y btnxpuart_tx_work() se programa simult\u00e1neamente, psdata->ps_state se lee como PS_STATE_AWAKE, lo que impide que se programe psdata->work, que es responsable de desactivar la interrupci\u00f3n de UART. Este problema se soluciona a\u00f1adiendo un mutex ps_lock alrededor de la activaci\u00f3n/desactivaci\u00f3n de la interrupci\u00f3n de UART, as\u00ed como alrededor de la lectura/escritura de ps_state. btnxpuart_tx_wakeup() ahora leer\u00e1 el valor actualizado de ps_state. Si ps_state es PS_STATE_SLEEP, primero programar\u00e1 psdata->work y luego se reprogramar\u00e1 a s\u00ed mismo una vez que la interrupci\u00f3n de UART se haya desactivado y ps_state sea PS_STATE_AWAKE. Prob\u00e9 el script anterior durante 50,000 iteraciones y el error de tiempo de espera de TX ya no se observ\u00f3."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4",
"versionEndExcluding": "6.6.49",
"matchCriteriaId": "B61B0036-48C0-4123-AB2A-796471892EBE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.9",
"matchCriteriaId": "DC98DB83-3CEF-4B4A-B71C-7629C15061A6"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/9d5df94ce0e213d5b549633f528f96114c736190",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e4db90e4eb8d5487098712ffb1048f3fa6d25e98",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2024/CVE-2024-63xx/CVE-2024-6364.json
+3 -3
View File
@@ -2,7 +2,7 @@
"id": "CVE-2024-6364",
"sourceIdentifier": "[email protected]",
"published": "2025-05-13T17:15:50.850",
"lastModified": "2025-07-15T16:24:00.013",
"lastModified": "2025-11-19T17:39:01.667",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@@ -104,9 +104,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:absolute:persistence:*:*:*:*:*:*:*:*",
"criteria": "cpe:2.3:o:absolute:persistence:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.8",
"matchCriteriaId": "259E0E0E-BE36-45B5-807F-061E7A75AF23"
"matchCriteriaId": "D55221DE-D569-42C6-9DB5-791BFC60E245"
}
]
}
CVE-2025/CVE-2025-110xx/CVE-2025-11021.json
+5 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-11021",
"sourceIdentifier": "[email protected]",
"published": "2025-09-26T09:15:31.370",
"lastModified": "2025-11-18T15:16:25.700",
"lastModified": "2025-11-19T18:15:46.313",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@@ -92,6 +92,10 @@
"url": "https://access.redhat.com/errata/RHSA-2025:21666",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:21772",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-11021",
"source": "[email protected]"
CVE-2025/CVE-2025-118xx/CVE-2025-11865.json
+64 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-11865",
"sourceIdentifier": "[email protected]",
"published": "2025-11-15T08:15:43.547",
"lastModified": "2025-11-18T14:06:55.963",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-19T17:59:17.653",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -32,6 +32,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
]
},
@@ -47,14 +67,54 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "18.1.0",
"versionEndExcluding": "18.3.6",
"matchCriteriaId": "0AC48ED5-5EF8-477F-A9F9-E08BE928EC6A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "18.4.0",
"versionEndExcluding": "18.4.4",
"matchCriteriaId": "6D0A238D-1278-4D05-86F5-4C323E0CFE36"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "18.5.0",
"versionEndExcluding": "18.5.2",
"matchCriteriaId": "B2A3A57F-C750-4C92-8C2B-C5FCF1D70F4F"
}
]
}
]
}
],
"references": [
{
"url": "https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/561399",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
}
]
}
CVE-2025/CVE-2025-119xx/CVE-2025-11990.json
+71 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-11990",
"sourceIdentifier": "[email protected]",
"published": "2025-11-15T08:15:45.620",
"lastModified": "2025-11-18T14:06:55.963",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-19T17:55:22.270",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -32,6 +32,26 @@
},
"exploitabilityScore": 1.6,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"baseScore": 3.5,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.1,
"impactScore": 1.4
}
]
},
@@ -45,20 +65,66 @@
"value": "CWE-177"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "18.4.0",
"versionEndExcluding": "18.4.4",
"matchCriteriaId": "6D0A238D-1278-4D05-86F5-4C323E0CFE36"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "18.5.0",
"versionEndExcluding": "18.5.2",
"matchCriteriaId": "B2A3A57F-C750-4C92-8C2B-C5FCF1D70F4F"
}
]
}
]
}
],
"references": [
{
"url": "https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/577850",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://hackerone.com/reports/3257843",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required"
]
}
]
}
CVE-2025/CVE-2025-127xx/CVE-2025-12743.json
+82
View File
@@ -0,0 +1,82 @@
{
"id": "CVE-2025-12743",
"sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
"published": "2025-11-19T17:15:46.003",
"lastModified": "2025-11-19T17:15:46.003",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Looker endpoint for generating new projects from database connections allows users to specify \"looker\" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database.\n\nLooker-hosted and Self-hosted were found to be vulnerable.\nThis issue has already been mitigated for Looker-hosted instances.\u00a0No user action is required for these.\n\n\nSelf-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.\nThe versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :\n * 24.12.106\n * 24.18.198+\n * 25.0.75\n * 25.6.63+\n * 25.8.45+\n * 25.10.33+\n * 25.12.1+\n * 25.14+"
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "RED"
}
}
]
},
"weaknesses": [
{
"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://cloud.google.com/support/bulletins#gcp-2025-052",
"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"
},
{
"url": "https://www.tenable.com/security/research/tra-2025-43",
"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"
}
]
}
CVE-2025/CVE-2025-127xx/CVE-2025-12766.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-12766",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:46.690",
"lastModified": "2025-11-19T18:15:47.457",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry\u00ae AtHoc\u00ae (OnPrem) version 7.21 could allow an attacker to potentially gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS)."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/140929",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-131xx/CVE-2025-13191.json
+76 -8
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-13191",
"sourceIdentifier": "[email protected]",
"published": "2025-11-15T07:15:46.627",
"lastModified": "2025-11-18T14:06:55.963",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:04:24.997",
"vulnStatus": "Analyzed",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
@@ -66,7 +66,7 @@
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
@@ -83,6 +83,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"cvssMetricV2": [
@@ -127,26 +147,74 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:dlink:dir-816l_firmware:2.06.b09:beta:*:*:*:*:*:*",
"matchCriteriaId": "ABE7E66F-20B2-4A39-A845-03E5FBBD9E2A"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:dlink:dir-816l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A17C1E74-E315-4292-AF6B-EEF86B64A63C"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(soap.cgi).pdf",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://vuldb.com/?ctiid.332480",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.332480",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.685543",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://www.dlink.com/",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}
CVE-2025/CVE-2025-133xx/CVE-2025-13315.json
+78
View File
@@ -0,0 +1,78 @@
{
"id": "CVE-2025-13315",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T18:15:47.843",
"lastModified": "2025-11-19T18:15:47.843",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-420"
}
]
}
],
"references": [
{
"url": "https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-133xx/CVE-2025-13316.json
+78
View File
@@ -0,0 +1,78 @@
{
"id": "CVE-2025-13316",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T18:15:48.017",
"lastModified": "2025-11-19T18:15:48.017",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-321"
}
]
}
],
"references": [
{
"url": "https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-134xx/CVE-2025-13400.json
+145
View File
@@ -0,0 +1,145 @@
{
"id": "CVE-2025-13400",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:47.177",
"lastModified": "2025-11-19T17:15:47.177",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Tenda CH22 1.0.0.1. Affected is the function formWrlExtraGet of the file /goform/WrlExtraGet. Performing manipulation of the argument chkHz results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"baseScore": 9.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"availabilityImpact": "COMPLETE"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-119"
},
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"references": [
{
"url": "https://github.com/f000x0/cve/issues/14",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?ctiid.332926",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?id.332926",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?submit.692145",
"source": "[email protected]"
},
{
"url": "https://www.tenda.com.cn/",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-203xx/CVE-2025-20346.json
+34 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-20346",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T17:15:45.630",
"lastModified": "2025-11-14T16:42:03.187",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:16:36.880",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -45,12 +45,43 @@
"value": "CWE-269"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:catalyst_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7.10",
"matchCriteriaId": "5C88A587-FFF4-493C-823F-F958374FC6B6"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-privesc-catc-rYjReeLU",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-203xx/CVE-2025-20349.json
+45 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-20349",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T17:15:45.817",
"lastModified": "2025-11-14T16:42:03.187",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:07:43.197",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,7 +15,7 @@
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
@@ -32,6 +32,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
]
},
@@ -47,10 +67,31 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:catalyst_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7.10",
"matchCriteriaId": "5C88A587-FFF4-493C-823F-F958374FC6B6"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-26xx/CVE-2025-2615.json
+89 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-2615",
"sourceIdentifier": "[email protected]",
"published": "2025-11-15T08:15:45.820",
"lastModified": "2025-11-18T14:06:55.963",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-19T17:46:27.007",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -32,6 +32,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
@@ -47,18 +67,82 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"versionStartIncluding": "16.7.0",
"versionEndExcluding": "18.3.6",
"matchCriteriaId": "3A389C8A-1460-43EC-9B93-2FEE62D6ABF1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "16.7.0",
"versionEndExcluding": "18.3.6",
"matchCriteriaId": "54B0B363-735C-4D9C-B775-BFAD2B28145B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"versionStartIncluding": "18.4.0",
"versionEndExcluding": "18.4.4",
"matchCriteriaId": "36824F52-C9A0-4FB3-91F3-05593E3551E8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "18.4.0",
"versionEndExcluding": "18.4.4",
"matchCriteriaId": "6D0A238D-1278-4D05-86F5-4C323E0CFE36"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"versionStartIncluding": "18.5.0",
"versionEndExcluding": "18.5.2",
"matchCriteriaId": "7E85D20B-EEE1-4CC9-B50A-4040972287D8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "18.5.0",
"versionEndExcluding": "18.5.2",
"matchCriteriaId": "B2A3A57F-C750-4C92-8C2B-C5FCF1D70F4F"
}
]
}
]
}
],
"references": [
{
"url": "https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/526360",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://hackerone.com/reports/3049150",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required"
]
}
]
}
CVE-2025/CVE-2025-295xx/CVE-2025-29592.json
+3 -3
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-29592",
"sourceIdentifier": "[email protected]",
"published": "2025-09-10T16:15:36.553",
"lastModified": "2025-09-22T18:44:33.763",
"lastModified": "2025-11-19T17:06:38.830",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@@ -56,8 +56,8 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:aaluoxiang:oasys:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BCE7E31C-26AC-44BB-9EB9-881DCC22D35B"
"criteria": "cpe:2.3:a:aaluoxiang:oa_system:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82E1964F-6040-42D6-A502-5D03B4E4F9DF"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34328.json
+97
View File
@@ -0,0 +1,97 @@
{
"id": "CVE-2025-34328",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:47.420",
"lastModified": "2025-11-19T17:15:47.420",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which runs as NT AUTHORITY\\\\SYSTEM on Windows deployments. A remote, unauthenticated attacker can write arbitrary files into the product\u2019s web-accessible directory structure and subsequently execute them."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-file-upload-rce-via-ajaxscript",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34329.json
+97
View File
@@ -0,0 +1,97 @@
{
"id": "CVE-2025-34329",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:47.613",
"lastModified": "2025-11-19T17:15:47.613",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates the directory if it does not exist, and then moves an uploaded file to that location using the attacker-controlled filename, without any authentication, authorization, or file-type validation. On default Windows deployments where the backup directory resolves to the system drive, a remote attacker can upload web server or interpreter configuration files that cause a log file or other server-controlled resource to be treated as executable code. This allows subsequent HTTP requests to trigger arbitrary command execution under the web server account, which runs as NT AUTHORITY\\\\SYSTEM."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-backup-upload-rce-via-ajaxbackupuploadfile",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34330.json
+97
View File
@@ -0,0 +1,97 @@
{
"id": "CVE-2025-34330",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:47.777",
"lastModified": "2025-11-19T17:15:47.777",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23\u00a0include a web administration component (F2MAdmin) that exposes an unauthenticated prompt upload endpoint at AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and writes it into the C:\\\\F2MAdmin\\\\tmp directory using a filename derived from application constants, without any authentication, authorization, or file-type validation. A remote, unauthenticated attacker can upload or overwrite prompt- or music-on-hold\u2013related files in this directory, potentially leading to tampering with IVR audio content or preparing files for use in further attacks."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-prompt-file-upload-via-ajaxpromptuploadfile",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34331.json
+97
View File
@@ -0,0 +1,97 @@
{
"id": "CVE-2025-34331",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:47.967",
"lastModified": "2025-11-19T17:15:47.967",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23\u00a0contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remote, unauthenticated users to request files stored on the appliance based solely on attacker-supplied path and filename parameters. While limited to specific file extensions permitted by the application logic, sensitive backup archives can be retrieved, exposing internal databases and credential hashes. Successful exploitation may lead to disclosure of administrative password hashes and other sensitive configuration data."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"references": [
{
"url": "https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-file-read-via-download",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34332.json
+97
View File
@@ -0,0 +1,97 @@
{
"id": "CVE-2025-34332",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:48.133",
"lastModified": "2025-11-19T17:15:48.133",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23\u00a0include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\\\F2MAdmin\\\\F2E\\\\AudioCodes_files\\\\utils\\\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
}
],
"references": [
{
"url": "https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpe",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34333.json
+97
View File
@@ -0,0 +1,97 @@
{
"id": "CVE-2025-34333",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:48.500",
"lastModified": "2025-11-19T17:15:48.500",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23\u00a0configure the web document root at C:\\\\F2MAdmin\\\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
}
],
"references": [
{
"url": "https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-world-writable-webroot-lpe",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34334.json
+97
View File
@@ -0,0 +1,97 @@
{
"id": "CVE-2025-34334",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:48.703",
"lastModified": "2025-11-19T17:15:48.703",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23\u00a0are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax \"send\" test is requested, the application builds a faxsender command line using attacker-supplied parameters and passes it to GlobalUtils::RunBatchFile without proper validation or shell-argument sanitization. The resulting batch file is written into a temporary run directory and then executed via a backend service that runs as NT AUTHORITY\\\\SYSTEM. An authenticated attacker with access to the fax test interface can craft parameter values that inject additional shell commands into the generated batch file, leading to arbitrary command execution with SYSTEM privileges. In addition, because the generated batch files reside in a location with overly permissive file system permissions, a local low-privilege user on the server can modify pending batch files to achieve the same elevation."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"references": [
{
"url": "https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-authenticated-command-injection-via-testfax-and-lpe",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34335.json
+97
View File
@@ -0,0 +1,97 @@
{
"id": "CVE-2025-34335",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:48.900",
"lastModified": "2025-11-19T17:15:48.900",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23\u00a0expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploaded, the application derives a new filename by combining a generated base name with the attacker-controlled extension portion of the original upload name, then constructs a command line for fax_server_lic_cmdline.exe that includes this path. The extension value is incorporated into the command string without input validation, escaping, or proper argument quotation before being passed to exec(). An authenticated user with access to the license upload interface can supply a specially crafted filename whose extension injects additional shell metacharacters, causing arbitrary commands to be executed as NT AUTHORITY\\\\SYSTEM."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"references": [
{
"url": "https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-authenticated-command-injection-via-activatelicense",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34336.json
+94
View File
@@ -0,0 +1,94 @@
{
"id": "CVE-2025-34336",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:49.073",
"lastModified": "2025-11-19T17:15:49.073",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do image upload endpoints. These controllers accept multipart requests without authentication, pass the uploaded content to a shared upload helper, and store the file on the server under a framework-controlled path. The framework then returns a download URL that can be used to retrieve the uploaded content, including an attacker-controlled Content-Type within the limits of the image upload functionality. While a filename extension whitelist is enforced, the attacker fully controls the file contents. The response MIME type used is also attacker-controlled when the file is served up to version < 4.1.2. Since version 4.1.2, it is possible to download any image uploaded with any whitelisted content type. But any file uploaded other than an image will be served with the `application/octet-stream` content type (the content type is no longer controlled by the attacker since version 4.1.2). This enables an unauthenticated attacker to use any affected application as a persistent file hosting service for arbitrary content under the application's origin. KISA/KrCERT has identified this unpatched vulnerability as \"KVE-2023-5280.\""
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://github.com/eGovFramework/egovframe-common-components",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/advisories/2025-egovframe.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.egovframe.go.kr/eng/sub.do?menuNo=2",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/egovframework-unauthenticated-file-upload-via-web-editor-image-upload-endpoints",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-343xx/CVE-2025-34337.json
+94
View File
@@ -0,0 +1,94 @@
{
"id": "CVE-2025-34337",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T17:15:49.257",
"lastModified": "2025-11-19T17:15:49.257",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes\u00a0Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes an encryption oracle that allows attackers to generate valid ciphertext for chosen values. The image upload endpoints /utl/wed/insertImage.do and /utl/wed/insertImageCk.do encrypt server-side paths, filenames, and MIME types and embed them directly into a download URL that is returned to the client. Because these same encrypted parameters are trusted by other endpoints, such as /utl/web/imageSrc.do and /cmm/fms/getImage.do, an unauthenticated attacker can abuse the upload functionality to obtain encrypted representations of attacker-chosen identifiers and then replay those ciphertext values to file-serving APIs. This design failure allows an attacker to bypass access controls that rely solely on the secrecy of encrypted parameters and retrieve arbitrary stored files that are otherwise expected to require an existing session or specific authorization context. KISA/KrCERT has identified this unpatched vulnerability as \"KVE-2023-5281.\""
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-345"
}
]
}
],
"references": [
{
"url": "https://github.com/eGovFramework/egovframe-common-components",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/advisories/2025-egovframe.txt",
"source": "[email protected]"
},
{
"url": "https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html",
"source": "[email protected]"
},
{
"url": "https://www.egovframe.go.kr/eng/sub.do?menuNo=2",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/egovframework-unauthenticated-encryption-oracle-via-web-editor-image-upload-endpoints",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-383xx/CVE-2025-38398.json
+85 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38398",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T13:15:29.303",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:18:07.647",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,95 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: spi-qpic-snand: reasignar transacciones BAM El uso del m\u00f3dulo mtd_nandbiterrs para probar el controlador ocasionalmente da como resultado cosas extra\u00f1as como la siguiente. 1. La asignaci\u00f3n de swiotlb falla con el siguiente mensaje: [85.926216] qcom_snand 79b0000.spi: el b\u00fafer de swiotlb est\u00e1 lleno (sz: 4294967294 bytes), total 512 (ranuras), usado 0 (ranuras) [85.932937] qcom_snand 79b0000.spi: error en la asignaci\u00f3n desc [87.999314] qcom_snand 79b0000.spi: error al escribir la p\u00e1gina sin formato [87.999352] mtd_nandbiterrs: error: write_oob fall\u00f3 (-110) Reiniciar la placa despu\u00e9s de esto provoca un p\u00e1nico debido a una desreferencia de puntero NULL. 2. Si el mapeo swiotlb no falla, reiniciar la placa puede resultar en un p\u00e1nico diferente debido a un spinlock magic defectuoso: [ 256.104459] BUG: spinlock bad magic on CPU#3, procd/2241 [ 256.104488] Unable to handle kernel paging request at virtual address ffffffff0000049b ... La investigaci\u00f3n del problema revel\u00f3 que estos s\u00edntomas son resultados de la corrupci\u00f3n de memoria que es causada por el acceso fuera de los l\u00edmites dentro del controlador. El controlador utiliza una estructura asignada din\u00e1micamente para las transacciones BAM, dicha estructura debe tener suficiente espacio para todas las posibles variaciones de diferentes operaciones flash iniciadas por el controlador. El espacio requerido depende en gran medida del n\u00famero real de 'palabras de c\u00f3digo' que se calcula a partir del tama\u00f1o de p\u00e1gina del chip NAND real. Aunque la funci\u00f3n qcom_nandc_alloc() asigna memoria para las transacciones BAM durante el sondeo, pero como el n\u00famero real de 'palabras de c\u00f3digo' a\u00fan no se conoce, la asignaci\u00f3n se realiza solo para una 'palabra de c\u00f3digo'. Por ello, siempre que el controlador realiza una operaci\u00f3n de flash y el n\u00famero de transacciones requeridas excede el tama\u00f1o de las matrices asignadas, accede a memoria fuera del rango asignado. Para evitarlo, modifique el c\u00f3digo para liberar la memoria de transacciones BAM inicialmente asignada y asigne una nueva una vez que se conozca el n\u00famero real de palabras de c\u00f3digo requeridas para un chip NAND determinado."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15",
"versionEndExcluding": "6.15.6",
"matchCriteriaId": "575B7891-8019-4D0D-B284-1B8DA410C942"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/86fb36de1132b560f9305f0c78fa69f459fa0980",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d85d0380292a7e618915069c3579ae23c7c80339",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38402.json
+96 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38402",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T13:15:29.780",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:18:14.867",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,109 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: idpf: devolver un tama\u00f1o 0 para la clave RSS si no se admite. Devolver -EOPNOTSUPP desde una funci\u00f3n que devuelve u32 provoca una conversi\u00f3n y, como resultado, un valor de tama\u00f1o no v\u00e1lido. Usar -EOPNOTSUPP como tama\u00f1o probablemente provocar\u00e1 un error de asignaci\u00f3n. Comando: ethtool -x eth0. Es visible en todos los dispositivos que no tienen configurados los l\u00edmites RSS. [ 136.615917] Call Trace: [ 136.615921] [ 136.615927] ? __warn+0x89/0x130 [ 136.615942] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.615953] ? report_bug+0x164/0x190 [ 136.615968] ? handle_bug+0x58/0x90 [ 136.615979] ? exc_invalid_op+0x17/0x70 [ 136.615987] ? asm_exc_invalid_op+0x1a/0x20 [ 136.616001] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616016] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.616028] __alloc_pages_noprof+0xe/0x20 [ 136.616038] ___kmalloc_large_node+0x80/0x110 [ 136.616072] __kmalloc_large_node_noprof+0x1d/0xa0 [ 136.616081] __kmalloc_noprof+0x32c/0x4c0 [ 136.616098] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616105] rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616114] ethnl_default_doit+0x107/0x3d0 [ 136.616131] genl_family_rcv_msg_doit+0x100/0x160 [ 136.616147] genl_rcv_msg+0x1b8/0x2c0 [ 136.616156] ? __pfx_ethnl_default_doit+0x10/0x10 [ 136.616168] ? __pfx_genl_rcv_msg+0x10/0x10 [ 136.616176] netlink_rcv_skb+0x58/0x110 [ 136.616186] genl_rcv+0x28/0x40 [ 136.616195] netlink_unicast+0x19b/0x290 [ 136.616206] netlink_sendmsg+0x222/0x490 [ 136.616215] __sys_sendto+0x1fd/0x210 [ 136.616233] __x64_sys_sendto+0x24/0x30 [ 136.616242] do_syscall_64+0x82/0x160 [ 136.616252] ? __sys_recvmsg+0x83/0xe0 [ 136.616265] ? syscall_exit_to_user_mode+0x10/0x210 [ 136.616275] ? do_syscall_64+0x8e/0x160 [ 136.616282] ? __count_memcg_events+0xa1/0x130 [ 136.616295] ? count_memcg_events.constprop.0+0x1a/0x30 [ 136.616306] ? handle_mm_fault+0xae/0x2d0 [ 136.616319] ? do_user_addr_fault+0x379/0x670 [ 136.616328] ? clear_bhb_loop+0x45/0xa0 [ 136.616340] ? clear_bhb_loop+0x45/0xa0 [ 136.616349] ? clear_bhb_loop+0x45/0xa0 [ 136.616359] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 136.616369] RIP: 0033:0x7fd30ba7b047 [ 136.616376] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d bd d5 0c 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 &lt;48&gt; 3d 00 f0 ff ff 77 71 c3 55 48 83 ec 30 44 89 4c 24 2c 4c 89 44 [ 136.616381] RSP: 002b:00007ffde1796d68 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 136.616388] RAX: ffffffffffffffda RBX: 000055d7bd89f2a0 RCX: 00007fd30ba7b047 [ 136.616392] RDX: 0000000000000028 RSI: 000055d7bd89f3b0 RDI: 0000000000000003 [ 136.616396] RBP: 00007ffde1796e10 R08: 00007fd30bb4e200 R09: 000000000000000c [ 136.616399] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d7bd89f340 [ 136.616403] R13: 000055d7bd89f3b0 R14: 000055d78943f200 R15: 0000000000000000"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.37",
"matchCriteriaId": "6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.6",
"matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/018ff57fd79c38be989b8b3248bbe69bcfb77160",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/326e384ee7acbebf0541ac064ac7a4dd1f1dde1d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f77bf1ebf8ff6301ccdbc346f7b52db928f9cbf8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38405.json
+96 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38405",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T14:15:32.077",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:18:34.070",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,109 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvmet: se corrige una fuga de memoria de la integridad de la bio. Si nvmet recibe comandos con metadatos, se produce una fuga de memoria continua de la slab kmalloc-128 o, m\u00e1s precisamente, bio-&gt;bi_integrity. Desde el commit bf4c89fc8797 (\"bloqueo: no llamar a bio_uninit desde bio_endio\"), cada usuario de bio_init debe usar tambi\u00e9n bio_uninit. De lo contrario, la integridad de la bio no se libera. nvmet usa bio_init para la bios en l\u00ednea. Desinicie la bios en l\u00ednea para completar la desasignaci\u00f3n de la integridad en la bio."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.10",
"versionEndExcluding": "6.12.37",
"matchCriteriaId": "692DB691-91FE-43AD-82FA-92BAD9C97C80"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.6",
"matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/190f4c2c863af7cc5bb354b70e0805f06419c038",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2e2028fcf924d1c6df017033c8d6e28b735a0508",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/431e58d56fcb5ff1f9eb630724a922e0d2a941df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38407.json
+96 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38407",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T14:15:32.317",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:19:03.110",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,109 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: cpu_ops_sbi: Usar una matriz est\u00e1tica para boot_data. Desde el commit 6b9f29b81b15 (\"riscv: Habilitar el asignador de primer fragmento de p\u00e1gina pcpu\"), si NUMA est\u00e1 habilitado, el asignador de p\u00e1ginas por CPU puede usarse en configuraciones muy dispersas o cuando se solicita al arrancar con percpu_alloc=page. En ese caso, los datos por CPU se colocan en el \u00e1rea vmalloc. Sin embargo, sbi_hsm_hart_start() necesita la direcci\u00f3n f\u00edsica de sbi_hart_boot_data y simplemente asume que __pa() funcionar\u00eda. Esto provoca que el hart reci\u00e9n iniciado acceda inmediatamente a una direcci\u00f3n no v\u00e1lida y se cuelgue. Afortunadamente, la estructura sbi_hart_boot_data no es demasiado grande, por lo que podemos asignar una matriz est\u00e1ticamente para boot_data, coloc\u00e1ndola en la imagen del kernel. Esto soluciona el problema del arranque SMP con NUMA=y en Sophgo SG2042. Para reproducir en QEMU: Establezca CONFIG_NUMA=y y CONFIG_DEBUG_VIRTUAL=y, luego ejecute con: qemu-system-riscv64 -M virt -smp 2 -nographic \\ -kernel arch/riscv/boot/Image \\ -append \"percpu_alloc=page\" Salida del kernel: [ 0.000000] Booting Linux on hartid 0 [ 0.000000] Linux version 6.16.0-rc1 (dram@sakuya) (riscv64-unknown-linux-gnu-gcc (GCC) 14.2.1 20250322, GNU ld (GNU Binutils) 2.44) #11 SMP Tue Jun 24 14:56:22 CST 2025 ... [ 0.000000] percpu: 28 4K pages/cpu s85784 r8192 d20712 ... [ 0.083192] smp: Bringing up secondary CPUs ... [ 0.086722] ------------[ cut here ]------------ [ 0.086849] virt_to_phys used for non-linear address: (____ptrval____) (0xff2000000001d080) [ 0.088001] WARNING: CPU: 0 PID: 1 at arch/riscv/mm/physaddr.c:14 __virt_to_phys+0xae/0xe8 [ 0.088376] Modules linked in: [ 0.088656] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.16.0-rc1 #11 NONE [ 0.088833] Hardware name: riscv-virtio,qemu (DT) [ 0.088948] epc : __virt_to_phys+0xae/0xe8 [ 0.089001] ra : __virt_to_phys+0xae/0xe8 [ 0.089037] epc : ffffffff80021eaa ra : ffffffff80021eaa sp : ff2000000004bbc0 [ 0.089057] gp : ffffffff817f49c0 tp : ff60000001d60000 t0 : 5f6f745f74726976 [ 0.089076] t1 : 0000000000000076 t2 : 705f6f745f747269 s0 : ff2000000004bbe0 [ 0.089095] s1 : ff2000000001d080 a0 : 0000000000000000 a1 : 0000000000000000 [ 0.089113] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.089131] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000 [ 0.089155] s2 : ffffffff8130dc00 s3 : 0000000000000001 s4 : 0000000000000001 [ 0.089174] s5 : ffffffff8185eff8 s6 : ff2000007f1eb000 s7 : ffffffff8002a2ec [ 0.089193] s8 : 0000000000000001 s9 : 0000000000000001 s10: 0000000000000000 [ 0.089211] s11: 0000000000000000 t3 : ffffffff8180a9f7 t4 : ffffffff8180a9f7 [ 0.089960] t5 : ffffffff8180a9f8 t6 : ff2000000004b9d8 [ 0.089984] status: 0000000200000120 badaddr: ffffffff80021eaa cause: 0000000000000003 [ 0.090101] [] __virt_to_phys+0xae/0xe8 [ 0.090228] [] sbi_cpu_start+0x6e/0xe8 [ 0.090247] [] __cpu_up+0x1e/0x8c [ 0.090260] [] bringup_cpu+0x42/0x258 [ 0.090277] [] cpuhp_invoke_callback+0xe0/0x40c [ 0.090292] [] __cpuhp_invoke_callback_range+0x68/0xfc [ 0.090320] [] _cpu_up+0x11a/0x244 [ 0.090334] [] cpu_up+0x52/0x90 [ 0.090384] [] bringup_nonboot_cpus+0x78/0x118 [ 0.090411] [] smp_init+0x34/0xb8 [ 0.090425] [] kernel_init_freeable+0x148/0x2e4 [ 0.090442] [] kernel_init+0x1e/0x14c [ 0.090455] [] ret_from_fork_kernel+0xe/0xf0 [ 0.090471] [] ret_from_fork_kernel_asm+0x16/0x18 [ 0.090560] ---[ end trace 0000000000000000 ]--- [ 1.179875] CPU1: failed to come online [ 1.190324] smp: Brought up 1 node, 1 CPU"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8",
"versionEndExcluding": "6.12.37",
"matchCriteriaId": "366673BD-D793-4DB6-9C97-ADF13DFEBA1F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.6",
"matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/02c725cd55eb5052b88eeaa3f60a391ef4dcaec5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2b29be967ae456fc09c320d91d52278cf721be1e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f5fe094f35a37adea40b2fd52c99bb1333be9b07",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38408.json
+86 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38408",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T14:15:32.440",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:19:13.603",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,99 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: genirq/irq_sim: Inicializar correctamente los punteros del contexto de trabajo. Inicializar correctamente los punteros del miembro `ops` usando kzalloc() en lugar de kmalloc() al asignar el contexto de trabajo de simulaci\u00f3n. De lo contrario, los punteros contienen contenido aleatorio, lo que provoca una desreferenciaci\u00f3n no v\u00e1lida."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8",
"versionEndExcluding": "6.12.37",
"matchCriteriaId": "0A1AA99A-84C5-4F7F-B9AD-5A171DA2B7A0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.6",
"matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/19bd7597858dd15802c1d99fcc38e528f469080a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7f73d1def72532bac4d55ea8838f457a6bed955c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38411.json
+85 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38411",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T14:15:32.790",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:23:03.220",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,95 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfs: Corregir doble put de solicitud Si una solicitud netfs finaliza durante el bucle de pausa, tendr\u00e1 la referencia que pertenece al indicador IN_PROGRESS eliminada en ese punto; sin embargo, si luego va al bucle de espera final, eso *tambi\u00e9n* pondr\u00e1 la referencia porque ve que el indicador IN_PROGRESS est\u00e1 limpio y asume incorrectamente que esto sucedi\u00f3 cuando llam\u00f3 al recopilador. De hecho, como IN_PROGRESS est\u00e1 limpio, no deber\u00edamos volver a llamar al recopilador ya que ha hecho toda la limpieza, como llamar a -&gt;ki_complete(). Corrija esto haciendo que netfs_collect_in_app() simplemente regrese, lo que indica que hemos terminado si se elimina IN_PROGRESS."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-415"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.3",
"versionEndExcluding": "6.15.6",
"matchCriteriaId": "03C8347D-D0BB-400D-85B2-E313F34D93AD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/9df7b5ebead649b00bf9a53a798e4bf83a1318fd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d18facba5a5795ad44b2a00a052e3db2fa77ab12",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38413.json
+96 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38413",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T14:15:33.017",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:23:29.607",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,109 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-net: xsk: rx: correcci\u00f3n de la comprobaci\u00f3n de la longitud del marco. Al llamar a buf_to_xdp, el argumento len es la longitud de los datos del marco sin la longitud del encabezado de Virtio (vi-&gt;hdr_len). Comprobamos esta longitud con xsk_pool_get_rx_frame_size() + vi-&gt;hdr_len para garantizar que la longitud proporcionada no supere el tama\u00f1o del fragmento asignado. El valor adicional de vi-&gt;hdr_len se debe a que, en virtnet_add_recvbuf_xsk, usamos parte de XDP_PACKET_HEADROOM para el encabezado de virtio y solicitamos al vhost que comience a colocar datos desde hard_start + XDP_PACKET_HEADROOM - vi-&gt;hdr_len, no hard_start + XDP_PACKET_HEADROOM. Sin embargo, el primer b\u00fafer tiene virtio_header, por lo que la longitud m\u00e1xima del fotograma en el primer b\u00fafer solo puede ser xsk_pool_get_rx_frame_size(), no xsk_pool_get_rx_frame_size() + vi-&gt;hdr_len, como en la comprobaci\u00f3n actual. Este commit a\u00f1ade un argumento adicional a buf_to_xdp para diferenciar entre el primer b\u00fafer y los dem\u00e1s y calcular correctamente la longitud m\u00e1xima del fotograma."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11",
"versionEndExcluding": "6.12.37",
"matchCriteriaId": "EE1FC310-514B-4D67-A65A-36DA37296733"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.6",
"matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/5177373c31318c3c6a190383bfd232e6cf565c36",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/6013bb6bc24c2cac3f45b37a15b71b232a5b00ff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/892f6ed9a4a38bb3360fdff091b9241cfa105b61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38414.json
+81 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38414",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T14:15:33.140",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:59:15.207",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,94 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: correcci\u00f3n de la definici\u00f3n de GCC_GCC_PCIE_HOT_RST para WCN7850. GCC_GCC_PCIE_HOT_RST est\u00e1 mal definido para WCN7850, lo que provoca un fallo del kernel en algunas plataformas espec\u00edficas. Dado que este registro es divergente para WCN7850 y QCN9274, mu\u00e9valo a la tabla de registros para permitir definiciones diferentes. A continuaci\u00f3n, corrija la direcci\u00f3n del registro de WCN7850 para solucionar este problema. Nota: IPQ5332 no se ve afectado, ya que no es un dispositivo basado en PCIe. Probado en: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3",
"versionEndExcluding": "6.12.34",
"matchCriteriaId": "55CA54BF-D496-4699-979F-8DAA815A3A55"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.3",
"matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/569972c5bdb839b0eaf8aba6ce76ea0b78e2acf8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7588a893cde5385ad308400ff167d29a29913b3a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d71ac5694b33c80f1de97d074f6fbdc6c01a9d61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38417.json
+86 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38417",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T14:15:33.493",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:59:24.477",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,99 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: se corrige la fuga de memoria del c\u00f3digo de eswitch en el escenario de reinicio. Se a\u00f1ade un verificador simple del modo eswitch al procedimiento de conexi\u00f3n de VF y se asignan las estructuras de memoria requeridas para el representante de puerto solo en el modo switchdev. Los flujos de reinicio activan el procedimiento de desconexi\u00f3n/conexi\u00f3n de VF (si est\u00e1 presente). Podr\u00eda implicar la recreaci\u00f3n del/de los representante(s) de puerto de VF si el dispositivo est\u00e1 configurado en modo switchdev (no en el modo heredado). La memoria se asignaba ciegamente en la implementaci\u00f3n actual, independientemente del modo, y no se liberaba en el modo heredado. Rastreo de Kmemeleak: objeto sin referencia (percpu) 0x7e3bce5b888458 (size 40): comm \"bash\", pid 1784, jiffies 4295743894 hex dump (first 32 bytes on cpu 45): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): pcpu_alloc_noprof+0x4c4/0x7c0 ice_repr_create+0x66/0x130 [ice] ice_repr_create_vf+0x22/0x70 [ice] ice_eswitch_attach_vf+0x1b/0xa0 [ice] ice_reset_all_vfs+0x1dd/0x2f0 [ice] ice_pci_err_resume+0x3b/0xb0 [ice] pci_reset_function+0x8f/0x120 reset_store+0x56/0xa0 kernfs_fop_write_iter+0x120/0x1b0 vfs_write+0x31c/0x430 ksys_write+0x61/0xd0 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Testing hints (ethX is PF netdev): - create at least one VF echo 1 &gt; /sys/class/net/ethX/device/sriov_numvfs - trigger the reset echo 1 &gt; /sys/class/net/ethX/device/reset"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12",
"versionEndExcluding": "6.12.35",
"matchCriteriaId": "B9A5A6B0-4B32-4F26-8142-EF867203ADBB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.4",
"matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/48c8b214974dc55283bd5f12e3a483b27c403bbc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d6715193de439b79f1d6a4c03593c7529239b545",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e97a7a051b55f55f276c1568491d0ed7f890ee94",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38421.json
+99 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38421",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:26.927",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:59:33.060",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,109 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: platform/x86/amd: pmf: Usar asignaciones administradas por dispositivo. Si la configuraci\u00f3n de Smart PC falla por cualquier motivo, esto puede provocar una doble liberaci\u00f3n al descargar amd-pmf. Esto se debe a que dev-&gt;buf se liber\u00f3, pero nunca se configur\u00f3 como NULL y se libera de nuevo en amd_pmf_remove(). Para evitar errores sutiles de asignaci\u00f3n en fallos que provoquen una doble liberaci\u00f3n, cambie todas las asignaciones a asignaciones administradas por dispositivo."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-415"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.23",
"versionEndExcluding": "6.13",
"matchCriteriaId": "50F52A53-697C-4085-B8FE-105DE882578F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.11",
"versionEndExcluding": "6.14",
"matchCriteriaId": "124AE182-7E9F-4410-9E08-5976ED49C6A4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.1",
"versionEndExcluding": "6.15.4",
"matchCriteriaId": "A43298F2-A0DE-4797-B4E4-14DE5F4D5EED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*",
"matchCriteriaId": "7DE421BA-0600-4401-A175-73CAB6A6FB4E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*",
"matchCriteriaId": "AD948719-8628-4421-A340-1066314BBD4A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38423.json
+76 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38423",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:27.153",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:59:40.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,89 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: codecs: wcd9375: Se corrige la doble liberaci\u00f3n de los suministros del regulador. El controlador obtiene los suministros del regulador en la ruta de la sonda con devm_regulator_bulk_get(), por lo que no deber\u00eda llamar a regulator_bulk_free() por error y eliminar las rutas para evitar la doble liberaci\u00f3n."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-415"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11",
"versionEndExcluding": "6.12.35",
"matchCriteriaId": "50E16863-852A-4232-B230-626F86B126F4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.4",
"matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/63fe298652d4eda07d738bfcbbc59d1343a675ef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/c8228b5f3d74fd8ad4dfc79d5d601eb6fca5e63e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ce30258c05d39b62a05c99016d7148b3bf60fbdc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38426.json
+65 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38426",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:27.510",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:59:45.190",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,75 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: Se ha a\u00f1adido validaci\u00f3n b\u00e1sica para el encabezado RAS. Si el encabezado RAS le\u00eddo desde la EEPROM est\u00e1 da\u00f1ado, podr\u00eda intentar asignar una gran cantidad de memoria para leer los registros. Se ha a\u00f1adido validaci\u00f3n a los campos del encabezado."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4",
"versionEndExcluding": "6.15.4",
"matchCriteriaId": "5DD8B476-3CB0-45CC-89B4-31ECFFA5F19D"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/5df0d6addb7e9b6f71f7162d1253762a5be9138e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b52f52bc5ba9feb026c0be600f8ac584fd12d187",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38427.json
+87 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38427",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:27.623",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:59:50.960",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,103 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: video: screen_info: Reubicar framebuffers detr\u00e1s de puentes PCI. Aplicar desplazamientos de ventana del puente host PCI a los framebuffers de screen_info. Corrige el acceso no v\u00e1lido a la memoria de E/S. Los recursos detr\u00e1s de un puente host PCI se pueden reubicar mediante un desplazamiento determinado en el rango de direcciones de CPU del kernel utilizado para E/S. El rango de memoria del framebuffer almacenado en screen_info se refiere a las direcciones de CPU tal como se ven durante el arranque (donde el desplazamiento es 0). Durante el arranque, el firmware puede asignar un desplazamiento de memoria diferente al puente host PCI y, por lo tanto, reubicar la direcci\u00f3n del framebuffer del dispositivo gr\u00e1fico PCI tal como lo ve el kernel. La informaci\u00f3n en screen_info tambi\u00e9n debe actualizarse. El asistente pcibios_bus_to_resource() realiza la reubicaci\u00f3n del recurso framebuffer de screen_info (indicado en direcciones de bus PCI). El resultado coincide con el recurso de memoria de E/S del dispositivo gr\u00e1fico PCI (indicado en direcciones de CPU). Como antes, almacenamos la informaci\u00f3n necesaria para actualizarla posteriormente en screen_info. El commit 78aa89d1dfba (\"firmware/sysfb: Update screen_info for relocated EFI framebuffers\" agreg\u00f3 el c\u00f3digo para actualizar screen_info. Se basa en una funcionalidad similar a la que ya exist\u00eda en efifb. Efifb usa un puntero al recurso PCI, mientras que el c\u00f3digo m\u00e1s reciente realiza un memcpy de la regi\u00f3n. Por lo tanto, efifb detecta cualquier actualizaci\u00f3n del recurso PCI y evita el problema. v3: - Usar struct pci_bus_region solo para direcciones de bus PCI (Bjorn) - Aclarar la sem\u00e1ntica de las direcciones en los mensajes y comentarios de la confirmaci\u00f3n (Bjorn) v2: - Etiquetas corregidas (Takashi, Ivan) - Informaci\u00f3n actualizada sobre efifb"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.45",
"versionEndExcluding": "6.6.95",
"matchCriteriaId": "420E8E58-A848-4DA3-8E0A-04C795EE80F8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9",
"versionEndExcluding": "6.12.35",
"matchCriteriaId": "B4D83789-E054-44F6-92F6-ABE7750DE9A0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.4",
"matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/2f29b5c231011b94007d2c8a6d793992f2275db1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5c70e3ad85d2890d8af375333699429de26327f2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/aeda386d86d79269a08f470dbdc53d13a91e51fa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/cc3cc41ed67054a03134bea42408c720eec0fa04",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38429.json
+1 -1
View File
@@ -3,7 +3,7 @@
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:27.870",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"cveTags": [],
"descriptions": [
{
CVE-2025/CVE-2025-384xx/CVE-2025-38432.json
+80 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38432",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:28.263",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:12:08.420",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,90 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: netpoll: Inicializar el campo de suma de comprobaci\u00f3n UDP antes del commit de suma de comprobaci\u00f3n f1fce08e63fe (\"netpoll: Eliminar la asignaci\u00f3n redundante\") elimin\u00f3 la inicializaci\u00f3n de la suma de comprobaci\u00f3n UDP, lo cual era incorrecto y rompi\u00f3 la transmisi\u00f3n IPv6 de netpoll debido a una suma de comprobaci\u00f3n incorrecta. udph-&gt;check debe configurarse antes de llamar a csum_ipv6_magic()."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15",
"versionEndExcluding": "6.15.5",
"matchCriteriaId": "F4823E88-411C-4CCD-AA8D-3917D070E873"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/353016ec159f939a380ff6746476a779367ba9a3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f5990207026987a353d5a95204c4d9cb725637fd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38433.json
+80 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38433",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:28.570",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:08:35.140",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,90 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: se corrige el soporte de constantes de tiempo de ejecuci\u00f3n para kernels nommu la funci\u00f3n `__runtime_fixup_32` no maneja el caso donde `val` es cero correctamente (como podr\u00eda ocurrir al parchar un kernel nommu y hacer referencia a una direcci\u00f3n f\u00edsica por debajo del l\u00edmite de 4GiB cuyos 32 bits superiores son todos cero) porque nada en la l\u00f3gica existente evita que el c\u00f3digo tome la rama `else` de ambos nop-checks y emita dos instrucciones `nop`. Esto deja basura aleatoria en el registro que se supone que recibe los 32 bits superiores del puntero en lugar de cero que, cuando se combina con el valor de los 32 bits inferiores, produce un puntero no v\u00e1lido y causa un p\u00e1nico del kernel cuando finalmente se accede a ese puntero. El autor consider\u00f3 claramente que si la instrucci\u00f3n `lui` se convierte en `nop`, la segunda instrucci\u00f3n debe ajustarse para que se convierta en `li` en lugar de `addi`, introduciendo as\u00ed la variable `addi_insn_mask`. Sin embargo, no sigui\u00f3 esta l\u00f3gica completamente hasta el caso en que se ejecuta la rama `else`. Para solucionarlo, simplemente ajuste la l\u00f3gica para garantizar que la segunda rama `else` no se ejecute si la primera instrucci\u00f3n se convierte en `nop`."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15",
"versionEndExcluding": "6.15.5",
"matchCriteriaId": "F4823E88-411C-4CCD-AA8D-3917D070E873"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/0a24b00dcde83934a3cc13e4c6b775522903496b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/8d90d9872edae7e78c3a12b98e239bfaa66f3639",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38434.json
+91 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38434",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:28.707",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:08:53.590",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,104 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Revertir \"riscv: Define TASK_SIZE_MAX for __access_ok()\". Esto revierte el commit ad5643cf2f69 (\"riscv: Define TASK_SIZE_MAX for __access_ok()\"). Este commit cambia TASK_SIZE_MAX a LONG_MAX para optimizar access_ok(), ya que el valor predeterminado de TASK_SIZE_MAX (predeterminado) requiere c\u00e1lculos. El razonamiento era que todas las direcciones de usuario son menores que LONG_MAX y todas las direcciones de kernel son mayores que LONG_MAX. Por lo tanto, access_ok() puede filtrar direcciones de kernel. Las direcciones entre TASK_SIZE y LONG_MAX no son direcciones de usuario v\u00e1lidas, pero access_ok() las deja pasar. Se consider\u00f3 que esto era correcto, ya que no son direcciones v\u00e1lidas a nivel de hardware. Desafortunadamente, se omite un caso: get_user_pages_fast() acepta direcciones entre TASK_SIZE y LONG_MAX. futex(), por ejemplo, usa get_user_pages_fast(). Esto causa el problema reportado por Robert [1]. Por lo tanto, revierte este commit . TASK_SIZE_MAX se cambia al valor predeterminado: TASK_SIZE. Lamentablemente, esto reduce el rendimiento, ya que TASK_SIZE es m\u00e1s costoso de calcular que LONG_MAX. Pero primero la correcci\u00f3n; podemos pensar en la optimizaci\u00f3n m\u00e1s adelante, si es necesario."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10",
"versionEndExcluding": "6.12.36",
"matchCriteriaId": "7D12ED65-B7F2-463D-B728-1F34443EA43B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.5",
"matchCriteriaId": "0CC768E2-3BBC-4A6E-9C2F-ECB27A703C2D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/890ba5be6335dbbbc99af14ea007befb5f83f174",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f8b1898748dfeb4f9b67b6a6d661f354b9de3523",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/fe30c30bf3bb68d4a4d8c7c814769857b5c973e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38435.json
+80 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38435",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:28.837",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:09:11.833",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,90 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: vector: Se corrige el guardado/restauraci\u00f3n de contexto con xtheadvector. Anteriormente, solo se guardaban/restauraban correctamente las versiones v0 a v7, y el contexto de las versiones v8 a v31 estaba da\u00f1ado. Guarde/restaure correctamente las versiones v8 a v31 para evitar la interrupci\u00f3n del espacio de usuario."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14",
"versionEndExcluding": "6.15.5",
"matchCriteriaId": "B778A5DA-B42B-4637-8580-7B4583B0061B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/4262bd0d9cc704ea1365ac00afc1272400c2cbef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38436.json
+87 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38436",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T15:15:29.000",
"lastModified": "2025-07-25T15:29:19.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:09:46.640",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,103 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/scheduler: se\u00f1al de valla programada al finalizar un trabajo. Cuando se finaliza una entidad de la aplicaci\u00f3n B, drm_sched_entity_kill() elimina todos los trabajos pertenecientes a esa entidad mediante drm_sched_entity_kill_jobs_work(). Si el trabajo de la aplicaci\u00f3n A depende de una valla programada del trabajo de la aplicaci\u00f3n B, y dicha valla no se se\u00f1aliza correctamente durante el proceso de finalizaci\u00f3n, no se puede eliminar la dependencia de la aplicaci\u00f3n A. Esto provoca que la aplicaci\u00f3n A se cuelgue indefinidamente mientras espera una dependencia que nunca se resolver\u00e1. Solucione este problema asegur\u00e1ndose de que las vallas programadas se se\u00f1alicen correctamente cuando se finaliza una entidad, lo que permite que las aplicaciones dependientes contin\u00faen su ejecuci\u00f3n."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-667"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.3",
"versionEndExcluding": "6.6.96",
"matchCriteriaId": "F0728C84-7187-4266-82A6-45CF39DEE5BA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.36",
"matchCriteriaId": "2BD88DEC-018F-4F40-8E29-A2CA89813EBA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.5",
"matchCriteriaId": "0CC768E2-3BBC-4A6E-9C2F-ECB27A703C2D"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/471db2c2d4f80ee94225a1ef246e4f5011733e50",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/aa382a8b6ed483e9812d0e63b6d1bdcba0186f29",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/aefd0a935625165a6ca36d0258d2d053901555df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/c5734f9bab6f0d40577ad0633af4090a5fda2407",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38438.json
+91 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38438",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:29.143",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:09:51.987",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,104 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: SOF: Intel: hda: Usar devm_kstrdup() para evitar fugas de memoria. La direcci\u00f3n de sof_pdata-&gt;tplg_filename puede ser asignada por kstrdup() y puede sobrescribirse. Se detect\u00f3 una fuga de memoria con kmemleak:unreferenced object 0xffff88812391ff60 (size 16): comm \"kworker/4:1\", pid 161, jiffies 4294802931 hex dump (first 16 bytes): 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. backtrace (crc 4bf1675c): __kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] sof_init_environment+0x16f/0xb50 [snd_sof] sof_probe_continue+0x45/0x7c0 [snd_sof] sof_probe_work+0x1e/0x40 [snd_sof] process_one_work+0x894/0x14b0 worker_thread+0x5e5/0xfb0 kthread+0x39d/0x760 ret_from_fork+0x31/0x70 ret_from_fork_asm+0x1a/0x30"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.2",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "32CB8F59-5702-4FE4-9C29-100A35495565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/58ecf51af12cb32b890858b52b2c34e80590c74a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/68397fda2caa90e99a7c0bcb2cf604e42ef3b91f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38440.json
+101 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38440",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:29.390",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:09:59.133",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,114 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: Se corrige la competencia entre la desactivaci\u00f3n de DIM y net_dim(). Existe una competencia entre la desactivaci\u00f3n de las devoluciones de llamada de DIM y NAPI mediante el puntero dim en el RQ o SQ. Si NAPI comprueba el bit de estado de DIM y lo ve a\u00fan establecido, asume que `rq-&gt;dim` o `sq-&gt;dim` son v\u00e1lidos. Sin embargo, si DIM se desactiva justo despu\u00e9s de dicha comprobaci\u00f3n, es posible que el puntero ya est\u00e9 establecido en NULL, lo que provoca una desreferencia de puntero NULL en net_dim(). Para solucionar esto, llame a `synchronize_net()` antes de liberar el contexto de DIM. Esto garantiza que todas las devoluciones de llamada de NAPI en curso finalicen antes de que se borre el puntero. Kernel log: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:net_dim+0x23/0x190 ... Call Trace: ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? common_interrupt+0xf/0xa0 ? sysvec_call_function_single+0xb/0x90 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? net_dim+0x23/0x190 ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core] ? sysvec_apic_timer_interrupt+0xb/0x90 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core] mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core] ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core] busy_poll_stop+0xa2/0x200 ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core] ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core] __napi_busy_loop+0x345/0x3b0 ? sysvec_call_function_single+0xb/0x90 ? asm_sysvec_call_function_single+0x16/0x20 ? sysvec_apic_timer_interrupt+0xb/0x90 ? pcpu_free_area+0x1e4/0x2e0 napi_busy_loop+0x11/0x20 xsk_recvmsg+0x10c/0x130 sock_recvmsg+0x44/0x70 __sys_recvfrom+0xbc/0x130 ? __schedule+0x398/0x890 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "5E0A7E52-CDBF-45E4-8338-F679910D5C1B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/2bc6fb90486e42dd80e660ef7a40c02b2516c6d6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7581afc051542e11ccf3ade68acd01b7fb1a3cde",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/eb41a264a3a576dc040ee37c3d9d6b7e2d9be968",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38442.json
+90 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38442",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:29.630",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:10:03.837",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,100 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloque: rechazar dispositivos de bloque bs &gt; ps cuando THP est\u00e1 deshabilitado Si THP est\u00e1 deshabilitado y cuando hay un dispositivo de bloque con un tama\u00f1o de bloque l\u00f3gico &gt; tama\u00f1o de p\u00e1gina, se produce el siguiente p\u00e1nico de desreferencia de ptr nulo durante el arranque:[ [13.2 mK AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07] [ 13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380 [ 13.025448] Call Trace: [ 13.025692] [ 13.025895] block_read_full_folio+0x610/0x780 [ 13.026379] ? __pfx_blkdev_get_block+0x10/0x10 [ 13.027008] ? __folio_batch_add_and_move+0x1fa/0x2b0 [ 13.027548] ? __pfx_blkdev_read_folio+0x10/0x10 [ 13.028080] filemap_read_folio+0x9b/0x200 [ 13.028526] ? __pfx_filemap_read_folio+0x10/0x10 [ 13.029030] ? __filemap_get_folio+0x43/0x620 [ 13.029497] do_read_cache_folio+0x155/0x3b0 [ 13.029962] ? __pfx_blkdev_read_folio+0x10/0x10 [ 13.030381] read_part_sector+0xb7/0x2a0 [ 13.030805] read_lba+0x174/0x2c0 [ 13.045348] nvme_scan_ns+0x684/0x850 [nvme_core] [ 13.045858] ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core] [ 13.046414] ? _raw_spin_unlock+0x15/0x40 [ 13.046843] ? __switch_to+0x523/0x10a0 [ 13.047253] ? kvm_clock_get_cycles+0x14/0x30 [ 13.047742] ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core] [ 13.048353] async_run_entry_fn+0x96/0x4f0 [ 13.048787] process_one_work+0x667/0x10a0 [ 13.049219] worker_thread+0x63c/0xf60 Como la compatibilidad con folios grandes depende de THP, solo se permiten dispositivos de bloque bs &gt; ps si THP est\u00e1 habilitado."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "FBA11932-25B2-4915-A601-431072CDC904"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/4cdf1bdd45ac78a088773722f009883af30ad318",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b025d81b96bfe8a62b6e3e6ac776608206ccbf6d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38446.json
+101 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38446",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:30.100",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:48:51.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,114 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: imx: Se corrige un acceso fuera de los l\u00edmites en dispmix_csr_clk_dev_data. Cuando num_parents es 4, __clk_register() genera un acceso fuera de los l\u00edmites al acceder al miembro parent_names. Use ARRAY_SIZE() en lugar de codificar el n\u00famero. BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x8c/0xcc print_report+0x398/0x5fc kasan_report+0xd4/0x114 __asan_report_load8_noabort+0x20/0x2c __clk_register+0x1844/0x20d8 clk_hw_register+0x44/0x110 __clk_hw_register_mux+0x284/0x3a8 imx95_bc_probe+0x4f4/0xa70"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "5E0A7E52-CDBF-45E4-8338-F679910D5C1B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/a956daad67cec454ee985e103e167711fab5b9b8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/aacc875a448d363332b9df0621dde6d3a225ea9f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/fcee75daecc5234ee3482d8cf3518bf021d8a0a5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38447.json
+90 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38447",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:30.210",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:49:00.113",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,100 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/rmap: corrige el posible acceso fuera de los l\u00edmites de la tabla de p\u00e1ginas durante la desasignaci\u00f3n por lotes Como se\u00f1al\u00f3 David[1], la l\u00f3gica de desasignaci\u00f3n por lotes en try_to_unmap_one() puede leer m\u00e1s all\u00e1 del final de una tabla PTE cuando las asignaciones PTE de un folio grande no est\u00e1n completamente contenidas dentro de una sola tabla de p\u00e1ginas. Si bien este escenario puede ser poco com\u00fan, un problema desencadenable desde el espacio de usuario debe corregirse independientemente de su probabilidad. Este parche corrige el acceso fuera de los l\u00edmites refactorizando la l\u00f3gica en un nuevo ayudante, folio_unmap_pte_batch(). El nuevo ayudante calcula correctamente el tama\u00f1o de lote seguro al limitar el escaneo en los l\u00edmites de VMA y PMD. Para simplificar el c\u00f3digo, tambi\u00e9n admite el procesamiento por lotes parcial (es decir, cualquier n\u00famero de p\u00e1ginas desde 1 hasta el m\u00e1ximo seguro calculado), ya que no hay una raz\u00f3n s\u00f3lida para un caso especial de folios completamente mapeados."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "FBA11932-25B2-4915-A601-431072CDC904"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/510fe9c15d07e765d96be9a9dc37e5057c6c09f4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ddd05742b45b083975a0855ef6ebbf88cf1f532a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38449.json
+106 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38449",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:30.443",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:52:35.217",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,122 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/gem: Adquisici\u00f3n de referencias en manejadores GEM para framebuffers. Un manejador GEM puede liberarse mientras el objeto de b\u00fafer GEM est\u00e1 asociado a un framebuffer DRM. Esto provoca la liberaci\u00f3n del dma-buf que respalda el objeto de b\u00fafer, si lo hay. [1] Intentar usar el framebuffer en otras operaciones de configuraci\u00f3n de modo provoca un fallo de segmentaci\u00f3n. Esto ocurre con mayor frecuencia con controladores que utilizan planos de sombra para vmapear el dma-buf durante un cambio de p\u00e1gina. A continuaci\u00f3n se muestra un ejemplo. [ 156.791968] ------------[ cut here ]------------ [ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430 [...] [ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430 [ 157.043420] Call Trace: [ 157.045898] [ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710 [ 157.065567] ? dma_buf_vmap+0x224/0x430 [ 157.069446] ? __warn.cold+0x58/0xe4 [ 157.073061] ? dma_buf_vmap+0x224/0x430 [ 157.077111] ? report_bug+0x1dd/0x390 [ 157.080842] ? handle_bug+0x5e/0xa0 [ 157.084389] ? exc_invalid_op+0x14/0x50 [ 157.088291] ? asm_exc_invalid_op+0x16/0x20 [ 157.092548] ? dma_buf_vmap+0x224/0x430 [ 157.096663] ? dma_resv_get_singleton+0x6d/0x230 [ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10 [ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10 [ 157.110697] drm_gem_shmem_vmap+0x74/0x710 [ 157.114866] drm_gem_vmap+0xa9/0x1b0 [ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0 [ 157.123086] drm_gem_fb_vmap+0xab/0x300 [ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10 [ 157.133032] ? lockdep_init_map_type+0x19d/0x880 [ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0 [ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180 [ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40 [...] [ 157.346424] ---[ end trace 0000000000000000 ]--- Acquiring GEM handles for the framebuffer's GEM buffer objects prevents this from happening. The framebuffer's cleanup later puts the handle references. Commit 1a148af06000 (\"drm/gem-shmem: Use dma_buf from GEM object instance\") triggers the segmentation fault easily by using the dma-buf field more widely. The underlying issue with reference counting has been present before. v2: - acquire the handle instead of the BO (Christian) - fix comment style (Christian) - drop the Fixes tag (Christian) - rename err_ gotos - add missing Link tag"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.99",
"matchCriteriaId": "F6143891-B8E1-437B-A985-B55E960DD92D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "18D57670-11F8-4B5A-AD56-EA32DD0F44E1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/08480e285c6a82ce689008d643e4a51db0aaef8b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/3cf520d9860d4ec9f7f32068825da31f18dd3f25",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5307dce878d4126e1b375587318955bd019c3741",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/cb4c956a15f8b7f870649454771fc3761f504b5f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38450.json
+101 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38450",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:30.560",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:52:45.297",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,114 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mt76: mt7925: evitar la desreferencia de puntero nulo en mt7925_sta_set_decap_offload(). Se ha a\u00f1adido una comprobaci\u00f3n nula para msta-&gt;vif antes de acceder a sus miembros para evitar un p\u00e1nico del kernel en la implementaci\u00f3n en modo AP. Esto tambi\u00e9n soluciona el problema reportado en [1]. El fallo se produce cuando esta funci\u00f3n se activa antes de que la estaci\u00f3n se inicialice por completo. El seguimiento de llamadas muestra un fallo de p\u00e1gina en mt7925_sta_set_decap_offload() debido al acceso a recursos cuando msta-&gt;vif es nulo. Para solucionar esto, se a\u00f1ade un retorno anticipado si msta-&gt;vif es nulo y se comprueba que wcid.sta est\u00e9 listo. Esto garantiza que solo procedamos con la configuraci\u00f3n de descarga de decap cuando el estado de la estaci\u00f3n se inicialice correctamente. [14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0 [14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G [14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE [14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) [14739.831577] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [14739.838538] pc : mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.845271] lr : mt7925_sta_set_decap_offload+0x58/0x1b8 [mt7925_common] [14739.851985] sp : ffffffc085efb500 [14739.855295] x29: ffffffc085efb500 x28: 0000000000000000 x27: ffffff807803a158 [14739.862436] x26: ffffff8041ececb8 x25: 0000000000000001 x24: 0000000000000001 [14739.869577] x23: 0000000000000001 x22: 0000000000000008 x21: ffffff8041ecea88 [14739.876715] x20: ffffff8041c19ca0 x19: ffffff8078031fe0 x18: 0000000000000000 [14739.883853] x17: 0000000000000000 x16: ffffffe2aeac1110 x15: 000000559da48080 [14739.890991] x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000000 [14739.898130] x11: 0a10020001008e88 x10: 0000000000001a50 x9 : ffffffe26457bfa0 [14739.905269] x8 : ffffff8042013bb0 x7 : ffffff807fb6cbf8 x6 : dead000000000100 [14739.912407] x5 : dead000000000122 x4 : ffffff80780326c8 x3 : 0000000000000000 [14739.919546] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8041ececb8 [14739.926686] Call trace: [14739.929130] mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.935505] ieee80211_check_fast_rx+0x19c/0x510 [mac80211] [14739.941344] _sta_info_move_state+0xe4/0x510 [mac80211] [14739.946860] sta_info_move_state+0x1c/0x30 [mac80211] [14739.952116] sta_apply_auth_flags.constprop.0+0x90/0x1b0 [mac80211] [14739.958708] sta_apply_parameters+0x234/0x5e0 [mac80211] [14739.964332] ieee80211_add_station+0xdc/0x190 [mac80211] [14739.969950] nl80211_new_station+0x46c/0x670 [cfg80211] [14739.975516] genl_family_rcv_msg_doit+0xdc/0x150 [14739.980158] genl_rcv_msg+0x218/0x298 [14739.983830] netlink_rcv_skb+0x64/0x138 [14739.987670] genl_rcv+0x40/0x60 [14739.990816] netlink_unicast+0x314/0x380 [14739.994742] netlink_sendmsg+0x198/0x3f0 [14739.998664] __sock_sendmsg+0x64/0xc0 [14740.002324] ____sys_sendmsg+0x260/0x298 [14740.006242] ___sys_sendmsg+0xb4/0x110"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "AA21F9C8-DBB9-4FA8-BA9E-8E4E5C237138"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/35ad47c0b3da04b00b19a8b9ed5632e2f2520472",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/91c3dec2453b3742e8f666957b99945edc30577f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9b50874f297fcc62adc7396f35209878e51010b0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38452.json
+101 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38452",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:30.800",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:52:50.963",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,114 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ethernet: rtsn: Se corrige una desreferencia de puntero nulo en rtsn_probe(). Se agrega una verificaci\u00f3n para el valor de retorno de rcar_gen4_ptp_alloc() para evitar una posible desreferencia de puntero nulo."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "AA21F9C8-DBB9-4FA8-BA9E-8E4E5C237138"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/95a234f6affbf51f06338383537ab80d637bb785",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9f260e16b297f8134c5f90bb5a20e805ff57e853",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d52eb4f0e0ca9a5213b8795abbeb11a325d9b22d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38453.json
+101 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38453",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:30.913",
"lastModified": "2025-09-09T17:15:44.790",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:57:44.400",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,114 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring/msg_ring: garantizar que la liberaci\u00f3n de io_kiocb se posponga para RCU syzbot informa que agregar defer/local task_work mediante msg_ring puede afectar a una solicitud que se ha liberado: CPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 No contaminado 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(full) Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Rastreo de llamadas: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 io_req_local_work_add io_uring/io_uring.c:1184 [inline] __io_req_task_work_add+0x589/0x950 io_uring/io_uring.c:1252 io_msg_remote_post io_uring/msg_ring.c:103 [inline] io_msg_data_remote io_uring/msg_ring.c:133 [inline] __io_msg_ring_data+0x820/0xaa0 io_uring/msg_ring.c:151 io_msg_ring_data io_uring/msg_ring.c:173 [inline] io_msg_ring+0x134/0xa00 io_uring/msg_ring.c:314 __io_issue_sqe+0x17e/0x4b0 io_uring/io_uring.c:1739 io_issue_sqe+0x165/0xfd0 io_uring/io_uring.c:1762 io_wq_submit_work+0x6e9/0xb90 io_uring/io_uring.c:1874 io_worker_handle_work+0x7cd/0x1180 io_uring/io-wq.c:642 io_wq_worker+0x42f/0xeb0 io_uring/io-wq.c:696 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 que se supone que es seguro con la asignaci\u00f3n de solicitudes. Sin embargo, las solicitudes del anillo msg asignan y liberan por s\u00ed solas, por lo que deben posponer la liberaci\u00f3n hasta un momento razonable. Agregue un rcu_head y use kfree_rcu() en ambos puntos donde se liberan las solicitudes. Solo el de io_msg_tw_complete() es estrictamente obligatorio, ya que ha sido visible en el otro anillo, pero \u00faselo consistentemente tambi\u00e9n en el otro punto. Esto no deber\u00eda causar otros problemas, aparte de las quejas leg\u00edtimas de KASAN."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11",
"versionEndExcluding": "6.12.46",
"matchCriteriaId": "256E5EE4-3CDD-4BC5-B736-C8EE925C1627"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/094ba14a471cc6c68078c7ad488539eaf32c2277",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e5b3432f4a6b418b8bd8fc91f38efbf17a77167a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/fc582cd26e888b0652bc1494f252329453fd3b23",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38454.json
+101 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38454",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:31.030",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:57:50.223",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,114 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: ad1816a: Se corrige la posible desreferencia de puntero NULL en snd_card_ad1816a_pnp(). Utilice pr_warn() en lugar de dev_warn() cuando 'pdev' sea NULL para evitar una posible desreferencia de puntero NULL."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "527896FF-1AAC-4EE0-A79C-A35602C28862"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/043faef334a1f3d96ae88e1b7618bfa2b4946388",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e14bffc90866596ba19ffe549f199d7870da4241",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ef84c94d11ff972ecc3507f1ed092046bf6204b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38463.json
+112 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38463",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-25T16:15:32.253",
"lastModified": "2025-07-29T14:14:55.157",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:57:59.300",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,128 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: Correcto signado en el c\u00e1lculo del espacio restante de skb Syzkaller inform\u00f3 de un error [1] en el que sk-&gt;sk_forward_alloc puede desbordarse. Al enviar datos, si existe un skb al final de la cola de escritura, el kernel intentar\u00e1 a\u00f1adir los nuevos datos a ese skb. Sin embargo, el c\u00f3digo que comprueba el espacio disponible en el skb presenta un fallo: ''' copy = size_goal - skb-&gt;len ''' Los tipos de las variables implicadas son: ''' copy: ssize_t (s64 en sistemas de 64 bits) size_goal: int skb-&gt;len: unsigned int ''' Debido a las reglas de promoci\u00f3n de tipos de C, el signed size_goal se convierte en un unsigned int para que coincida con skb-&gt;len antes de la resta. El resultado es un unsigned int. Cuando este resultado entero sin signo se asigna a la variable de copia s64, se extiende a cero, conservando su valor no negativo. Por lo tanto, la copia siempre es &gt;= 0. Supongamos que enviamos 2 GB de datos y que size_goal se ha ajustado a un valor menor que skb-&gt;len. La resta har\u00e1 que la copia contenga un entero positivo muy grande. En la l\u00f3gica subsiguiente, este valor alto se utiliza para actualizar sk-&gt;sk_forward_alloc, lo que puede provocar f\u00e1cilmente un desbordamiento. El reproductor syzkaller utiliza TCP_REPAIR para crear esta condici\u00f3n de forma fiable. Sin embargo, esto tambi\u00e9n puede ocurrir en situaciones reales. La funci\u00f3n tcp_bound_to_half_wnd() tambi\u00e9n puede reducir size_goal a un valor peque\u00f1o. Esto provocar\u00eda que la funci\u00f3n tcp_wmem_schedule() posterior estableciera sk-&gt;sk_forward_alloc en un valor cercano a INT_MAX. Las solicitudes de asignaci\u00f3n de memoria adicionales har\u00edan que sk_forward_alloc se repita y se vuelva negativo. [1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-191"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5",
"versionEndExcluding": "6.6.99",
"matchCriteriaId": "9CABF565-8BEB-40D7-AD9A-F7EFDFBFF1C6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "18D57670-11F8-4B5A-AD56-EA32DD0F44E1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/62e6160cfb5514787bda833d466509edc38fde23",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/81373cd1d72d87c7d844d4454a526b8f53e72d00",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9f164fa6bb09fbcc60fa5c3ff551ce9eec1befd7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d3a5f2871adc0c61c61869f37f3e697d97f03d8c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38469.json
+162 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38469",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:28.640",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:58:18.397",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,178 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86/xen: Se corrige la l\u00f3gica de limpieza en la emulaci\u00f3n de las hiperllamadas de sondeo schedop de Xen. kvm_xen_schedop_poll ejecuta kmalloc_array() cuando una m\u00e1quina virtual sondea el host en busca de m\u00e1s de un canal de eventos potr (nr_ports &gt; 1). Despu\u00e9s de kmalloc_array(), las rutas de error deben pasar por la etiqueta \"out\", pero la llamada a kvm_read_guest_virt() no. [Mensaje de confirmaci\u00f3n ajustado. - Paolo]"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.1",
"versionEndExcluding": "6.6.100",
"matchCriteriaId": "C432FF2D-AF56-430E-8635-4A2C47E320BC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.40",
"matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*",
"matchCriteriaId": "3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*",
"matchCriteriaId": "D34127CC-68F5-4703-A5F6-5006F803E4AE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*",
"matchCriteriaId": "4AB8D555-648E-4F2F-98BD-3E7F45BD12A8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*",
"matchCriteriaId": "C64BDD9D-C663-4E75-AE06-356EDC392B82"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc8:*:*:*:*:*:*",
"matchCriteriaId": "26544390-88E4-41CA-98BF-7BB1E9D4E243"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc7:*:*:*:*:*:*",
"matchCriteriaId": "7A9C2DE5-43B8-4D73-BDB5-EA55C7671A52"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/061c553c66bc1638c280739999224c8000fd4602",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/3ee59c38ae7369ad1f7b846e05633ccf0d159fab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5a53249d149f48b558368c5338b9921b76a12f8c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/fd627ac8a5cff4d45269f164b13ddddc0726f2cc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38475.json
+106 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38475",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:29.367",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:27:13.617",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,119 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smc: Se corrigen varios errores debido a la confusi\u00f3n de tipos inet_sock. syzbot report\u00f3 s\u00edmbolos extra\u00f1os [0][1] en cipso_v4_sock_setattr() al liberar inet_sk(sk)-&gt;inet_opt. La direcci\u00f3n se liber\u00f3 varias veces a pesar de ser memoria de solo lectura. cipso_v4_sock_setattr() no caus\u00f3 ning\u00fan error, y la causa ra\u00edz fue la confusi\u00f3n de tipos. La confirmaci\u00f3n citada permiti\u00f3 crear smc_sock como un socket INET. El problema es que struct smc_sock no tiene struct inet_sock como primer miembro, sino que secuestra AF_INET y AF_INET6 sk_family, lo que confunde varias ubicaciones. En este caso, inet_sock.inet_opt era en realidad smc_sock.clcsk_data_ready(), que es una direcci\u00f3n de una funci\u00f3n en el segmento de texto. $ pahole -C inet_sock vmlinux struct inet_sock { ... struct ip_options_rcu * inet_opt; /* 784 8 */ $ pahole -C smc_sock vmlinux struct smc_sock { ... void (*clcsk_data_ready)(struct sock *); /* 784 8 */ The same issue for another field was reported before. [2][3] At that time, an ugly hack was suggested [4], but it makes both INET and SMC code error-prone and hard to change. Also, yet another variant was fixed by a hacky commit 98d4435efcbf3 (\"net/smc: prevent NULL pointer dereference in txopt_get\"). Instead of papering over the root cause by such hacks, we should not allow non-INET socket to reuse the INET infra. Let's add inet_sock as the first member of smc_sock. [0]: kvfree_call_rcu(): Double-freed call. rcu_head 000000006921da73 WARNING: CPU: 0 PID: 6718 at mm/slab_common.c:1956 kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 Modules linked in: CPU: 0 UID: 0 PID: 6718 Comm: syz.0.17 Tainted: G W 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 lr : kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 sp : ffff8000a03a7730 x29: ffff8000a03a7730 x28: 00000000fffffff5 x27: 1fffe000184823d3 x26: dfff800000000000 x25: ffff0000c2411e9e x24: ffff0000dd88da00 x23: ffff8000891ac9a0 x22: 00000000ffffffea x21: ffff8000891ac9a0 x20: ffff8000891ac9a0 x19: ffff80008afc2480 x18: 00000000ffffffff x17: 0000000000000000 x16: ffff80008ae642c8 x15: ffff700011ede14c x14: 1ffff00011ede14c x13: 0000000000000004 x12: ffffffffffffffff x11: ffff700011ede14c x10: 0000000000ff0100 x9 : 5fa3c1ffaf0ff000 x8 : 5fa3c1ffaf0ff000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a03a7078 x4 : ffff80008f766c20 x3 : ffff80008054d360 x2 : 0000000000000000 x1 : 0000000000000201 x0 : 0000000000000000 Call trace: kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 (P) cipso_v4_sock_setattr+0x2f0/0x3f4 net/ipv4/cipso_ipv4.c:1914 netlbl_sock_setattr+0x240/0x334 net/netlabel/netlabel_kapi.c:1000 smack_netlbl_add+0xa8/0x158 security/smack/smack_lsm.c:2581 smack_inode_setsecurity+0x378/0x430 security/smack/smack_lsm.c:2912 security_inode_setsecurity+0x118/0x3c0 security/security.c:2706 __vfs_setxattr_noperm+0x174/0x5c4 fs/xattr.c:251 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295 vfs_setxattr+0x158/0x2ac fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] file_setxattr+0x1b8/0x294 fs/xattr.c:646 path_setxattrat+0x2ac/0x320 fs/xattr.c:711 __do_sys_fsetxattr fs/xattr.c:761 [inline] __se_sys_fsetxattr fs/xattr.c:758 [inline] __arm64_sys_fsetxattr+0xc0/0xdc fs/xattr.c:758 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 [ ---truncated---"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11",
"versionEndExcluding": "6.12.40",
"matchCriteriaId": "07851087-B8D6-4B99-A561-2A80E0F1FA64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/5b02e397929e5b13b969ef1f8e43c7951e2864f5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/60ada4fe644edaa6c2da97364184b0425e8aeaf5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/67a167a6b8b45607bc34aa541d1c75097d18d460",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38484.json
+113 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38484",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:30.367",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:37:19.910",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,126 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: backend: correcci\u00f3n de escritura fuera de l\u00edmite. El b\u00fafer est\u00e1 configurado a 80 caracteres. Si quien llama escribe m\u00e1s caracteres, count se trunca al espacio m\u00e1ximo disponible en \"simple_write_to_buffer\". Posteriormente, se escribe un terminador de cadena en el b\u00fafer en el desplazamiento count sin verificaci\u00f3n de los l\u00edmites. La terminaci\u00f3n cero se escribe OUT-OF-BOUND. Para evitarlo, se debe a\u00f1adir una verificaci\u00f3n de que el b\u00fafer dado sea menor que el b\u00fafer."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.23",
"versionEndExcluding": "6.12.40",
"matchCriteriaId": "526F5C6A-20E7-48A9-A397-8A16EC1E4B05"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.11",
"versionEndExcluding": "6.14",
"matchCriteriaId": "124AE182-7E9F-4410-9E08-5976ED49C6A4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.2",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "DF824E50-6D02-44EE-9300-88DB709E0B4F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/01e941aa7f5175125df4ac5d3aab099961525602",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/6eea9f7648ddb9e4903735a1f77cf196c957aa38",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/da9374819eb3885636934c1006d450c3cb1a02ed",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38486.json
+95 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38486",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:30.600",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:45:46.000",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,105 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: soundwire: Revertir \"soundwire: qcom: A\u00f1adir compatibilidad con la API set_channel_map\". Esto revierte el commit 7796c97df6b1b2206681a07f3c80f6023a6593d5. Este parche interrumpi\u00f3 la versi\u00f3n Dragonboard 845c (sdm845). Veo: Excepci\u00f3n BRK de kernel inesperada en EL1 Error interno: BRK handler: 00000000f20003e8 [#1] SMP pc : qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] lr : snd_soc_dai_set_channel_map+0x34/0x78 Call trace: qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] (P) sdm845_dai_init+0x18c/0x2e0 [snd_soc_sdm845] snd_soc_link_init+0x28/0x6c snd_soc_bind_card+0x5f4/0xb0c snd_soc_register_card+0x148/0x1a4 devm_snd_soc_register_card+0x50/0xb0 sdm845_snd_platform_probe+0x124/0x148 [snd_soc_sdm845] platform_probe+0x6c/0xd0 really_probe+0xc0/0x2a4 __driver_probe_device+0x7c/0x130 driver_probe_device+0x40/0x118 __device_attach_driver+0xc4/0x108 bus_for_each_drv+0x8c/0xf0 __device_attach+0xa4/0x198 device_initial_probe+0x18/0x28 bus_probe_device+0xb8/0xbc deferred_probe_work_func+0xac/0xfc process_one_work+0x244/0x658 worker_thread+0x1b4/0x360 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Kernel panic - not syncing: BRK handler: Fatal exception Dan has also reported following issues with the original patch https://lore.kernel.org/all/[email protected]/ Bug #1: se supone que el elemento cero de ctrl-&gt;pconfig[] no se utiliza. Empezamos a contar desde 1. Sin embargo, este c\u00f3digo establece ctrl-&gt;pconfig[0].ch_mask = 128. Error n.\u00b0 2: Hay elementos SLIM_MAX_TX_PORTS (16) en la matriz tx_ch[], pero solo QCOM_SDW_MAX_PORTS + 1 (15) en la matriz ctrl-&gt;pconfig[], por lo que corrompe la memoria, como se\u00f1al\u00f3 Yongqin Liu. Error 3: Como se\u00f1al\u00f3 Jie Gan, borra toda la informaci\u00f3n de la transmisi\u00f3n junto con la de la recepci\u00f3n."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "7AAE4EC0-78FF-4244-B25E-7B6A937DA2D5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/207cea8b72fcbdf4e6db178e54186ed4f1514b3c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/834bce6a715ae9a9c4dce7892454a19adf22b013",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38489.json
+159 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38489",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:30.990",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:45:54.723",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,175 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again Commit 7ded842b356d (\"s390/bpf: Fix bpf_plt pointer arithmetic\") elimin\u00f3 accidentalmente la parte cr\u00edtica del commit c730fce7c70c (\"s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL\"), lo que provocaba la reaparici\u00f3n de p\u00e1nicos de kernel intermitentes en el programa on_switch() de perf, por ejemplo. Restablezca la correcci\u00f3n y a\u00f1ada un comentario."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.26",
"versionEndExcluding": "6.6.100",
"matchCriteriaId": "60C486A1-44C8-480A-9ED8-78C68326016D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.5",
"versionEndExcluding": "6.9",
"matchCriteriaId": "A6B58EED-04EA-418F-99DB-71FC04B438DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.1",
"versionEndExcluding": "6.12.40",
"matchCriteriaId": "322F733E-C57F-430D-A0C8-E026D78FEAB7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*",
"matchCriteriaId": "3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*",
"matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*",
"matchCriteriaId": "91326417-E981-482E-A5A3-28BC1327521B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*",
"matchCriteriaId": "DAECDCD8-F556-4606-8D7B-5C6D47A501F2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/0c7b20f7785cfdd59403333612c90b458b12307c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/6a5abf8cf182f577c7ae6c62f14debc9754ec986",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a4f9c7846b1ac428921ce9676b1b8c80ed60093c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d5629d1af0600f8cc7c9245e8d832a66358ef889",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38490.json
+117 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38490",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:31.113",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:46:10.557",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,133 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: libwx: eliminar la p\u00e1gina duplicada page_pool_put_full_page(). page_pool_put_full_page() solo debe invocarse al liberar b\u00faferes Rx o al crear un skb si el tama\u00f1o es demasiado peque\u00f1o. En otros casos, es necesario reutilizar las p\u00e1ginas. Por lo tanto, se debe eliminar la p\u00e1gina redundante. En el c\u00f3digo original, las p\u00e1ginas doblemente libres provocan p\u00e1nico en el n\u00facleo:[ 876.949834] __irq_exit_rcu+0xc7/0x130 [ 876.949836] common_interrupt+0xb8/0xd0 [ 876.949838] [ 876.949838] [ 876.949840] asm_common_interrupt+0x22/0x40 [ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 &lt;45&gt; 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246 [ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000 [ 876.949846] RDX: 000000cc2dc4cb7c RSI: ffffffff89ee49ae RDI: ffffffff89ef9f9e [ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed [ 876.949848] R10: 000000000000afc8 R11: ffff9e3e9e5a9b6c R12: ffffffff8a6d8580 [ 876.949849] R13: 000000cc2dc4cb7c R14: 0000000000000002 R15: 0000000000000000 [ 876.949852] ? cpuidle_enter_state+0xb3/0x420 [ 876.949855] cpuidle_enter+0x29/0x40 [ 876.949857] cpuidle_idle_call+0xfd/0x170 [ 876.949859] do_idle+0x7a/0xc0 [ 876.949861] cpu_startup_entry+0x25/0x30 [ 876.949862] start_secondary+0x117/0x140 [ 876.949864] common_startup_64+0x13e/0x148 [ 876.949867] [ 876.949868] ---[ end trace 0000000000000000 ]--- [ 876.949869] ------------[ cut here ]------------ [ 876.949870] list_del corruption, ffffead40445a348-&gt;next is NULL [ 876.949873] WARNING: CPU: 14 PID: 0 at lib/list_debug.c:52 __list_del_entry_valid_or_report+0x67/0x120 [ 876.949875] Modules linked in: snd_hrtimer(E) bnep(E) binfmt_misc(E) amdgpu(E) squashfs(E) vfat(E) loop(E) fat(E) amd_atl(E) snd_hda_codec_realtek(E) intel_rapl_msr(E) snd_hda_codec_generic(E) intel_rapl_common(E) snd_hda_scodec_component(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) edac_mce_amd(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirks(E) cec(E) snd_pcm(E) drm_buddy(E) snd_seq_dummy(E) drm_ttm_helper(E) btusb(E) kvm(E) snd_seq_oss(E) btrtl(E) ttm(E) btintel(E) snd_seq_midi(E) btbcm(E) drm_exec(E) snd_seq_midi_event(E) i2c_algo_bit(E) snd_rawmidi(E) bluetooth(E) drm_suballoc_helper(E) irqbypass(E) snd_seq(E) ghash_clmulni_intel(E) sha512_ssse3(E) drm_display_helper(E) aesni_intel(E) snd_seq_device(E) rfkill(E) snd_timer(E) gf128mul(E) drm_client_lib(E) drm_kms_helper(E) snd(E) i2c_piix4(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_generic(E) sg(E) [ 876.949914] i2c_designware_core(E) sch_fq_codel(E) parport_pc(E) drm(E) ppdev(E) lp(E) parport(E) fuse(E) nfnetlink(E) ip_tables(E) ext4 crc16 mbcache jbd2 sd_mod sfp mdio_i2c i2c_core txgbe ahci ngbe pcs_xpcs libahci libwx r8169 phylink libata realtek ptp pps_core video wmi [ 876.949933] CPU: 14 UID: 0 PID: 0 Comm: swapper/14 Kdump: loaded Tainted: G W E 6.16.0-rc2+ #20 PREEMPT(voluntary) [ 876.949935] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 876.949936] RIP: 0010:__list_del_entry_valid_or_report+0x67/0x120 [ 876.949938] Code: 00 00 00 48 39 7d 08 0f 85 a6 00 00 00 5b b8 01 00 00 00 5d 41 5c e9 73 0d 93 ff 48 89 fe 48 c7 c7 a0 31 e8 89 e8 59 7c b3 ff &lt;0f&gt; 0b 31 c0 5b 5d 41 5c e9 57 0d 93 ff 48 89 fe 48 c7 c7 c8 31 e8 [ 876.949940] RSP: 0018:ffffaa73405d0c60 EFLAGS: 00010282 [ 876.949941] RAX: 0000000000000000 RBX: ffffead40445a348 RCX: 0000000000000000 [ 876.949942] RDX: 0000000000000105 RSI: 00000 ---truncated---"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-415"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3",
"versionEndExcluding": "6.6.100",
"matchCriteriaId": "2FFFB27A-1108-4092-B495-80F39EDD8FF9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.40",
"matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/003e4765d8661be97e650a833868c53d35574130",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/08d18bda0d03f5ec376929a8c6c4495f9594593a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/1b7e585c04cd5f0731dd25ffd396277e55fae0e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/3c91a56762b1f0d1e4af2d86c2cba83b61ed9eaa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38492.json
+95 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38492",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:31.367",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:46:50.547",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,105 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfs: Corregir la ejecuci\u00f3n entre la finalizaci\u00f3n de la escritura en cach\u00e9 y el establecimiento de ALL_QUEUED Cuando netfslib emite subsolicitudes, estas empiezan a procesarse inmediatamente y pueden completarse antes de que lleguemos al final de la funci\u00f3n de emisi\u00f3n. Al final de la funci\u00f3n de emisi\u00f3n, establecemos NETFS_RREQ_ALL_QUEUED para indicar al recolector que no vamos a emitir m\u00e1s subsolicitudes y que puede realizar las notificaciones finales y la limpieza. Ahora bien, esto no es un problema si la solicitud es sincr\u00f3nica (NETFS_RREQ_OFFLOAD_COLLECTION no est\u00e1 establecido), ya que la recopilaci\u00f3n de resultados se realizar\u00e1 en el subproceso y se nos garantiza una oportunidad para ejecutar el recolector. Sin embargo, si la solicitud es asincr\u00f3nica, la recopilaci\u00f3n se activa principalmente al finalizar las subsolicitudes que la ponen en cola en una cola de trabajo. Ahora bien, aqu\u00ed puede producirse una ejecuci\u00f3n si el subproceso de la aplicaci\u00f3n establece ALL_QUEUED despu\u00e9s de que finalice la \u00faltima subsolicitud. Esto se puede lograr m\u00e1s f\u00e1cilmente con el c\u00f3digo copy2cache (usado por Ceph), donde, en la rutina de recopilaci\u00f3n de una solicitud de lectura, se genera una solicitud de escritura as\u00edncrona para copiar datos a la cach\u00e9. Los folios se agregan a la solicitud de escritura a medida que se desbloquean, pero puede haber un retraso antes de que se configure ALL_QUEUED, ya que las subsolicitudes de escritura pueden completarse antes de que lleguemos a ese punto. Si todas las subsolicitudes de escritura han finalizado para el punto ALL_QUEUED, no ocurren m\u00e1s eventos y la recopilaci\u00f3n nunca se realiza, dejando la solicitud colgada. Para solucionar esto, ponga en cola el recopilador despu\u00e9s de configurar ALL_QUEUED. Esto es un poco forzado y podr\u00eda ser suficiente si no existen subsolicitudes. Tambi\u00e9n agregue un punto de seguimiento para realizar una referencia cruzada de ambas solicitudes en una operaci\u00f3n de copia a solicitud y agregue un seguimiento al punto de seguimiento netfs_rreq para indicar la configuraci\u00f3n de ALL_QUEUED."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "3B1D6837-C0C8-4CC6-9D70-85B362FFE711"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/110188a13c4853bd4c342e600ced4dfd26c3feb5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/89635eae076cd8eaa5cb752f66538c9dc6c9fdc3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38493.json
+117 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38493",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:31.483",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:46:57.017",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,133 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/osnoise: corrige fallo en timerlat_dump_stack() Hemos observado p\u00e1nicos en el kernel al usar timerlat con guardado de pila, con la siguiente salida de dmesg: memcpy: desbordamiento de b\u00fafer detectado: escritura de 88 bytes de tama\u00f1o de b\u00fafer 0 WARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0 CPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy) Call Trace: ? trace_buffer_lock_reserve+0x2a/0x60 __fortify_panic+0xd/0xf __timerlat_dump_stack.cold+0xd/0xd timerlat_dump_stack.part.0+0x47/0x80 timerlat_fd_read+0x36d/0x390 vfs_read+0xe2/0x390 ? syscall_exit_to_user_mode+0x1d5/0x210 ksys_read+0x73/0xe0 do_syscall_64+0x7b/0x160 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e __timerlat_dump_stack() construye la entrada de la pila ftrace de la siguiente manera: struct stack_entry *entry; ... memcpy(&amp;entry-&gt;caller, fstack-&gt;calls, size); entry-&gt;size = fstack-&gt;nr_entries; Desde el commit e7186af7fb26 (\"rastreo: Agregar la l\u00f3gica de FORTIFY_SOURCE a la estructura de eventos kernel_stack\"), struct stack_entry marca su campo de llamada con __counted_by(size). Al ejecutar memcpy, entry-&gt;size contiene informaci\u00f3n no v\u00e1lida del b\u00fafer de anillo, que en algunas circunstancias es cero, lo que desencadena un p\u00e1nico del n\u00facleo por desbordamiento del b\u00fafer. Rellene el campo de tama\u00f1o antes de ejecutar memcpy para que la comprobaci\u00f3n de fuera de los l\u00edmites conozca el tama\u00f1o correcto. Esto es an\u00e1logo a __ftrace_trace_stack()."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-674"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6",
"versionEndExcluding": "6.6.100",
"matchCriteriaId": "2810A6CA-96DE-439E-943F-B597B665190C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.40",
"matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/7bb9ea515cda027c9e717e27fefcf34f092e7c41",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/823d798900481875ba6c68217af028c5ffd2976b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/85a3bce695b361d85fc528e6fbb33e4c8089c806",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/fbf90f5aa7ac7cddc69148a71d58f12c8709ce2b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-384xx/CVE-2025-38496.json
+117 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38496",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-28T12:15:31.847",
"lastModified": "2025-07-29T14:14:29.590",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:47:16.730",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,23 +15,133 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm-bufio: correcci\u00f3n de sched en contexto at\u00f3mico Si \"try_verify_in_tasklet\" est\u00e1 configurado para dm-verity, DM_BUFIO_CLIENT_NO_SLEEP est\u00e1 habilitado para dm-bufio. Sin embargo, cuando bufio intenta expulsar b\u00fafer, existe la posibilidad de activar la programaci\u00f3n en spin_lock_bh, se muestra la siguiente advertencia: BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2745 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 123, name: kworker/2:2 preempt_count: 201, expected: 0 RCU nest depth: 0, expected: 0 4 locks held by kworker/2:2/123: #0: ffff88800a2d1548 ((wq_completion)dm_bufio_cache){....}-{0:0}, at: process_one_work+0xe46/0x1970 #1: ffffc90000d97d20 ((work_completion)(&amp;dm_bufio_replacement_work)){....}-{0:0}, at: process_one_work+0x763/0x1970 #2: ffffffff8555b528 (dm_bufio_clients_lock){....}-{3:3}, at: do_global_cleanup+0x1ce/0x710 #3: ffff88801d5820b8 (&amp;c-&gt;spinlock){....}-{2:2}, at: do_global_cleanup+0x2a5/0x710 Preemption disabled at: [&lt;0000000000000000&gt;] 0x0 CPU: 2 UID: 0 PID: 123 Comm: kworker/2:2 Not tainted 6.16.0-rc3-g90548c634bd0 #305 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: dm_bufio_cache do_global_cleanup Call Trace: dump_stack_lvl+0x53/0x70 __might_resched+0x360/0x4e0 do_global_cleanup+0x2f5/0x710 process_one_work+0x7db/0x1970 worker_thread+0x518/0xea0 kthread+0x359/0x690 ret_from_fork+0xf3/0x1b0 ret_from_fork_asm+0x1a/0x30 That can be reproduced by: veritysetup format --data-block-size=4096 --hash-block-size=4096 /dev/vda /dev/vdb SIZE=$(blockdev --getsz /dev/vda) dmsetup create myverity -r --table \"0 $SIZE verity 1 /dev/vda /dev/vdb 4096 4096 1 sha256 1 try_verify_in_tasklet\" mount /dev/dm-0 /mnt -o ro echo 102400 &gt; /sys/module/dm_bufio/parameters/max_cache_size_bytes [read files in /mnt]"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4",
"versionEndExcluding": "6.6.100",
"matchCriteriaId": "0F50E34C-5B86-414A-B85F-EDE608892599"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.40",
"matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.8",
"matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
"matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/3edfdb1d4ef81320dae0caa40bc24baf8c1bbb86",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/469a39a33a9934af157299bf11c58f6e6cb53f85",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/68860d1ade385eef9fcdbf6552f061283091fdb8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b1bf1a782fdf5c482215c0c661b5da98b8e75773",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-385xx/CVE-2025-38504.json
+90 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38504",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-16T11:15:43.293",
"lastModified": "2025-08-18T20:16:28.750",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:21:18.187",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,100 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring/zcrx: correcci\u00f3n de advertencias de destrucci\u00f3n de pp. Con varios grupos de p\u00e1ginas y en otros casos, podemos asignar niovs al destruir el grupo de p\u00e1ginas. Se ha eliminado una advertencia incorrecta que verificaba que todos los niovs se devolvieran a zcrx en io_pp_zc_destroy(). Se inform\u00f3 anteriormente, pero aparentemente se perdi\u00f3."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "FBA11932-25B2-4915-A601-431072CDC904"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/203817de269539c062724d97dfa5af3cdf77a3ec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ad9f1b5bed082b9c910e2a24bae0286a70846909",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-385xx/CVE-2025-38505.json
+101 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38505",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-16T11:15:43.407",
"lastModified": "2025-08-18T20:16:28.750",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:21:35.500",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,114 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mwifiex: descarta marcos de disociaci\u00f3n err\u00f3neos en la interfaz STA. Cuando se opera en modo STA/AP concurrente con MLME de host habilitado, el firmware env\u00eda incorrectamente marcos de disociaci\u00f3n a la interfaz STA cuando los clientes se desconectan de la interfaz AP. Esto genera advertencias del kernel ya que la interfaz STA procesa eventos de desconexi\u00f3n que no se aplican a ella: [ 1303.240540] ADVERTENCIA: CPU: 0 PID: 513 en net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211] [ 1303.250861] M\u00f3dulos vinculados: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us [ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 No contaminado 6.16.0-rc1+ #3 PREEMPT [ 1303.335937] Nombre del hardware: Toradex Verdin AM62 WB en placa de desarrollo Verdin (DT) [ 1303.343588] Cola de trabajo: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex] [ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211] [ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211] [ 1303.370221] sp : ffff800083053be0 [ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 00000000000000000 [ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae [ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008 [ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006 [ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048 [ 1303.409910] x14: ffff000003625300 x13: 000000000000001 x12: 0000000000000000 [ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300 [ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002 [ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186 [ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de [ 1303.446221] Rastreo de llamadas: [ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P) [ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211] [ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex] [ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex] [ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex] [ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex] [ 1303.483734] process_one_work+0x14c/0x28c [ 1303.487845]worker_thread+0x2cc/0x3d4 [ 1303.491680] kthread+0x12c/0x208 [ 1303.495014] ret_from_fork+0x10/0x20 Agregue validaci\u00f3n en la ruta de recepci\u00f3n de STA para verificar que los marcos de desasociaci\u00f3n/desautorizaci\u00f3n se originen en el AP conectado. Las tramas que no superan esta comprobaci\u00f3n se descartan prematuramente, lo que impide que lleguen a la capa MLME y activen WARN_ON(). Esta l\u00f3gica de filtrado es similar a la utilizada en la funci\u00f3n ieee80211_rx_mgmt_disassoc() de mac80211, que descarta las tramas de desasociaci\u00f3n que no coinciden con el BSSID actual (!ether_addr_equal(mgmt-&gt;bssid, sdata-&gt;vif.cfg.ap_addr)), garantizando as\u00ed que solo se procesen las tramas relevantes. Probado en: - 8997 con firmware 16.68.1.p197"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "527896FF-1AAC-4EE0-A79C-A35602C28862"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/3b602ddc0df723992721b0d286c90c9bdd755b34",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/52654cebaac23dae31a9c97ae0da5be649f1ab4d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a963819a121f5dd61e0b39934d8b5dec529da96a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-385xx/CVE-2025-38506.json
+101 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38506",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-16T11:15:43.527",
"lastModified": "2025-08-18T20:16:28.750",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:21:44.267",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,114 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: Permitir que la CPU reprograme mientras se configuran atributos de memoria por p\u00e1gina Cuando se ejecuta un invitado SEV-SNP con una cantidad de memoria suficientemente grande (1 TB+), el host puede experimentar bloqueos suaves de la CPU cuando ejecuta una operaci\u00f3n en kvm_vm_set_mem_attributes() para configurar los atributos de memoria en todo el rango de memoria del invitado. watchdog: BUG: bloqueo suave: \u00a1CPU n.\u00ba 8 bloqueada durante 26 s! [qemu-kvm:6372] CPU: 8 UID: 0 PID: 6372 Comm: qemu-kvm Kdump: cargado No contaminado 6.15.0-rc7.20250520.el9uek.rc1.x86_64 #1 PREEMPT(voluntario) Nombre del hardware: Oracle Corporation ORACLE SERVER E4-2c/Asm,MB Tray,2U,E4-2c, BIOS 78016600 13/11/2024 RIP: 0010:xas_create+0x78/0x1f0 C\u00f3digo: 00 00 00 41 80 fc 01 0f 84 82 00 00 00 ba 06 00 00 00 bd 06 00 00 00 49 8b 45 08 4d 8d 65 08 41 39 d6 73 20 83 ed 06 48 85 c0 &lt;74&gt; 67 48 89 c2 83 e2 03 48 83 fa 02 75 0c 48 3d 00 10 00 00 0f 87 RSP: 0018:ffffad890a34b940 EFLAGS: 00000286 RAX: ffff96f30b261daa RBX: ffffad890a34b9c8 RCX: 00000000000000000 RDX: 000000000000001e RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffad890a356868 R13: ffffad890a356860 R14: 000000000000000 R15: ffffad890a356868 FS: 00007f5578a2a400(0000) GS:ffff97ed317e1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f015c70fb18 CR3: 00000001109fd006 CR4: 0000000000f70ef0 PKRU: 55555554 Rastreo de llamadas: xas_store+0x58/0x630 __xa_store+0xa5/0x130 xa_store+0x2c/0x50 kvm_vm_set_mem_attributes+0x343/0x710 [kvm] kvm_vm_ioctl+0x796/0xab0 [kvm] __x64_sys_ioctl+0xa3/0xd0 do_syscall_64+0x8c/0x7a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f5578d031bb C\u00f3digo: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 &lt;48&gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2d 4c 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe0a742b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000004020aed2 RCX: 00007f5578d031bb RDX: 00007ffe0a742c80 RSI: 000000004020aed2 RDI: 00000000000000b RBP: 000001000000000 R08: 0000010000000000 R09: 0000017680000000 R10: 0000000000000080 R11: 0000000000000246 R12: 00005575e5f95120 R13: 00007ffe0a742c80 R14: 0000000000000008 R15: 00005575e5f961e0 Mientras recorre el rango de memoria configurando los atributos, llame a cond_resched() para darle al programador la oportunidad de ejecutar una tarea de mayor prioridad en la cola de ejecuci\u00f3n si es necesario y evitar permanecer en modo kernel el tiempo suficiente para activar el bloqueo."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-667"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "10807776-5E00-40EF-A71B-8298F5EF80E3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/1ef45ae7a3938f0844032ba670b4f89180a5bffc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/47bb584237cc285e3a860b70c01f7bda9dcfb05b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d9bd1163c8d8f716f45e54d034ee28757cc85549",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-385xx/CVE-2025-38507.json
+91 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38507",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-16T11:15:43.653",
"lastModified": "2025-08-18T20:16:28.750",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:22:00.177",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,19 +15,104 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: nintendo: evitar bloqueos de suspensi\u00f3n/reinicio de bluetooth Aseg\u00farese de que no bloqueemos ni hagamos que el kernel entre en p\u00e1nico cuando usemos controladores conectados por bluetooth. Esto se inform\u00f3 como un problema en dispositivos Android que usan el kernel 6.6 debido al gancho de reanudaci\u00f3n que se hab\u00eda agregado para los joycons usb. Primero, establezca un nuevo valor de estado en JOYCON_CTLR_STATE_SUSPENDED en un nintendo_hid_suspend reci\u00e9n agregado. Esto asegura que no bloquearemos el kernel esperando informes de entrada durante la suspensi\u00f3n de classdev led. Los bloqueos podr\u00edan ocurrir si la conectividad no es confiable o se pierde con el controlador antes de la suspensi\u00f3n. Segundo, dado que perdemos la conectividad durante la suspensi\u00f3n, no intentes joycon_init() para controladores bluetooth en la ruta nintendo_hid_resume. Probado a trav\u00e9s de m\u00faltiples flujos de suspensi\u00f3n/reinicio al usar el controlador en modo USB y bluetooth."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.12.39",
"matchCriteriaId": "993A4313-EA93-43C8-B612-1B24D129183E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/4a0381080397e77792a5168069f174d3e56175ff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/72cb7eef06a5cde42b324dea85fa11fd5bb6a08a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7b4a026313529a487821ef6ab494a61f12c1db08",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-385xx/CVE-2025-38508.json
+85 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38508",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-16T11:15:43.773",
"lastModified": "2025-08-18T20:16:28.750",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:22:13.597",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,95 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/sev: Usar TSC_FACTOR para el c\u00e1lculo de frecuencia de Secure TSC. Al usar Secure TSC, el MSR GUEST_TSC_FREQ informa una frecuencia basada en la frecuencia P0 nominal, que se desv\u00eda ligeramente (normalmente ~0,2 %) de la frecuencia media real de TSC debido a los par\u00e1metros de reloj. Con el tiempo de actividad prolongado de la m\u00e1quina virtual, esta discrepancia se acumula, causando un sesgo de reloj entre el hipervisor y una m\u00e1quina virtual SEV-SNP, lo que lleva a interrupciones tempranas del temporizador seg\u00fan lo percibe el invitado. El kernel invitado se basa en la frecuencia nominal informada para el control de tiempo basado en TSC, mientras que la frecuencia real establecida durante SNP_LAUNCH_START puede diferir. Esta falta de coincidencia resulta en c\u00e1lculos de tiempo inexactos, lo que hace que el invitado perciba que los temporizadores hr se activan antes de lo esperado. Utilice el factor TSC_FACTOR de la p\u00e1gina de secretos del firmware SEV (consulte \"Formato de la p\u00e1gina de secretos\" en la especificaci\u00f3n ABI del firmware SNP) para calcular la frecuencia media de TSC, lo que garantiza una sincronizaci\u00f3n precisa y mitiga el desfase de reloj en las m\u00e1quinas virtuales SEV-SNP. Utilice early_ioremap_encrypted() para mapear la p\u00e1gina de secretos, ya que ioremap_encrypted() utiliza kmalloc(), que no est\u00e1 disponible durante la inicializaci\u00f3n temprana de TSC y provoca un p\u00e1nico. [bp: Eliminar la variable ficticia: https://lore.kernel.org/r/20250630192726.GBaGLlHl84xIopx4Pt@fat_crate.local]"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "68515F48-E05D-4424-B536-E045CCDDFDDA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/52e1a03e6cf61ae165f59f41c44394a653a0a788",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d0195c42e65805938c9eb507657e7cdf8e1e9522",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-385xx/CVE-2025-38509.json
+90 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-38509",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-16T11:15:43.893",
"lastModified": "2025-08-18T20:16:28.750",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:22:32.987",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -15,15 +15,100 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: rechazar el modo de operaci\u00f3n VHT para anchos de canal no compatibles. Las notificaciones del modo de operaci\u00f3n VHT no est\u00e1n definidas para anchos de canal inferiores a 20 MHz. En particular, 5 MHz y 10 MHz no son v\u00e1lidos seg\u00fan la especificaci\u00f3n VHT y deben rechazarse. Sin esta comprobaci\u00f3n, las notificaciones malformadas que utilicen estos anchos pueden alcanzar ieee80211_chan_width_to_rx_bw(), lo que genera un WARN_ON debido a una entrada no v\u00e1lida. Este problema fue reportado por syzbot. Rechace estos anchos no compatibles al principio de sta_link_apply_parameters() cuando se utilice opmode_notif. El conjunto aceptado incluye 20, 40, 80, 160 y 80+80 MHz, que son v\u00e1lidos para VHT. Si bien 320 MHz no est\u00e1 definido para VHT, se permite evitar rechazar clientes HE o EHT que a\u00fan puedan enviar una notificaci\u00f3n de modo de operaci\u00f3n VHT."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.7",
"matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
"matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/18eca59a04500b68a90e0c5c873f97c9d1ea2bfa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/58fcb1b4287ce38850402bb2bb16d09bf77b91d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}
CVE-2025/CVE-2025-411xx/CVE-2025-41116.json
+2 -2
View File
@@ -2,13 +2,13 @@
"id": "CVE-2025-41116",
"sourceIdentifier": "[email protected]",
"published": "2025-11-11T21:15:38.800",
"lastModified": "2025-11-12T16:19:12.850",
"lastModified": "2025-11-19T18:15:48.183",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When using the Grafana Databricks Datasource Plugin,\nif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u00a0 could result in\u00a0\n\nthe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u00a0\n\nThis issue affects Grafana Databricks Datasource Plugin: from 1.12.1 before 1.12.0"
"value": "When using the Grafana Databricks Datasource Plugin,\nif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u00a0 could result in\u00a0\n\nthe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u00a0\n\nThis issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0"
}
],
"metrics": {
CVE-2025/CVE-2025-440xx/CVE-2025-44033.json
+3 -3
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-44033",
"sourceIdentifier": "[email protected]",
"published": "2025-08-29T18:15:42.280",
"lastModified": "2025-09-09T13:45:53.430",
"lastModified": "2025-11-19T17:06:22.677",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@@ -56,8 +56,8 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:aaluoxiang:oasys:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BCE7E31C-26AC-44BB-9EB9-881DCC22D35B"
"criteria": "cpe:2.3:a:aaluoxiang:oa_system:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82E1964F-6040-42D6-A502-5D03B4E4F9DF"
}
]
}
CVE-2025/CVE-2025-440xx/CVE-2025-44034.json
+3 -3
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-44034",
"sourceIdentifier": "[email protected]",
"published": "2025-09-16T14:15:54.630",
"lastModified": "2025-09-20T02:59:29.723",
"lastModified": "2025-11-19T17:06:31.153",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@@ -56,8 +56,8 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:aaluoxiang:oasys:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BCE7E31C-26AC-44BB-9EB9-881DCC22D35B"
"criteria": "cpe:2.3:a:aaluoxiang:oa_system:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82E1964F-6040-42D6-A502-5D03B4E4F9DF"
}
]
}
CVE-2025/CVE-2025-485xx/CVE-2025-48593.json
+46 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-48593",
"sourceIdentifier": "[email protected]",
"published": "2025-11-18T05:16:10.350",
"lastModified": "2025-11-18T14:06:29.817",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:50:36.580",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -47,18 +47,59 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*",
"matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D49E611-5D53-479D-A981-42388FDC0E8D"
}
]
}
]
}
],
"references": [
{
"url": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5ed63461b44198c80d5aff7e1af1df812f782abb",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
},
{
"url": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c69c78d7c4f623201f35831d32e6c401156e76cc",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
},
{
"url": "https://source.android.com/security/bulletin/2025-11-01",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-49xx/CVE-2025-4945.json
+5 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-4945",
"sourceIdentifier": "[email protected]",
"published": "2025-05-19T17:15:29.103",
"lastModified": "2025-11-18T15:16:30.640",
"lastModified": "2025-11-19T18:15:48.340",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@@ -96,6 +96,10 @@
"url": "https://access.redhat.com/errata/RHSA-2025:21666",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:21772",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-4945",
"source": "[email protected]"
CVE-2025/CVE-2025-543xx/CVE-2025-54321.json
+37 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-54321",
"sourceIdentifier": "[email protected]",
"published": "2025-11-18T19:15:49.043",
"lastModified": "2025-11-18T19:15:49.043",
"lastModified": "2025-11-19T17:15:49.557",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -11,7 +11,42 @@
"value": "In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-799"
}
]
}
],
"references": [
{
"url": "https://github.com/saykino/CVE-2025-54321",
CVE-2025/CVE-2025-54xx/CVE-2025-5480.json
+15 -3
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-5480",
"sourceIdentifier": "[email protected]",
"published": "2025-06-06T19:15:27.757",
"lastModified": "2025-08-18T15:59:15.010",
"lastModified": "2025-11-19T17:50:43.850",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@@ -53,6 +53,7 @@
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
@@ -60,9 +61,20 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:action1:action1:*:*:*:*:*:*:*:*",
"criteria": "cpe:2.3:a:action1:agent:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.218.620.1",
"matchCriteriaId": "26FB35C8-8A31-465D-9B82-F9D22A4FCCC9"
"matchCriteriaId": "2091AAD6-32BD-4957-8B06-9EE0C5A5CCDD"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
CVE-2025/CVE-2025-566xx/CVE-2025-56643.json
+37 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-56643",
"sourceIdentifier": "[email protected]",
"published": "2025-11-18T18:16:07.647",
"lastModified": "2025-11-18T18:16:07.647",
"lastModified": "2025-11-19T17:15:49.793",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -11,7 +11,42 @@
"value": "Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a token is compromised. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-613"
}
]
}
],
"references": [
{
"url": "https://github.com/0xBS0D27/CVE-2025-56643",
CVE-2025/CVE-2025-606xx/CVE-2025-60686.json
+98 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-60686",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T16:15:52.590",
"lastModified": "2025-11-14T16:42:03.187",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-19T17:41:28.740",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -47,18 +47,111 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.614_b20230630:*:*:*:*:*:*:*",
"matchCriteriaId": "BCA249C9-68D4-48FE-B0CA-77ECF53DDE3B"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:totolink:a720r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A1DE5168-B787-462C-B024-2B8F73759034"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:totolink:lr1200gb_firmware:9.1.0u.6619_b20230130:*:*:*:*:*:*:*",
"matchCriteriaId": "00F36DE9-D043-4C8B-9EF9-8DA669589E85"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:totolink:lr1200gb:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8442849E-5B06-41A1-8DA8-827FBD7A34E5"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:totolink:nr1800x_firmware:9.1.0u.6681_b20230703:*:*:*:*:*:*:*",
"matchCriteriaId": "7F9DCAA5-1EC6-44A1-9606-B6FBF29DEC65"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:totolink:nr1800x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B4D2D0E8-2678-4238-8229-83450ECA1153"
}
]
}
]
}
],
"references": [
{
"url": "http://totolink.com",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60686.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.totolink.net/",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}
CVE-2025/CVE-2025-606xx/CVE-2025-60687.json
+44 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-60687",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T16:15:52.720",
"lastModified": "2025-11-14T16:42:03.187",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-19T17:38:41.063",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -47,18 +47,57 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:totolink:lr1200gb_firmware:9.1.0u.6619_b20230130:*:*:*:*:*:*:*",
"matchCriteriaId": "00F36DE9-D043-4C8B-9EF9-8DA669589E85"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:totolink:lr1200gb:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8442849E-5B06-41A1-8DA8-827FBD7A34E5"
}
]
}
]
}
],
"references": [
{
"url": "http://totolink.com",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-LR1200GB/CVE-2025-60687.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.totolink.net/",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}
CVE-2025/CVE-2025-606xx/CVE-2025-60688.json
+71 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-60688",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T16:15:52.850",
"lastModified": "2025-11-14T16:42:03.187",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-19T17:33:06.030",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -47,18 +47,84 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:totolink:lr1200gb_firmware:9.1.0u.6619_b20230130:*:*:*:*:*:*:*",
"matchCriteriaId": "00F36DE9-D043-4C8B-9EF9-8DA669589E85"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:totolink:lr1200gb:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8442849E-5B06-41A1-8DA8-827FBD7A34E5"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:totolink:nr1800x_firmware:9.1.0u.6681_b20230703:*:*:*:*:*:*:*",
"matchCriteriaId": "7F9DCAA5-1EC6-44A1-9606-B6FBF29DEC65"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:totolink:nr1800x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B4D2D0E8-2678-4238-8229-83450ECA1153"
}
]
}
]
}
],
"references": [
{
"url": "http://totolink.com",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-LR1200GB/CVE-2025-60688.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.totolink.net/",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}
CVE-2025/CVE-2025-606xx/CVE-2025-60689.json
+44 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-60689",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T16:15:52.970",
"lastModified": "2025-11-14T16:42:03.187",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:30:38.190",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -47,18 +47,57 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linksys:e1200_firmware:2.0.11.001:*:*:*:*:*:*:*",
"matchCriteriaId": "2461F974-2121-490C-A6CD-18B006070679"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:linksys:e1200:2:*:*:*:*:*:*:*",
"matchCriteriaId": "4B14B800-5FCA-4E2B-A42B-EBE6EEC8FBB1"
}
]
}
]
}
],
"references": [
{
"url": "http://linksys.com",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
},
{
"url": "https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60689.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.linksys.com/",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}
CVE-2025/CVE-2025-624xx/CVE-2025-62406.json
+6 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-62406",
"sourceIdentifier": "[email protected]",
"published": "2025-11-18T23:15:54.827",
"lastModified": "2025-11-18T23:15:54.827",
"lastModified": "2025-11-19T17:15:50.100",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -38,7 +38,7 @@
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"type": "Secondary",
"description": [
{
"lang": "en",
@@ -55,6 +55,10 @@
{
"url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6",
"source": "[email protected]"
},
{
"url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2025/CVE-2025-624xx/CVE-2025-62484.json
+62 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-62484",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T16:15:53.200",
"lastModified": "2025-11-14T16:42:03.187",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T17:24:03.203",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -32,6 +32,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
@@ -47,10 +67,49 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:android:*:*",
"versionEndExcluding": "6.5.10",
"matchCriteriaId": "98DD5270-A4AE-4E08-A2E1-5A7DF2E76F36"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:iphone_os:*:*",
"versionEndExcluding": "6.5.10",
"matchCriteriaId": "20C73D4A-B93C-4CD8-B753-0B1CA49DD23F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:zoom:workplace:*:*:*:*:*:android:*:*",
"versionEndExcluding": "6.5.10",
"matchCriteriaId": "019D6D44-FAB4-47EC-9A82-CDCA374293F1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:zoom:workplace:*:*:*:*:*:iphone_os:*:*",
"versionEndExcluding": "6.5.10",
"matchCriteriaId": "0E1FD0E8-796C-4F88-9321-59C5B8B359D4"
}
]
}
]
}
],
"references": [
{
"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25048",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-632xx/CVE-2025-63205.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-63205",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T18:15:48.507",
"lastModified": "2025-11-19T18:15:48.507",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 Production Analytics Probe, and NOMAD, firmware versions 6.5.0-9, allowing attackers to gain sensitive information such as administrator passwords via the /probe/core/setup/passwd endpoint."
}
],
"metrics": {},
"references": [
{
"url": "https://bridgetech.tv/",
"source": "[email protected]"
},
{
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63205_bridgetech%20probes%20Information%20Disclosure",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-632xx/CVE-2025-63206.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-63206",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T18:15:48.647",
"lastModified": "2025-11-19T18:15:48.647",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser."
}
],
"metrics": {},
"references": [
{
"url": "http://dasansmc.com/",
"source": "[email protected]"
},
{
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63206_Dasan%20Switch%20DS2924%20Authentication%20Bypass",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-632xx/CVE-2025-63207.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-63207",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T18:15:48.793",
"lastModified": "2025-11-19T18:15:48.793",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on the /_Passwd.html endpoint. An attacker can send an unauthenticated POST request to change the Admin, Operator, and User passwords, resulting in complete system compromise."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63207_RVR%20Elettronica%20TEX%20Broken%20Access%20Control",
"source": "[email protected]"
},
{
"url": "https://www.rvr.it/en/",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-632xx/CVE-2025-63208.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-63208",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T18:15:48.933",
"lastModified": "2025-11-19T18:15:48.933",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive information such as administrator passwords via the /probe/core/setup/passwd endpoint."
}
],
"metrics": {},
"references": [
{
"url": "https://bridgetech.tv/",
"source": "[email protected]"
},
{
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63208_bridgetech%20VB288%20Information%20Disclosure",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-632xx/CVE-2025-63209.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-63209",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T18:15:49.067",
"lastModified": "2025-11-19T18:15:49.067",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an information disclosure vulnerability allowing unauthenticated attackers to retrieve admin credentials and system settings via an unprotected /setup.xml endpoint. The admin password is stored in plaintext under the <p05> XML tag, potentially leading to remote compromise of the transmitter system."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63209_ELCA%20Star%20Transmitter%20Remote%20Control%20-%20Information%20Disclosure",
"source": "[email protected]"
},
{
"url": "https://www.elcaradio.com",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-632xx/CVE-2025-63210.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-63210",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T18:15:49.207",
"lastModified": "2025-11-19T18:15:49.207",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit this issue by modifying intercepted responses from the /celoxservice endpoint. By injecting a forged response body during the loginWithUserName flow, the attacker can gain Superuser or Operator access without providing valid credentials."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63210_Newtec%20Celox%20UHD%20Authentication%20Bypass%20_%20Privilege%20Escalation",
"source": "[email protected]"
},
{
"url": "https://www.newtec.com/",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-632xx/CVE-2025-63224.json
+41 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-63224",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T16:15:48.450",
"lastModified": "2025-11-19T16:15:48.450",
"lastModified": "2025-11-19T17:15:50.223",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -11,7 +11,46 @@
"value": "The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
},
{
"lang": "en",
"value": "CWE-384"
}
]
}
],
"references": [
{
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63224_Itel%20DAB%20Encoder%20Authentication%20Bypass",
CVE-2025/CVE-2025-635xx/CVE-2025-63513.json
+41 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-63513",
"sourceIdentifier": "[email protected]",
"published": "2025-11-18T17:16:10.360",
"lastModified": "2025-11-18T17:16:10.360",
"lastModified": "2025-11-19T17:15:50.447",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -11,7 +11,42 @@
"value": "kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vulnerability in the appointment cancellation functionality."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"references": [
{
"url": "https://github.com/NicatAliyevh/Zero-Days/blob/main/Hospital_Management_System_IDOR.md",
@@ -20,6 +55,10 @@
{
"url": "https://github.com/kishan0725/Hospital-Management-System/issues/55",
"source": "[email protected]"
},
{
"url": "https://github.com/kishan0725/Hospital-Management-System/issues/55",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2025/CVE-2025-636xx/CVE-2025-63694.json
+41 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-63694",
"sourceIdentifier": "[email protected]",
"published": "2025-11-18T18:16:13.437",
"lastModified": "2025-11-18T18:16:13.437",
"lastModified": "2025-11-19T17:15:50.677",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -11,7 +11,42 @@
"value": "DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://github.com/Yohane-Mashiro/dzzoffice_sql",
@@ -20,6 +55,10 @@
{
"url": "https://github.com/zyx0814/dzzoffice/issues/364",
"source": "[email protected]"
},
{
"url": "https://github.com/Yohane-Mashiro/dzzoffice_sql",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2025/CVE-2025-636xx/CVE-2025-63695.json
+41 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-63695",
"sourceIdentifier": "[email protected]",
"published": "2025-11-18T18:16:13.590",
"lastModified": "2025-11-18T18:16:13.590",
"lastModified": "2025-11-19T17:15:50.910",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -11,7 +11,42 @@
"value": "DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://github.com/Yohane-Mashiro/dzzoffice_upload",
@@ -20,6 +55,10 @@
{
"url": "https://github.com/zyx0814/dzzoffice/issues/365",
"source": "[email protected]"
},
{
"url": "https://github.com/Yohane-Mashiro/dzzoffice_upload",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2025/CVE-2025-638xx/CVE-2025-63828.json
+41 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-63828",
"sourceIdentifier": "[email protected]",
"published": "2025-11-18T18:16:13.753",
"lastModified": "2025-11-18T18:16:13.753",
"lastModified": "2025-11-19T17:15:51.133",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -11,7 +11,42 @@
"value": "Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-601"
}
]
}
],
"references": [
{
"url": "https://github.com/mertdurum06/BackdropCms-1.32.1/",
@@ -20,6 +55,10 @@
{
"url": "https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt",
"source": "[email protected]"
},
{
"url": "https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2025/CVE-2025-638xx/CVE-2025-63879.json
+37 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-63879",
"sourceIdentifier": "[email protected]",
"published": "2025-11-19T16:15:49.280",
"lastModified": "2025-11-19T16:15:49.280",
"lastModified": "2025-11-19T17:15:51.360",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -11,7 +11,42 @@
"value": "A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the id parameter."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2025-63879.md",
CVE-2025/CVE-2025-638xx/CVE-2025-63891.json
+32 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-63891",
"sourceIdentifier": "[email protected]",
"published": "2025-11-14T21:15:45.223",
"lastModified": "2025-11-18T14:06:55.963",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-19T18:55:50.953",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -47,18 +47,45 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oretnom23:simple_online_book_store_system:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B40E9E0E-EAC6-4992-9E9D-2B519E73E134"
}
]
}
]
}
],
"references": [
{
"url": "http://simple.com",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Not Applicable"
]
},
{
"url": "http://sourcecodester.com",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
},
{
"url": "https://github.com/lucascdsm/CVEs/blob/main/CVE-2025-63891.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-640xx/CVE-2025-64084.json
+33 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-64084",
"sourceIdentifier": "[email protected]",
"published": "2025-11-14T21:15:45.367",
"lastModified": "2025-11-18T14:06:55.963",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-11-19T18:50:31.280",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -47,18 +47,46 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:magicbug:cloudlog:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.6",
"matchCriteriaId": "C2C2D20F-EC44-4703-96E6-A6540F69F83A"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/XY20130630/Cloudlog/security/advisories/GHSA-4r9r-3r3q-jg44",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://github.com/magicbug/Cloudlog/commit/72a8c3d705c8629f60f64da9f37968417c980242",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/magicbug/Cloudlog/releases/tag/2.7.6",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Release Notes"
]
}
]
}
Loaded 100 of 126 files, more files were not shown because too many files have changed in this diff. Show more