admin/nvd-json-data-feeds
1
0 Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2026-10-29 01:30:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2025-10-22T16:00:13.850775+00:00

Browse Source
This commit is contained in:
cad-safe-bot committed 2025-10-22 16:04:01 +00:00
1 parent 45ac2645ca
commit a6d73900dd
380 files changed
+13604 -424
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CVE-2016/CVE-2016-150xx/CVE-2016-15048.json
+94
View File
@@ -0,0 +1,94 @@
{
"id": "CVE-2016-15048",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T15:15:30.923",
"lastModified": "2025-10-22T15:15:30.923",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name.\u00a0VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14\u00a0at 04:45:53.510819 UTC."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"references": [
{
"url": "https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/remote_code_execution/hiboss-rce_2.yaml#L21",
"source": "[email protected]"
},
{
"url": "https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2016-0181444",
"source": "[email protected]"
},
{
"url": "https://www.amttgroup.com/",
"source": "[email protected]"
},
{
"url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-37784",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/amtt-hibos-command-injection-rce-via-server-ping-php",
"source": "[email protected]"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50556.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50556",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:39.673",
"lastModified": "2025-10-22T14:15:39.673",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix potential null-ptr-deref due to drmm_mode_config_init()\n\ndrmm_mode_config_init() will call drm_mode_create_standard_properties()\nand won't check the ret value. When drm_mode_create_standard_properties()\nfailed due to alloc, property will be a NULL pointer and may causes the\nnull-ptr-deref. Fix the null-ptr-deref by adding the ret value check.\n\nFound null-ptr-deref while testing insert module bochs:\ngeneral protection fault, probably for non-canonical address\n 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\nCPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\nRIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]\nCall Trace:\n <TASK>\n __drm_connector_init+0xb6c/0x1100 [drm]\n bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]\n pci_device_probe+0x17d/0x340\n really_probe+0x1db/0x5d0\n __driver_probe_device+0x1e7/0x250\n driver_probe_device+0x4a/0x120\n __driver_attach+0xcd/0x2c0\n bus_for_each_dev+0x11a/0x1b0\n bus_add_driver+0x3d7/0x500\n driver_register+0x18e/0x320\n do_one_initcall+0xc4/0x3e0\n do_init_module+0x1b4/0x630\n load_module+0x5dca/0x7230\n __do_sys_finit_module+0x100/0x170\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7ff65af9f839"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/834c23e4f798dcdc8af251b3c428ceef94741991",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/961620ad67611a7320a49f4b6f3c5e2906833a03",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b14147464251f66e38fa39f0aae9780466db8610",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d06e827a65a6bcd2e329045d891d0739cec1cf4a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50557.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50557",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:40.403",
"lastModified": "2025-10-22T14:15:40.403",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions()\n\nThe thunderbay_add_functions() will free memory of thunderbay_funcs\nwhen everything is ok, but thunderbay_funcs will not be freed when\nthunderbay_add_functions() fails, then there will be a memory leak,\nso we need to add kfree() when thunderbay_add_functions() fails to\nfix it.\n\nIn addition, doing some cleaner works, moving kfree(funcs) from\nthunderbay_add_functions() to thunderbay_build_functions()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/3650943bab29d03ef147290451237713ed1942cd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/83e1bcaf8cef26edaaf2a6098ef760f563683483",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aae4846e8e49044cb51d0276bec2a3fc2d5cd8da",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50558.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50558",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:40.513",
"lastModified": "2025-10-22T14:15:40.513",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode\n\nCommit faa87ce9196d (\"regmap-irq: Introduce config registers for irq\ntypes\") added the num_config_regs, then commit 9edd4f5aee84 (\"regmap-irq:\nDeprecate type registers and virtual registers\") suggested to replace\nnum_type_reg with it. However, regmap_add_irq_chip_fwnode wasn't modified\nto use the new property. Later on, commit 255a03bb1bb3 (\"ASoC: wcd9335:\nConvert irq chip to config regs\") removed the old num_type_reg property\nfrom the WCD9335 driver's struct regmap_irq_chip, causing a null pointer\ndereference in regmap_irq_set_type when it tried to index d->type_buf as\nit was never allocated in regmap_add_irq_chip_fwnode:\n\n[ 39.199374] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n\n[ 39.200006] Call trace:\n[ 39.200014] regmap_irq_set_type+0x84/0x1c0\n[ 39.200026] __irq_set_trigger+0x60/0x1c0\n[ 39.200040] __setup_irq+0x2f4/0x78c\n[ 39.200051] request_threaded_irq+0xe8/0x1a0\n\nUse num_config_regs in regmap_add_irq_chip_fwnode instead of num_type_reg,\nand fall back to it if num_config_regs isn't defined to maintain backward\ncompatibility."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/57bb34330c0fc70bb4ab96399a3c1b80e73e9d49",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/84498d1fb35de6ab71bdfdb6270a464fb4a0951b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/961db32e52f4d34a9a95939a30393fd190397f84",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50559.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50559",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:40.627",
"lastModified": "2025-10-22T14:15:40.627",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: scu: fix memleak on platform_device_add() fails\n\nNo error handling is performed when platform_device_add()\nfails. Add error processing before return, and modified\nthe return value."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/05fe0b3d69b8e094db207648ab21cade56d71cd8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/43c589b7a187ef481b594317eaab8c8f269e4a68",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/855ae87a2073ebf1b395e020de54fdf9ce7d166f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9209e6bab75d4008d9f4248c66008f3ffd24c931",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50560.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50560",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:40.737",
"lastModified": "2025-10-22T14:15:40.737",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/meson: explicitly remove aggregate driver at module unload time\n\nBecause component_master_del wasn't being called when unloading the\nmeson_drm module, the aggregate device would linger forever in the global\naggregate_devices list. That means when unloading and reloading the\nmeson_dw_hdmi module, component_add would call into\ntry_to_bring_up_aggregate_device and find the unbound meson_drm aggregate\ndevice.\n\nThis would in turn dereference some of the aggregate_device's struct\nentries which point to memory automatically freed by the devres API when\nunbinding the aggregate device from meson_drv_unbind, and trigger an\nuse-after-free bug:\n\n[ +0.000014] =============================================================\n[ +0.000007] BUG: KASAN: use-after-free in find_components+0x468/0x500\n[ +0.000017] Read of size 8 at addr ffff000006731688 by task modprobe/2536\n[ +0.000018] CPU: 4 PID: 2536 Comm: modprobe Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1\n[ +0.000010] Hardware name: Hardkernel ODROID-N2Plus (DT)\n[ +0.000008] Call trace:\n[ +0.000005] dump_backtrace+0x1ec/0x280\n[ +0.000011] show_stack+0x24/0x80\n[ +0.000007] dump_stack_lvl+0x98/0xd4\n[ +0.000010] print_address_description.constprop.0+0x80/0x520\n[ +0.000011] print_report+0x128/0x260\n[ +0.000007] kasan_report+0xb8/0xfc\n[ +0.000007] __asan_report_load8_noabort+0x3c/0x50\n[ +0.000009] find_components+0x468/0x500\n[ +0.000008] try_to_bring_up_aggregate_device+0x64/0x390\n[ +0.000009] __component_add+0x1dc/0x49c\n[ +0.000009] component_add+0x20/0x30\n[ +0.000008] meson_dw_hdmi_probe+0x28/0x34 [meson_dw_hdmi]\n[ +0.000013] platform_probe+0xd0/0x220\n[ +0.000008] really_probe+0x3ac/0xa80\n[ +0.000008] __driver_probe_device+0x1f8/0x400\n[ +0.000008] driver_probe_device+0x68/0x1b0\n[ +0.000008] __driver_attach+0x20c/0x480\n[ +0.000009] bus_for_each_dev+0x114/0x1b0\n[ +0.000007] driver_attach+0x48/0x64\n[ +0.000009] bus_add_driver+0x390/0x564\n[ +0.000007] driver_register+0x1a8/0x3e4\n[ +0.000009] __platform_driver_register+0x6c/0x94\n[ +0.000007] meson_dw_hdmi_platform_driver_init+0x30/0x1000 [meson_dw_hdmi]\n[ +0.000014] do_one_initcall+0xc4/0x2b0\n[ +0.000008] do_init_module+0x154/0x570\n[ +0.000010] load_module+0x1a78/0x1ea4\n[ +0.000008] __do_sys_init_module+0x184/0x1cc\n[ +0.000008] __arm64_sys_init_module+0x78/0xb0\n[ +0.000008] invoke_syscall+0x74/0x260\n[ +0.000008] el0_svc_common.constprop.0+0xcc/0x260\n[ +0.000009] do_el0_svc+0x50/0x70\n[ +0.000008] el0_svc+0x68/0x1a0\n[ +0.000009] el0t_64_sync_handler+0x11c/0x150\n[ +0.000009] el0t_64_sync+0x18c/0x190\n\n[ +0.000014] Allocated by task 902:\n[ +0.000007] kasan_save_stack+0x2c/0x5c\n[ +0.000009] __kasan_kmalloc+0x90/0xd0\n[ +0.000007] __kmalloc_node+0x240/0x580\n[ +0.000010] memcg_alloc_slab_cgroups+0xa4/0x1ac\n[ +0.000010] memcg_slab_post_alloc_hook+0xbc/0x4c0\n[ +0.000008] kmem_cache_alloc_node+0x1d0/0x490\n[ +0.000009] __alloc_skb+0x1d4/0x310\n[ +0.000010] alloc_skb_with_frags+0x8c/0x620\n[ +0.000008] sock_alloc_send_pskb+0x5ac/0x6d0\n[ +0.000010] unix_dgram_sendmsg+0x2e0/0x12f0\n[ +0.000010] sock_sendmsg+0xcc/0x110\n[ +0.000007] sock_write_iter+0x1d0/0x304\n[ +0.000008] new_sync_write+0x364/0x460\n[ +0.000007] vfs_write+0x420/0x5ac\n[ +0.000008] ksys_write+0x19c/0x1f0\n[ +0.000008] __arm64_sys_write+0x78/0xb0\n[ +0.000007] invoke_syscall+0x74/0x260\n[ +0.000008] el0_svc_common.constprop.0+0x1a8/0x260\n[ +0.000009] do_el0_svc+0x50/0x70\n[ +0.000007] el0_svc+0x68/0x1a0\n[ +0.000008] el0t_64_sync_handler+0x11c/0x150\n[ +0.000008] el0t_64_sync+0x18c/0x190\n\n[ +0.000013] Freed by task 2509:\n[ +0.000008] kasan_save_stack+0x2c/0x5c\n[ +0.000007] kasan_set_track+0x2c/0x40\n[ +0.000008] kasan_set_free_info+0x28/0x50\n[ +0.000008] ____kasan_slab_free+0x128/0x1d4\n[ +0.000008] __kasan_slab_free+0x18/0x24\n[ +0.000007] slab_free_freelist_hook+0x108/0x230\n[ +0.000010] \n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/587c7da877219e6185217bf64418e62e114dab1e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6ef20de2fe0ee1decedbfabb17782897ca27bfe5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8616f2a0589a80e08434212324250eb22f6a66ce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a427a22839daacd36531a62c83d5c9cd6f20657",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f11aa996fc01888f870be0e79ba71526888c0d8a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50561.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2022-50561",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:40.847",
"lastModified": "2025-10-22T14:15:40.847",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: fix memory leak in iio_device_register_eventset()\n\nWhen iio_device_register_sysfs_group() returns failed,\niio_device_register_eventset() needs to free attrs array.\n\nOtherwise, kmemleak would scan & report memory leak as below:\n\nunreferenced object 0xffff88810a1cc3c0 (size 32):\n comm \"100-i2c-vcnl302\", pid 728, jiffies 4295052307 (age 156.027s)\n backtrace:\n __kmalloc+0x46/0x1b0\n iio_device_register_eventset at drivers/iio/industrialio-event.c:541\n __iio_device_register at drivers/iio/industrialio-core.c:1959\n __devm_iio_device_register at drivers/iio/industrialio-core.c:2040"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5de3add7509c95685f1185683b817dd206c4b1f1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/86fdd15e10e404e70ecb2a3bff24d70356d42b36",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a154b1c139fbf6a49762159be81d425d41ceec87",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dc6afd6070f3a5b086c8c5cfa6ded63ae44494da",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50562.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50562",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:40.953",
"lastModified": "2025-10-22T14:15:40.953",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: acpi: Call acpi_put_table() to fix memory leak\n\nThe start and length of the event log area are obtained from\nTPM2 or TCPA table, so we call acpi_get_table() to get the\nACPI information, but the acpi_get_table() should be coupled with\nacpi_put_table() to release the ACPI memory, add the acpi_put_table()\nproperly to fix the memory leak.\n\nWhile we are at it, remove the redundant empty line at the\nend of the tpm_read_log_acpi()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/638cd298dfebce46919cbd6cf1884701215f506d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/694a3d66f493afd77c704c6de91d9be4d6e004e4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8740a12ca2e2959531ad253bac99ada338b33d80",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ddc48068ac85740d3d5f9f3b0b323e733a35b33",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf31e3f8077af539feaf4e9bbf82e8eb51e7e5a8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50563.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50563",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:41.067",
"lastModified": "2025-10-22T14:15:41.067",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: Fix UAF in run_timer_softirq()\n\nWhen dm_resume() and dm_destroy() are concurrent, it will\nlead to UAF, as follows:\n\n BUG: KASAN: use-after-free in __run_timers+0x173/0x710\n Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0\n<snip>\n Call Trace:\n <IRQ>\n dump_stack_lvl+0x73/0x9f\n print_report.cold+0x132/0xaa2\n _raw_spin_lock_irqsave+0xcd/0x160\n __run_timers+0x173/0x710\n kasan_report+0xad/0x110\n __run_timers+0x173/0x710\n __asan_store8+0x9c/0x140\n __run_timers+0x173/0x710\n call_timer_fn+0x310/0x310\n pvclock_clocksource_read+0xfa/0x250\n kvm_clock_read+0x2c/0x70\n kvm_clock_get_cycles+0xd/0x20\n ktime_get+0x5c/0x110\n lapic_next_event+0x38/0x50\n clockevents_program_event+0xf1/0x1e0\n run_timer_softirq+0x49/0x90\n __do_softirq+0x16e/0x62c\n __irq_exit_rcu+0x1fa/0x270\n irq_exit_rcu+0x12/0x20\n sysvec_apic_timer_interrupt+0x8e/0xc0\n\nOne of the concurrency UAF can be shown as below:\n\n use free\ndo_resume |\n __find_device_hash_cell |\n dm_get |\n atomic_inc(&md->holders) |\n | dm_destroy\n | __dm_destroy\n | if (!dm_suspended_md(md))\n | atomic_read(&md->holders)\n | msleep(1)\n dm_resume |\n __dm_resume |\n dm_table_resume_targets |\n pool_resume |\n do_waker #add delay work |\n dm_put |\n atomic_dec(&md->holders) |\n | dm_table_destroy\n | pool_dtr\n | __pool_dec\n | __pool_destroy\n | destroy_workqueue\n | kfree(pool) # free pool\n time out\n__do_softirq\n run_timer_softirq # pool has already been freed\n\nThis can be easily reproduced using:\n 1. create thin-pool\n 2. dmsetup suspend pool\n 3. dmsetup resume pool\n 4. dmsetup remove_all # Concurrent with 3\n\nThe root cause of this UAF bug is that dm_resume() adds timer after\ndm_destroy() skips cancelling the timer because of suspend status.\nAfter timeout, it will call run_timer_softirq(), however pool has\nalready been freed. The concurrency UAF bug will happen.\n\nTherefore, cancelling timer again in __pool_destroy()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/34cd15d83b7206188d440b29b68084fcafde9395",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/34fe9c2251f19786a6689149a6212c6c0de1d63b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/550a4fac7ecfee5bac6a0dd772456ca62fb72f46",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7ae6aa649394e1e7f6dafb55ce0d578c0572a280",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7ee059d06a5d3c15465959e0472993e80fbe4e81",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/88430ebcbc0ec637b710b947738839848c20feff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/94e231c9d6f2648d2f1f68e7f476e050ee0a6159",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d9971fa4d8bde63d49c743c1b32d12fbbd3a30bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e8b8e0d2bbf7d1172c4f435621418e29ee408d46",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50564.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50564",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:41.193",
"lastModified": "2025-10-22T14:15:41.193",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/netiucv: Fix return type of netiucv_tx()\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed. A\nproposed warning in clang aims to catch these at compile time, which\nreveals:\n\n drivers/s390/net/netiucv.c:1854:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n .ndo_start_xmit = netiucv_tx,\n ^~~~~~~~~~\n\n->ndo_start_xmit() in 'struct net_device_ops' expects a return type of\n'netdev_tx_t', not 'int'. Adjust the return type of netiucv_tx() to\nmatch the prototype's to resolve the warning and potential CFI failure,\nshould s390 select ARCH_SUPPORTS_CFI_CLANG in the future.\n\nAdditionally, while in the area, remove a comment block that is no\nlonger relevant."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ac0217ca9186c2f9af9a0113a331a42aa847894",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4bee3c75d5bf7c2b5dc0b520410eb40449e5da31",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85d392710275355425df8618ccbebbc336f5acc5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/88d86d18d7cf7e9137c95f9d212bb9fff8a1b4be",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d034fa43af92fc46a81d882f46d9cc3e4ffdbbcc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dfbf0122ea1b9b3e73fa22c8ff6bd888935c54fc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e7a849f740e3576e79cba403697e916f4c3a6f12",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eccc88c0efe407e579291792ad07a7dedc0f63f0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f13d870fce90f01cf930bfaffecc8185ae0be21c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50565.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50565",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:41.313",
"lastModified": "2025-10-22T14:15:41.313",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx()\n\nurbs does not be freed in exception paths in __lf_x_usb_enable_rx().\nThat will trigger memory leak. To fix it, add kfree() for urbs within\n\"error\" label. Compile tested only."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/286464463a05cb4bad80b134e24f8ffaab20bee4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/895b3b06efc285c1245242e9638b9ae251dc13ec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fce7e46273649d9cdcd98d89551975a65f206a14",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50566.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50566",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:41.420",
"lastModified": "2025-10-22T14:15:41.420",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: Fix device name leak when register device failed in add_mtd_device()\n\nThere is a kmemleak when register device failed:\n unreferenced object 0xffff888101aab550 (size 8):\n comm \"insmod\", pid 3922, jiffies 4295277753 (age 925.408s)\n hex dump (first 8 bytes):\n 6d 74 64 30 00 88 ff ff mtd0....\n backtrace:\n [<00000000bde26724>] __kmalloc_node_track_caller+0x4e/0x150\n [<000000003c32b416>] kvasprintf+0xb0/0x130\n [<000000001f7a8f15>] kobject_set_name_vargs+0x2f/0xb0\n [<000000006e781163>] dev_set_name+0xab/0xe0\n [<00000000e30d0c78>] add_mtd_device+0x4bb/0x700\n [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0\n [<00000000c0d88488>] 0xffffffffa0238457\n [<00000000b40d0922>] 0xffffffffa02a008f\n [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0\n [<00000000770f6ca6>] do_init_module+0xdf/0x320\n [<000000007b6768fe>] load_module+0x2f98/0x3330\n [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0\n [<00000000674c2290>] do_syscall_64+0x35/0x80\n [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nIf register device failed, should call put_device() to give up the\nreference."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b172fb05d6315ecec082fd7544a3390e96f0d7e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2302e2dc42b1f84f951c725ce742fc21c5a1e151",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/330bc5533e8a8ed69cb951d5a8edce9bddb9db21",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/71212d73184845c944ef1b43f092e643e5bde003",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/895d68a39481a75c680aa421546931fb11942fa6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a75f45afa932bfb24a2603ebcea5efd2e7cdcfd6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bcabe1dc2a344adbb3382930a23e273ba9382277",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db07fe76df01f40cb897d6e9066b84e46957beb3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fa0d32ab8407d7481450c664fd0de64f2dae9489",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50567.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50567",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:41.533",
"lastModified": "2025-10-22T14:15:41.533",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: jfs: fix shift-out-of-bounds in dbAllocAG\n\nSyzbot found a crash : UBSAN: shift-out-of-bounds in dbAllocAG. The\nunderlying bug is the missing check of bmp->db_agl2size. The field can\nbe greater than 64 and trigger the shift-out-of-bounds.\n\nFix this bug by adding a check of bmp->db_agl2size in dbMount since this\nfield is used in many following functions. The upper bound for this\nfield is L2MAXL2SIZE - L2MAXAG, thanks for the help of Dave Kleikamp.\nNote that, for maintenance, I reorganized error handling code of dbMount."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0536f76a2bca83d1a3740517ba22cc93a44b3099",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2c575c8905f7a8b32d5611b91856b69bac2a5bf1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3115313cf03113e87c87adee18ee49a20bbdb9ba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/359616ce587e524107730504891afa4b1a8be58c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3e997e4ce8ae7ab89d72334120f6aee49c5bbdbd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/67973caae78e21ee46a7281aaa8ca364eb9c444f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/898f706695682b9954f280d95e49fa86ffa55d08",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d3b486946a4e62c7ef6023f7d9c1d049051384ba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eea87acb6027be3dd4d3c57186bb22800d57fdda",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50568.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2022-50568",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:41.657",
"lastModified": "2025-10-22T14:15:41.657",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_hid: fix f_hidg lifetime vs cdev\n\nThe embedded struct cdev does not have its lifetime correctly tied to\nthe enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN\nis held open while the gadget is deleted.\n\nThis can readily be replicated with libusbgx's example programs (for\nconciseness - operating directly via configfs is equivalent):\n\n\tgadget-hid\n\texec 3<> /dev/hidg0\n\tgadget-vid-pid-remove\n\texec 3<&-\n\nPull the existing device up in to struct f_hidg and make use of the\ncdev_device_{add,del}() helpers. This changes the lifetime of the\ndevice object to match struct f_hidg, but note that it is still added\nand deleted at the same time."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b6a53e447ec3d81623610c8c7ec5082b47dfdce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1cd7f156f6389918f760687fbbf133c86da93162",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/89ff3dfac604614287ad5aad9370c3f984ea3f4b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9e08b7f5fa00e9d550851352bd0d1ba74ccffef2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9e4b85d815b14bd4db2deea2a54264a23de8b896",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c78c87c4e389b62f8892af7f59857447aa6d9797",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d3136b79705c2e3bba9c76adc5628af0215d798e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50569.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50569",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:41.780",
"lastModified": "2025-10-22T14:15:41.780",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Update ipcomp_scratches with NULL when freed\n\nCurrently if ipcomp_alloc_scratches() fails to allocate memory\nipcomp_scratches holds obsolete address. So when we try to free the\npercpu scratches using ipcomp_free_scratches() it tries to vfree non\nexistent vm area. Described below:\n\nstatic void * __percpu *ipcomp_alloc_scratches(void)\n{\n ...\n scratches = alloc_percpu(void *);\n if (!scratches)\n return NULL;\nipcomp_scratches does not know about this allocation failure.\nTherefore holding the old obsolete address.\n ...\n}\n\nSo when we free,\n\nstatic void ipcomp_free_scratches(void)\n{\n ...\n scratches = ipcomp_scratches;\nAssigning obsolete address from ipcomp_scratches\n\n if (!scratches)\n return;\n\n for_each_possible_cpu(i)\n vfree(*per_cpu_ptr(scratches, i));\nTrying to free non existent page, causing warning: trying to vfree\nexistent vm area.\n ...\n}\n\nFix this breakage by updating ipcomp_scrtches with NULL when scratches\nis freed"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/03155680191ef0f004b1d6a5714c5b8cd271ab61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/18373ed500f7cd53e24d9b0bd0f1c09d78dba87e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1e8abde895b3ac6a368cbdb372e8800c49e73a28",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2c19945ce8095d065df550e7fe350cd5cc40c6e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a04d2fc700f717104bfb95b0f6694e448a4537f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a39f456d62810c0efb43cead22f98d95b53e4b1a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/be81c44242b20fc3bdcc73480ef8aaee56f5d0b6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/debca61df6bc2f65e020656c9c5b878d6b38d30f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f3bdba4440d82e0da2b1bfc35d3836c8a8e00677",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50570.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50570",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:41.910",
"lastModified": "2025-10-22T14:15:41.910",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: fix memory corruption in ioctl\n\nIf \"s_mem.bytes\" is larger than the buffer size it leads to memory\ncorruption."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c2e18924504208644d18415667895a4ac54cf2a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/868fc93b615b9f6c2b0b1894536618fa6cd66acc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a07b45fd3c2dda24fad43639be5335a4595196a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e548f9503c4b3292a60a63fe77dccea62999a35a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f143f1d9a8e5c6c9db3de81ca270191226fcce36",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fd1d3b265784a2243fcaef06aebfb2f8ee733cec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50571.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2022-50571",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.020",
"lastModified": "2025-10-22T14:15:42.020",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: call __btrfs_remove_free_space_cache_locked on cache load failure\n\nNow that lockdep is staying enabled through our entire CI runs I started\nseeing the following stack in generic/475\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 2171864 at fs/btrfs/discard.c:604 btrfs_discard_update_discardable+0x98/0xb0\nCPU: 1 PID: 2171864 Comm: kworker/u4:0 Not tainted 5.19.0-rc8+ #789\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014\nWorkqueue: btrfs-cache btrfs_work_helper\nRIP: 0010:btrfs_discard_update_discardable+0x98/0xb0\nRSP: 0018:ffffb857c2f7bad0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8c85c605c200 RCX: 0000000000000001\nRDX: 0000000000000000 RSI: ffffffff86807c5b RDI: ffffffff868a831e\nRBP: ffff8c85c4c54000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff8c85c66932f0 R11: 0000000000000001 R12: ffff8c85c3899010\nR13: ffff8c85d5be4f40 R14: ffff8c85c4c54000 R15: ffff8c86114bfa80\nFS: 0000000000000000(0000) GS:ffff8c863bd00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f2e7f168160 CR3: 000000010289a004 CR4: 0000000000370ee0\nCall Trace:\n\n __btrfs_remove_free_space_cache+0x27/0x30\n load_free_space_cache+0xad2/0xaf0\n caching_thread+0x40b/0x650\n ? lock_release+0x137/0x2d0\n btrfs_work_helper+0xf2/0x3e0\n ? lock_is_held_type+0xe2/0x140\n process_one_work+0x271/0x590\n ? process_one_work+0x590/0x590\n worker_thread+0x52/0x3b0\n ? process_one_work+0x590/0x590\n kthread+0xf0/0x120\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x1f/0x30\n\nThis is the code\n\n ctl = block_group->free_space_ctl;\n discard_ctl = &block_group->fs_info->discard_ctl;\n\n lockdep_assert_held(&ctl->tree_lock);\n\nWe have a temporary free space ctl for loading the free space cache in\norder to avoid having allocations happening while we're loading the\ncache. When we hit an error we free it all up, however this also calls\nbtrfs_discard_update_discardable, which requires\nblock_group->free_space_ctl->tree_lock to be held. However this is our\ntemporary ctl so this lock isn't held. Fix this by calling\n__btrfs_remove_free_space_cache_locked instead so that we only clean up\nthe entries and do not mess with the discardable stats."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/819a61301275dcc573e3f520be3dc2c8531bee2d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a1ae2781dee9fc21ca82db682d37bea4bd074ad",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50572.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50572",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.123",
"lastModified": "2025-10-22T14:15:42.123",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()\n\nThe of_get_next_child() returns a node with refcount incremented, and\ndecrements the refcount of prev. So in the error path of the while loop,\nof_node_put() needs be called for cpu_ep."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/06c9d468c06806dab752eb8e72addbf3792c1023",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/49dad92af6892f46851af989ef3aa7cd7316c389",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4cc8431ec77a43ea106d8bde0860c61cfdda1cd0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85eb5c952b7fe2d2059beaa4a4dd26688b25547b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ab2d12c726f0fde0692fa5d81d8019b3dcd62d0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ed1376f771404917c2ec3ebc617431ec01146134",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50573.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2022-50573",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.233",
"lastModified": "2025-10-22T14:15:42.233",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks\n\nCoverity message: variable \"buf\" going out of scope leaks the storage.\n\nAddresses-Coverity-ID: 1527799 (\"Resource leaks\")"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/8b25301af01566f4b5a301fc1ad7c5d2b1788d7f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ecff00802f60fa5d08c133d209ed984a455a41f8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50574.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2022-50574",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.333",
"lastModified": "2025-10-22T14:15:42.333",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/omap: dss: Fix refcount leak bugs\n\nIn dss_init_ports() and __dss_uninit_ports(), we should call\nof_node_put() for the reference returned by of_graph_get_port_by_id()\nin fail path or when it is not used anymore."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f340e1c1c74d11c45a6e32663829b26acd4f47b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b42057e62120813ebe9274f508fa785b7cab33a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f7c4114db841497e1148598e22548dd1f700b22",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9d7af9b1624dd70b67354972d7297429e6372091",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a5ce83e85d795ec98697039ecc518b21d5810adc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e55261beb86a15c190b2ff9090cb47bc06765353",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50575.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2022-50575",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.443",
"lastModified": "2025-10-22T14:15:42.443",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()\n\nAs 'kdata.num' is user-controlled data, if user tries to allocate\nmemory larger than(>=) MAX_ORDER, then kcalloc() will fail, it\ncreates a stack trace and messes up dmesg with a warning.\n\nCall trace:\n-> privcmd_ioctl\n--> privcmd_ioctl_mmap_resource\n\nAdd __GFP_NOWARN in order to avoid too large allocation warning.\nThis is detected by static analysis using smatch."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0bf874183b32eae2cc20e3c5be38ec3d33e7e564",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/46026bb057c35f5bb111bf95e00cd8366d2e34d4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4da411086f5ab32f811a89ef804980ec106ebb65",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f983ee5e5de924d93a7bbb4e6f68f38c6256cd5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5d68ae32d132ea2af73bc223fd64c46f85302a8b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b997b2bb2c53b76a6db6c195930e9ab8e4b0c79",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e0c5f1058ed96f2b7487560c4c4cbd768d13d065",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50576.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50576",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.560",
"lastModified": "2025-10-22T14:15:42.560",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: pch: Fix PCI device refcount leak in pch_request_dma()\n\nAs comment of pci_get_slot() says, it returns a pci_device with its\nrefcount increased. The caller must decrement the reference count by\ncalling pci_dev_put().\n\nSince 'dma_dev' is only used to filter the channel in filter(), we can\ncall pci_dev_put() before exiting from pch_request_dma(). Add the\nmissing pci_dev_put() for the normal and error path."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/07f4ca68b0f6bf84b6b391c14b59fd179fcde9c5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f5d28865c665c9064de631a518f9bc8099d9ce4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/516614a371c26e3334625b4bca19a5362bf658d6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/56e5a7c5ee3f0dc8978b5df2b1a98a1b060c5e2a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6f7d82380fbeaed3a940efc33c23f0c4bbd0fc02",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8be3a7bf773700534a6e8f87f6ed2ed111254be5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/90ff030ca10b69feeebda1427550ebf9ed2ad868",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d165388227aa7e46a9751b90bae6337b5335cdbb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dfd15c5550b9190d5b0f9bcacb3e6436322f3854",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50577.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2022-50577",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.677",
"lastModified": "2025-10-22T14:15:42.677",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Fix memory leak in __ima_inode_hash()\n\nCommit f3cc6b25dcc5 (\"ima: always measure and audit files in policy\") lets\nmeasurement or audit happen even if the file digest cannot be calculated.\n\nAs a result, iint->ima_hash could have been allocated despite\nima_collect_measurement() returning an error.\n\nSince ima_hash belongs to a temporary inode metadata structure, declared\nat the beginning of __ima_inode_hash(), just add a kfree() call if\nima_collect_measurement() returns an error different from -ENOMEM (in that\ncase, ima_hash should not have been allocated)."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c1d6a050a0f16e0a9d32eaf53b965c77279c6f8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c4df8cb38f139ed9f4296868c0a6f15a26e8c491",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f375bcf69f58fd0744c9dfd1b6b891a27301d67b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50578.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2022-50578",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.803",
"lastModified": "2025-10-22T14:15:42.803",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclass: fix possible memory leak in __class_register()\n\nIf class_add_groups() returns error, the 'cp->subsys' need be\nunregister, and the 'cp' need be freed.\n\nWe can not call kset_unregister() here, because the 'cls' will\nbe freed in callback function class_release() and it's also\nfreed in caller's error path, it will cause double free.\n\nSo fix this by calling kobject_del() and kfree_const(name) to\ncleanup kobject. Besides, call kfree() to free the 'cp'.\n\nFault injection test can trigger this:\n\nunreferenced object 0xffff888102fa8190 (size 8):\n comm \"modprobe\", pid 502, jiffies 4294906074 (age 49.296s)\n hex dump (first 8 bytes):\n 70 6b 74 63 64 76 64 00 pktcdvd.\n backtrace:\n [<00000000e7c7703d>] __kmalloc_track_caller+0x1ae/0x320\n [<000000005e4d70bc>] kstrdup+0x3a/0x70\n [<00000000c2e5e85a>] kstrdup_const+0x68/0x80\n [<000000000049a8c7>] kvasprintf_const+0x10b/0x190\n [<0000000029123163>] kobject_set_name_vargs+0x56/0x150\n [<00000000747219c9>] kobject_set_name+0xab/0xe0\n [<0000000005f1ea4e>] __class_register+0x15c/0x49a\n\nunreferenced object 0xffff888037274000 (size 1024):\n comm \"modprobe\", pid 502, jiffies 4294906074 (age 49.296s)\n hex dump (first 32 bytes):\n 00 40 27 37 80 88 ff ff 00 40 27 37 80 88 ff ff .@'7.....@'7....\n 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........\n backtrace:\n [<00000000151f9600>] kmem_cache_alloc_trace+0x17c/0x2f0\n [<00000000ecf3dd95>] __class_register+0x86/0x49a"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/18a7200646958cf8e1b8a933de08122fc50676cd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3bb9c92c27624ad076419a70f2b1a30cd1f8bbbd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3e0efc3f3f5e5c73996782f8db69963e501bb878",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/417ef049e3fd3b0d2593c1d5ffa3d0d5d0a018a7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4efa5443817c1b6de22d401aeca5b2481e835f8c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8c3e8a6bdb5253b97ad532570f8b5db5f7a06407",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/abaedb68a769e6bf36836b55a2f49b531c5f3f7b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e764ad5918a099ebeb909ccff83893a714e497e1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50579.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50579",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:42.927",
"lastModified": "2025-10-22T14:15:42.927",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: ftrace: fix module PLTs with mcount\n\nLi Huafei reports that mcount-based ftrace with module PLTs was broken\nby commit:\n\n a6253579977e4c6f (\"arm64: ftrace: consistently handle PLTs.\")\n\nWhen a module PLTs are used and a module is loaded sufficiently far away\nfrom the kernel, we'll create PLTs for any branches which are\nout-of-range. These are separate from the special ftrace trampoline\nPLTs, which the module PLT code doesn't directly manipulate.\n\nWhen mcount is in use this is a problem, as each mcount callsite in a\nmodule will be initialized to point to a module PLT, but since commit\na6253579977e4c6f ftrace_make_nop() will assume that the callsite has\nbeen initialized to point to the special ftrace trampoline PLT, and\nftrace_find_callable_addr() rejects other cases.\n\nThis means that when ftrace tries to initialize a callsite via\nftrace_make_nop(), the call to ftrace_find_callable_addr() will find\nthat the `_mcount` stub is out-of-range and is not handled by the ftrace\nPLT, resulting in a splat:\n\n| ftrace_test: loading out-of-tree module taints kernel.\n| ftrace: no module PLT for _mcount\n| ------------[ ftrace bug ]------------\n| ftrace failed to modify\n| [<ffff800029180014>] 0xffff800029180014\n| actual: 44:00:00:94\n| Initializing ftrace call sites\n| ftrace record flags: 2000000\n| (0)\n| expected tramp: ffff80000802eb3c\n| ------------[ cut here ]------------\n| WARNING: CPU: 3 PID: 157 at kernel/trace/ftrace.c:2120 ftrace_bug+0x94/0x270\n| Modules linked in:\n| CPU: 3 PID: 157 Comm: insmod Tainted: G O 6.0.0-rc6-00151-gcd722513a189-dirty #22\n| Hardware name: linux,dummy-virt (DT)\n| pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n| pc : ftrace_bug+0x94/0x270\n| lr : ftrace_bug+0x21c/0x270\n| sp : ffff80000b2bbaf0\n| x29: ffff80000b2bbaf0 x28: 0000000000000000 x27: ffff0000c4d38000\n| x26: 0000000000000001 x25: ffff800009d7e000 x24: ffff0000c4d86e00\n| x23: 0000000002000000 x22: ffff80000a62b000 x21: ffff8000098ebea8\n| x20: ffff0000c4d38000 x19: ffff80000aa24158 x18: ffffffffffffffff\n| x17: 0000000000000000 x16: 0a0d2d2d2d2d2d2d x15: ffff800009aa9118\n| x14: 0000000000000000 x13: 6333626532303830 x12: 3030303866666666\n| x11: 203a706d61727420 x10: 6465746365707865 x9 : 3362653230383030\n| x8 : c0000000ffffefff x7 : 0000000000017fe8 x6 : 000000000000bff4\n| x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : 0000000000000001\n| x2 : ad2cb14bb5438900 x1 : 0000000000000000 x0 : 0000000000000022\n| Call trace:\n| ftrace_bug+0x94/0x270\n| ftrace_process_locs+0x308/0x430\n| ftrace_module_init+0x44/0x60\n| load_module+0x15b4/0x1ce8\n| __do_sys_init_module+0x1ec/0x238\n| __arm64_sys_init_module+0x24/0x30\n| invoke_syscall+0x54/0x118\n| el0_svc_common.constprop.4+0x84/0x100\n| do_el0_svc+0x3c/0xd0\n| el0_svc+0x1c/0x50\n| el0t_64_sync_handler+0x90/0xb8\n| el0t_64_sync+0x15c/0x160\n| ---[ end trace 0000000000000000 ]---\n| ---------test_init-----------\n\nFix this by reverting to the old behaviour of ignoring the old\ninstruction when initialising an mcount callsite in a module, which was\nthe behaviour prior to commit a6253579977e4c6f."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f77b6b2ba70d7c9d69ef39694e283ded9f8b5f2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/657de36c72f57fa172a66b06f826b3f5bc56f42e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6c93b683cedaef745884cb9d554d02ed6266b897",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8cfb08575c6d4585f1ce0deeb189e5c824776b04",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/985432303cf7d4804fb2c2fdfbf0466a796d68c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50580.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50580",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:43.037",
"lastModified": "2025-10-22T14:15:43.037",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-throttle: prevent overflow while calculating wait time\n\nThere is a problem found by code review in tg_with_in_bps_limit() that\n'bps_limit * jiffy_elapsed_rnd' might overflow. Fix the problem by\ncalling mul_u64_u64_div_u64() instead."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/19c010ae44f0ce52b5436080492a61a092ee0cf4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/70b2adb1d698fbc63d3b3848c452524dc15872c5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8d6bbaada2e0a65f9012ac4c2506460160e7237a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ca67b0563b39e79290c23e509319c178b9ca9104",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cc6f0855bf8d9b729df28ff443ced7350c380dbd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50581.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2022-50581",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:43.147",
"lastModified": "2025-10-22T14:15:43.147",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix OOB Read in __hfs_brec_find\n\nSyzbot reported a OOB read bug:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190\nfs/hfs/string.c:84\nRead of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11\nCPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted\n6.1.0-rc6-syzkaller-00308-g644e9524388a #0\nWorkqueue: writeback wb_workfn (flush-7:0)\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n print_address_description+0x74/0x340 mm/kasan/report.c:284\n print_report+0x107/0x1f0 mm/kasan/report.c:395\n kasan_report+0xcd/0x100 mm/kasan/report.c:495\n hfs_strcmp+0x117/0x190 fs/hfs/string.c:84\n __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75\n hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138\n hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462\n write_inode fs/fs-writeback.c:1440 [inline]\n\nIf the input inode of hfs_write_inode() is incorrect:\nstruct inode\n struct hfs_inode_info\n struct hfs_cat_key\n struct hfs_name\n u8 len # len is greater than HFS_NAMELEN(31) which is the\nmaximum length of an HFS filename\n\nOOB read occurred:\nhfs_write_inode()\n hfs_brec_find()\n __hfs_brec_find()\n hfs_cat_keycmp()\n hfs_strcmp() # OOB read occurred due to len is too large\n\nFix this by adding a Check on len in hfs_write_inode() before calling\nhfs_brec_find()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/367296925c7625c3969d2a78d7a3e1dee161beb5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4fd3a11804c8877ff11fec59c5c53f1635331e3e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8c40f2dbae603ef0bd21e87c63f54ec59fd88256",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8d824e69d9f3fa3121b2dda25053bae71e2460d2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/90103ccb6e60aa4efe48993d23d6a528472f2233",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bfc9d8f27f89717431a6aecce42ae230b437433f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c886c10a6eddb99923b315f42bf63f448883ef9a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e9e692917c6e10a7066c7a6d092dcdc3d4e329f3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2022/CVE-2022-505xx/CVE-2022-50582.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2022-50582",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:43.267",
"lastModified": "2025-10-22T14:15:43.267",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: Prevent integer underflow\n\nBy using a ratio of delay to poll_enabled_time that is not integer\ntime_remaining underflows and does not exit the loop as expected.\nAs delay could be derived from DT and poll_enabled_time is defined\nin the driver this can easily happen.\n\nUse a signed iterator to make sure that the loop exits once\nthe remaining time is negative."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d8e16592022c9650df8aedfe6552ed478d7135b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9f2395316e4845466cb9b5b9b15a171a2c91913c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b051d9bf98bd9cea312b228e264eb6542a9beb67",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bfe602d9a349360e60e9051c9cafb9fef204524d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e33da263e9658bfe870ea7836fbbd72f246d7dbd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53691.json
+6 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2023-53691",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T04:15:51.837",
"lastModified": "2025-10-22T04:15:51.837",
"lastModified": "2025-10-22T14:15:43.380",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -38,7 +38,7 @@
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"type": "Secondary",
"description": [
{
"lang": "en",
@@ -51,6 +51,10 @@
{
"url": "https://zhuanlan.zhihu.com/p/639514473",
"source": "[email protected]"
},
{
"url": "https://zhuanlan.zhihu.com/p/639514473",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53692.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2023-53692",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:43.670",
"lastModified": "2025-10-22T14:15:43.670",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free read in ext4_find_extent for bigalloc + inline\n\nSyzbot found the following issue:\nloop0: detected capacity change from 0 to 2048\nEXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none.\n==================================================================\nBUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline]\nBUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931\nRead of size 4 at addr ffff888073644750 by task syz-executor420/5067\n\nCPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106\n print_address_description+0x74/0x340 mm/kasan/report.c:306\n print_report+0x107/0x1f0 mm/kasan/report.c:417\n kasan_report+0xcd/0x100 mm/kasan/report.c:517\n ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline]\n ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931\n ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809\n ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline]\n ext4_da_map_blocks fs/ext4/inode.c:1806 [inline]\n ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870\n ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098\n ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082\n generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772\n ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285\n ext4_file_write_iter+0x1d0/0x18f0\n call_write_iter include/linux/fs.h:2186 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x7dc/0xc50 fs/read_write.c:584\n ksys_write+0x177/0x2a0 fs/read_write.c:637\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7f4b7a9737b9\nRSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9\nRDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004\nRBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000\nR10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n </TASK>\n\nAbove issue is happens when enable bigalloc and inline data feature. As\ncommit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for\nbigalloc + inline. But it only resolved issue when has inline data, if\ninline data has been converted to extent(ext4_da_convert_inline_data_to_extent)\nbefore writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However\ni_data is still store inline data in this scene. Then will trigger UAF\nwhen find extent.\nTo resolve above issue, there is need to add judge \"ext4_has_inline_data(inode)\"\nin ext4_clu_mapped()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/11c87c8df2cae1d6be83c07e59fef0792de73482",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/14da044725a3ab10affa3566d29c15737c0e67a4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/40566def189c513be2c694681256d7486cc6e368",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/770b0613637f59f3091dda1ff0c23671a5326b9c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/835659598c67907b98cd2aa57bb951dfaf675c69",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/96d440bee177669dc0acedca0abd73bae6a9be8b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a34f6dcb78c654ab905642c1b4e7e5fbb4f0babe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53693.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2023-53693",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:43.787",
"lastModified": "2025-10-22T14:15:43.787",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: Fix the memory leak in raw_gadget driver\n\nCurrently, increasing raw_dev->count happens before invoke the\nraw_queue_event(), if the raw_queue_event() return error, invoke\nraw_release() will not trigger the dev_free() to be called.\n\n[ 268.905865][ T5067] raw-gadget.0 gadget.0: failed to queue event\n[ 268.912053][ T5067] udc dummy_udc.0: failed to start USB Raw Gadget: -12\n[ 268.918885][ T5067] raw-gadget.0: probe of gadget.0 failed with error -12\n[ 268.925956][ T5067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy\n[ 268.934657][ T5067] misc raw-gadget: fail, usb_gadget_register_driver returned -16\n\nBUG: memory leak\n\n[<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076\n[<ffffffff8347eb55>] kmalloc include/linux/slab.h:582 [inline]\n[<ffffffff8347eb55>] kzalloc include/linux/slab.h:703 [inline]\n[<ffffffff8347eb55>] dev_new drivers/usb/gadget/legacy/raw_gadget.c:191 [inline]\n[<ffffffff8347eb55>] raw_open+0x45/0x110 drivers/usb/gadget/legacy/raw_gadget.c:385\n[<ffffffff827d1d09>] misc_open+0x1a9/0x1f0 drivers/char/misc.c:165\n\n[<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076\n[<ffffffff8347cd2f>] kmalloc include/linux/slab.h:582 [inline]\n[<ffffffff8347cd2f>] raw_ioctl_init+0xdf/0x410 drivers/usb/gadget/legacy/raw_gadget.c:460\n[<ffffffff8347dfe9>] raw_ioctl+0x5f9/0x1120 drivers/usb/gadget/legacy/raw_gadget.c:1250\n[<ffffffff81685173>] vfs_ioctl fs/ioctl.c:51 [inline]\n\n[<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076\n[<ffffffff833ecc6a>] kmalloc include/linux/slab.h:582 [inline]\n[<ffffffff833ecc6a>] kzalloc include/linux/slab.h:703 [inline]\n[<ffffffff833ecc6a>] dummy_alloc_request+0x5a/0xe0 drivers/usb/gadget/udc/dummy_hcd.c:665\n[<ffffffff833e9132>] usb_ep_alloc_request+0x22/0xd0 drivers/usb/gadget/udc/core.c:196\n[<ffffffff8347f13d>] gadget_bind+0x6d/0x370 drivers/usb/gadget/legacy/raw_gadget.c:292\n\nThis commit therefore invoke kref_get() under the condition that\nraw_queue_event() return success."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f7a2b567197798da7bfa2252f4485c0ca6c6266",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/68e6287ac61dc22513cd39f02b9ac1fef28513e4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/83e30f2bf86ef7c38fbd476ed81a88522b620628",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9934e5d07c0dc294169a7d52f6309f35cd6d7755",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de77000c1923d7942f9b4f08447c8feeae1c0f33",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53694.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2023-53694",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:43.887",
"lastModified": "2025-10-22T14:15:43.887",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: ftrace: Fixup panic by disabling preemption\n\nIn RISCV, we must use an AUIPC + JALR pair to encode an immediate,\nforming a jump that jumps to an address over 4K. This may cause errors\nif we want to enable kernel preemption and remove dependency from\npatching code with stop_machine(). For example, if a task was switched\nout on auipc. And, if we changed the ftrace function before it was\nswitched back, then it would jump to an address that has updated 11:0\nbits mixing with previous XLEN:12 part.\n\np: patched area performed by dynamic ftrace\nftrace_prologue:\np| REG_S ra, -SZREG(sp)\np| auipc ra, 0x? ------------> preempted\n\t\t\t\t\t...\n\t\t\t\tchange ftrace function\n\t\t\t\t\t...\np| jalr -?(ra) <------------- switched back\np| REG_L ra, -SZREG(sp)\nfunc:\n\txxx\n\tret"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/20a7510e781084364691b4962de31de758194cc9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/84cfcf240f4a577733b1d98fcd2611a611612b03",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8547649981e6631328cd64f583667501ae385531",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53695.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2023-53695",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.000",
"lastModified": "2025-10-22T14:15:44.000",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Detect system inodes linked into directory hierarchy\n\nWhen UDF filesystem is corrupted, hidden system inodes can be linked\ninto directory hierarchy which is an avenue for further serious\ncorruption of the filesystem and kernel confusion as noticed by syzbot\nfuzzed images. Refuse to access system inodes linked into directory\nhierarchy and vice versa."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dc71eeb198a8daa17d0c995998a53b0b749a158",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1f328751b65c49c13a312d67a3bf27766b85baf7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/37e74003d81e79457535cbbdfa1603431c03fac0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85a37983ec69cc9fcd188bc37c4de15ee326355a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9e3b5ef7d02eaa6553e79b4af9bd99227280f245",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a44ec34b90440ada190924f5908b97026504fdcd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d747b31e2925a2f384e7dd1901a2e5bc5f984ed8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53696.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2023-53696",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.113",
"lastModified": "2025-10-22T14:15:44.113",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix memory leak in qla2x00_probe_one()\n\nThere is a memory leak reported by kmemleak:\n\n unreferenced object 0xffffc900003f0000 (size 12288):\n comm \"modprobe\", pid 19117, jiffies 4299751452 (age 42490.264s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<00000000629261a8>] __vmalloc_node_range+0xe56/0x1110\n [<0000000001906886>] __vmalloc_node+0xbd/0x150\n [<000000005bb4dc34>] vmalloc+0x25/0x30\n [<00000000a2dc1194>] qla2x00_create_host+0x7a0/0xe30 [qla2xxx]\n [<0000000062b14b47>] qla2x00_probe_one+0x2eb8/0xd160 [qla2xxx]\n [<00000000641ccc04>] local_pci_probe+0xeb/0x1a0\n\nThe root cause is traced to an error-handling path in qla2x00_probe_one()\nwhen the adapter \"base_vha\" initialize failed. The fab_scan_rp \"scan.l\" is\nused to record the port information and it is allocated in\nqla2x00_create_host(). However, it is not released in the error handling\npath \"probe_failed\".\n\nFix this by freeing the memory of \"scan.l\" when an error occurs in the\nadapter initialization process."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/44374911ac63f769c442f56fdfadea673c5f4425",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/582e35e97318ccd9c81774bac08938291679525f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85ade4010e13ef152ea925c74d94253db92e5428",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ae73c4dd48f2c79d515d509a0cbe9efb0a197f44",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53697.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2023-53697",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.223",
"lastModified": "2025-10-22T14:15:44.223",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu()\n\nMemory pointed by 'nd_pmu->pmu.attr_groups' is allocated in function\n'register_nvdimm_pmu' and is lost after 'kfree(nd_pmu)' call in function\n'unregister_nvdimm_pmu'."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/16259c80542ee8945aaa39cfc6a1809bcdc08ffe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4999f2ec5fde7c45e3ecafda5b78560cc1c7bdb5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/500a6ff9c2a81348fe0f04e2deb758145e8ab94e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85ae42c72142346645e63c33835da947dfa008b3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53698.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2023-53698",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.330",
"lastModified": "2025-10-22T14:15:44.330",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix refcount underflow in error path\n\nFix a refcount underflow problem reported by syzbot that can happen\nwhen a system is running out of memory. If xp_alloc_tx_descs() fails,\nand it can only fail due to not having enough memory, then the error\npath is triggered. In this error path, the refcount of the pool is\ndecremented as it has incremented before. However, the reference to\nthe pool in the socket was not nulled. This means that when the socket\nis closed later, the socket teardown logic will think that there is a\npool attached to the socket and try to decrease the refcount again,\nleading to a refcount underflow.\n\nI chose this fix as it involved adding just a single line. Another\noption would have been to move xp_get_pool() and the assignment of\nxs->pool to after the if-statement and using xs_umem->pool instead of\nxs->pool in the whole if-statement resulting in somewhat simpler code,\nbut this would have led to much more churn in the code base perhaps\nmaking it harder to backport."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/15b453cf7348973217558235b9ece2ee5fea6777",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3e7722c31d4167eb7f3ffd35aba52cab69b79072",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/789fcd94c9cac133dd4d96e193188661aca9f6c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85c2c79a07302fe68a1ad5cc449458cc559e314d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-536xx/CVE-2023-53699.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2023-53699",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.437",
"lastModified": "2025-10-22T14:15:44.437",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: move memblock_allow_resize() after linear mapping is ready\n\nThe initial memblock metadata is accessed from kernel image mapping. The\nregions arrays need to \"reallocated\" from memblock and accessed through\nlinear mapping to cover more memblock regions. So the resizing should\nnot be allowed until linear mapping is ready. Note that there are\nmemblock allocations when building linear mapping.\n\nThis patch is similar to 24cc61d8cb5a (\"arm64: memblock: don't permit\nmemblock resizing until linear mapping is up\").\n\nIn following log, many memblock regions are reserved before\ncreate_linear_mapping_page_table(). And then it triggered reallocation\nof memblock.reserved.regions and memcpy the old array in kernel image\nmapping to the new array in linear mapping which caused a page fault.\n\n[ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf021000-0x00000000bf021fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf023000-0x00000000bf023fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf025000-0x00000000bf025fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf027000-0x00000000bf027fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf029000-0x00000000bf029fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf02b000-0x00000000bf02bfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf02d000-0x00000000bf02dfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf02f000-0x00000000bf02ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] memblock_reserve: [0x00000000bf030000-0x00000000bf030fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6\n[ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) map non-reusable mmode_resv0@80000000\n[ 0.000000] memblock_reserve: [0x00000000bf000000-0x00000000bf001fed] paging_init+0x19a/0x5ae\n[ 0.000000] memblock_phys_alloc_range: 4096 bytes align=0x1000 from=0x0000000000000000 max_addr=0x0000000000000000 alloc_pmd_fixmap+0x14/0x1c\n[ 0.000000] memblock_reserve: [0x000000017ffff000-0x000000017fffffff] memblock_alloc_range_nid+0xb8/0x128\n[ 0.000000] memblock: reserved is doubled to 256 at [0x000000017fffd000-0x000000017fffe7ff]\n[ 0.000000] Unable to handle kernel paging request at virtual address ff600000ffffd000\n[ 0.000000] Oops [#1]\n[ 0.000000] Modules linked in:\n[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.4.0-rc1-00011-g99a670b2069c #66\n[ 0.000000] Hardware name: riscv-virtio,qemu (DT)\n[ 0.000000] epc : __memcpy+0x60/0xf8\n[ 0.000000] ra : memblock_double_array+0x192/0x248\n[ 0.000000] epc : ffffffff8081d214 ra : ffffffff80a3dfc0 sp : ffffffff81403bd0\n[ 0.000000] gp : ffffffff814fbb38 tp : ffffffff8140dac0 t0 : 0000000001600000\n[ 0.000000] t1 : 0000000000000000 t2 : 000000008f001000 s0 : ffffffff81403c60\n[ 0.000000] s1 : ffffffff80c0bc98 a0 : ff600000ffffd000 a1 : ffffffff80c0bcd8\n[ 0.000000] a2 : 0000000000000c00 a3 : ffffffff80c0c8d8 a4 : 0000000080000000\n[ 0.000000] a5 : 0000000000080000 a6 : 0000000000000000 a7 : 0000000080200000\n[ 0.000000] s2 : ff600000ffffd000 s3 : 0000000000002000 s4 : 0000000000000c00\n[ 0.000000] s5 : ffffffff80c0bc60 s6 : ffffffff80c0bcc8 s7 : 0000000000000000\n[ 0.000000] s8 : ffffffff814fd0a8 s9 : 000000017fffe7ff s10: 0000000000000000\n[ 0.000000] s11: 0000000000001000 t3 : 0000000000001000 t4 : 0000000000000000\n[ 0.000000] t5 : 000000008f003000 t6 : ff600000ffffd000\n[ 0.000000] status: 0000000200000100 badaddr: ff600000ffffd000 cause: 000000000000000f\n[ 0.000000] [<fff\n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a1b80ff4f721c4be98707bfe9d20238df133eb8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/85fadc0d04119c2fe4a20287767ab904c6d21ba1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4284246fca2ef482a8fcf5ad7d2c33a45b41e9c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ba11f4e59509538810e5c44578fc73984acdf1d7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53700.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2023-53700",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.547",
"lastModified": "2025-10-22T14:15:44.547",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: max9286: Fix memleak in max9286_v4l2_register()\n\nThere is a kmemleak when testing the media/i2c/max9286.c with bpf mock\ndevice:\n\nkmemleak: 5 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\n\nunreferenced object 0xffff88810defc400 (size 256):\n comm \"python3\", pid 278, jiffies 4294737563 (age 31.978s)\n hex dump (first 32 bytes):\n 28 06 a7 0a 81 88 ff ff 00 fe 22 12 81 88 ff ff (.........\".....\n 10 c4 ef 0d 81 88 ff ff 10 c4 ef 0d 81 88 ff ff ................\n backtrace:\n [<00000000191de6a7>] __kmalloc_node+0x44/0x1b0\n [<000000002f4912b7>] kvmalloc_node+0x34/0x180\n [<0000000057dc4cae>] v4l2_ctrl_new+0x325/0x10f0 [videodev]\n [<0000000026030272>] v4l2_ctrl_new_std+0x16f/0x210 [videodev]\n [<00000000f0d9ea2f>] max9286_probe+0x76e/0xbff [max9286]\n [<00000000ea8f6455>] i2c_device_probe+0x28d/0x680\n [<0000000087529af3>] really_probe+0x17c/0x3f0\n [<00000000b08be526>] __driver_probe_device+0xe3/0x170\n [<000000004382edea>] driver_probe_device+0x49/0x120\n [<000000007bde528a>] __device_attach_driver+0xf7/0x150\n [<000000009f9c6ab4>] bus_for_each_drv+0x114/0x180\n [<00000000c8aaf588>] __device_attach+0x1e5/0x2d0\n [<0000000041cc06b9>] bus_probe_device+0x126/0x140\n [<000000002309860d>] device_add+0x810/0x1130\n [<000000002827bf98>] i2c_new_client_device+0x359/0x4f0\n [<00000000593bdc85>] of_i2c_register_device+0xf1/0x110\n\nmax9286_v4l2_register() calls v4l2_ctrl_new_std(), but won't free the\ncreated v412_ctrl when fwnode_graph_get_endpoint_by_id() failed, which\ncauses the memleak. Call v4l2_ctrl_handler_free() to free the v412_ctrl."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/505ff3a0c5951684c3a43094ca4c1a74683d5681",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5897fe3ebe8252993579e1bee715ebfe5504e052",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5e31213fa017c20ccc989033a5f4a626473aa2ca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/724039e013b34f46344abdbf8c74e6a65a828327",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53701.json
+21
View File
@@ -0,0 +1,21 @@
{
"id": "CVE-2023-53701",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.660",
"lastModified": "2025-10-22T14:15:44.660",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: deactivate anonymous set from preparation phase\n\n[ backport for 4.14 of c1592a89942e9678f7d9c8030efa777c0d57edab ]\n\nToggle deleted anonymous sets as inactive in the next generation, so\nusers cannot perform any update on it. Clear the generation bitmask\nin case the transaction is aborted.\n\nThe following KASAN splat shows a set element deletion for a bound\nanonymous set that has been already removed in the same transaction.\n\n[ 64.921510] ==================================================================\n[ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables]\n[ 64.924745] Write of size 8 at addr dead000000000122 by task test/890\n[ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253\n[ 64.931120] Call Trace:\n[ 64.932699] <TASK>\n[ 64.934292] dump_stack_lvl+0x33/0x50\n[ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables]\n[ 64.937551] kasan_report+0xda/0x120\n[ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables]\n[ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables]\n[ 64.942452] ? __kasan_slab_alloc+0x2d/0x60\n[ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables]\n[ 64.945710] ? kasan_set_track+0x21/0x30\n[ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink]\n[ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/86572872505023e3bb461b271c2f25fdaa3dfcd7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53702.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2023-53702",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.760",
"lastModified": "2025-10-22T14:15:44.760",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/crypto: use vector instructions only if available for ChaCha20\n\nCommit 349d03ffd5f6 (\"crypto: s390 - add crypto library interface for\nChaCha20\") added a library interface to the s390 specific ChaCha20\nimplementation. However no check was added to verify if the required\nfacilities are installed before branching into the assembler code.\n\nIf compiled into the kernel, this will lead to the following crash,\nif vector instructions are not available:\n\ndata exception: 0007 ilc:3 [#1] SMP\nModules linked in:\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7+ #11\nHardware name: IBM 3931 A01 704 (KVM/Linux)\nKrnl PSW : 0704e00180000000 000000001857277a (chacha20_vx+0x32/0x818)\n R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3\nKrnl GPRS: 0000037f0000000a ffffffffffffff60 000000008184b000 0000000019f5c8e6\n 0000000000000109 0000037fffb13c58 0000037fffb13c78 0000000019bb1780\n 0000037fffb13c58 0000000019f5c8e6 000000008184b000 0000000000000109\n 00000000802d8000 0000000000000109 0000000018571ebc 0000037fffb13718\nKrnl Code: 000000001857276a: c07000b1f80b larl %r7,0000000019bb1780\n 0000000018572770: a708000a lhi %r0,10\n #0000000018572774: e78950000c36 vlm %v24,%v25,0(%r5),0\n >000000001857277a: e7a060000806 vl %v26,0(%r6),0\n 0000000018572780: e7bf70004c36 vlm %v27,%v31,0(%r7),4\n 0000000018572786: e70b00000456 vlr %v0,%v27\n 000000001857278c: e71800000456 vlr %v1,%v24\n 0000000018572792: e74b00000456 vlr %v4,%v27\nCall Trace:\n [<000000001857277a>] chacha20_vx+0x32/0x818\nLast Breaking-Event-Address:\n [<0000000018571eb6>] chacha20_crypt_s390.constprop.0+0x6e/0xd8\n---[ end trace 0000000000000000 ]---\nKernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n\nFix this by adding a missing MACHINE_HAS_VX check.\n\n[[email protected]: remove duplicates in commit message]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/25e8d30507aa2f251152df1af7809e85b5538f4a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8703dd6b238da0ec6c276e53836f8200983d3d9b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/debb7797bba0caffdbdadc3e7968bb2c414f50da",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53703.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2023-53703",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.873",
"lastModified": "2025-10-22T14:15:44.873",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: Fix for shift-out-of-bounds\n\nShift operation of 'exp' and 'shift' variables exceeds the maximum number\nof shift values in the u32 range leading to UBSAN shift-out-of-bounds.\n\n...\n[ 6.120512] UBSAN: shift-out-of-bounds in drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c:149:50\n[ 6.120598] shift exponent 104 is too large for 64-bit type 'long unsigned int'\n[ 6.120659] CPU: 4 PID: 96 Comm: kworker/4:1 Not tainted 6.4.0amd_1-next-20230519-dirty #10\n[ 6.120665] Hardware name: AMD Birman-PHX/Birman-PHX, BIOS SFH_with_HPD_SEN.FD 04/05/2023\n[ 6.120667] Workqueue: events amd_sfh_work_buffer [amd_sfh]\n[ 6.120687] Call Trace:\n[ 6.120690] <TASK>\n[ 6.120694] dump_stack_lvl+0x48/0x70\n[ 6.120704] dump_stack+0x10/0x20\n[ 6.120707] ubsan_epilogue+0x9/0x40\n[ 6.120716] __ubsan_handle_shift_out_of_bounds+0x10f/0x170\n[ 6.120720] ? psi_group_change+0x25f/0x4b0\n[ 6.120729] float_to_int.cold+0x18/0xba [amd_sfh]\n[ 6.120739] get_input_rep+0x57/0x340 [amd_sfh]\n[ 6.120748] ? __schedule+0xba7/0x1b60\n[ 6.120756] ? __pfx_get_input_rep+0x10/0x10 [amd_sfh]\n[ 6.120764] amd_sfh_work_buffer+0x91/0x180 [amd_sfh]\n[ 6.120772] process_one_work+0x229/0x430\n[ 6.120780] worker_thread+0x4a/0x3c0\n[ 6.120784] ? __pfx_worker_thread+0x10/0x10\n[ 6.120788] kthread+0xf7/0x130\n[ 6.120792] ? __pfx_kthread+0x10/0x10\n[ 6.120795] ret_from_fork+0x29/0x50\n[ 6.120804] </TASK>\n...\n\nFix this by adding the condition to validate shift ranges."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e50bc2c177d4b2953d77037ac46ea0702d6aa1f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5a45ed1ae34bb0e68944471f4bafb68e0a572791",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/87854366176403438d01f368b09de3ec2234e0f5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53704.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2023-53704",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:44.977",
"lastModified": "2025-10-22T14:15:44.977",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()\n\nReplace of_iomap() and kzalloc() with devm_of_iomap() and devm_kzalloc()\nwhich can automatically release the related memory when the device\nor driver is removed or unloaded to avoid potential memory leak.\n\nIn this case, iounmap(anatop_base) in line 427,433 are removed\nas manual release is not required.\n\nBesides, referring to clk-imx8mq.c, check the return code of\nof_clk_add_hw_provider, if it returns negtive, print error info\nand unregister hws, which makes the program more robust."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5bcf140e9e6cf76f1f1bd1f489a14ca4d49f9a1a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6317d0302655f7e854cd4f31e93b47d35cb058bb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/878b02d5f3b56cb090dbe2c70c89273be144087f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92ce7629a11ae62292e1cfaa6132dab081fc80ee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bcea444ab4c045864b55d67313833d606676602a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cb047c13bbf9018693ae31f03a5a26b212d02f13",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53705.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2023-53705",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.080",
"lastModified": "2025-10-22T14:15:45.080",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix out-of-bounds access in ipv6_find_tlv()\n\noptlen is fetched without checking whether there is more than one byte to parse.\nIt can lead to out-of-bounds access.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with SVACE."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/011f47c8b8389154f996f5f69da8efc3a3beefef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/04bf69e3de435d793a203aacc4b774f8f9f2baeb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/59e656d0d4a84ea0ee9a39c6f69160a3effccc94",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/878ecb0897f4737a4c9401f3523fd49589025671",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/91dd8aab9c9f193210681b86b6b92840ffe74f0c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9b92e2d0eb696d7586ba832c8854653b59887da0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ae68c0f7edbc9a294094ce03a0aaf45aa489ce40",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e5f82688ae10f5f386952e65e941bb8868ee54dc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53706.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2023-53706",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.197",
"lastModified": "2025-10-22T14:15:45.197",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmemmap/devdax: fix kernel crash when probing devdax devices\n\ncommit 4917f55b4ef9 (\"mm/sparse-vmemmap: improve memory savings for\ncompound devmaps\") added support for using optimized vmmemap for devdax\ndevices. But how vmemmap mappings are created are architecture specific. \nFor example, powerpc with hash translation doesn't have vmemmap mappings\nin init_mm page table instead they are bolted table entries in the\nhardware page table\n\nvmemmap_populate_compound_pages() used by vmemmap optimization code is not\naware of these architecture-specific mapping. Hence allow architecture to\nopt for this feature. I selected architectures supporting\nHUGETLB_PAGE_OPTIMIZE_VMEMMAP option as also supporting this feature.\n\nThis patch fixes the below crash on ppc64.\n\nBUG: Unable to handle kernel data access on write at 0xc00c000100400038\nFaulting instruction address: 0xc000000001269d90\nOops: Kernel access of bad area, sig: 11 [#1]\nLE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries\nModules linked in:\nCPU: 7 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc5-150500.34-default+ #2 5c90a668b6bbd142599890245c2fb5de19d7d28a\nHardware name: IBM,9009-42G POWER9 (raw) 0x4e0202 0xf000005 of:IBM,FW950.40 (VL950_099) hv:phyp pSeries\nNIP: c000000001269d90 LR: c0000000004c57d4 CTR: 0000000000000000\nREGS: c000000003632c30 TRAP: 0300 Not tainted (6.3.0-rc5-150500.34-default+)\nMSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24842228 XER: 00000000\nCFAR: c0000000004c57d0 DAR: c00c000100400038 DSISR: 42000000 IRQMASK: 0\n....\nNIP [c000000001269d90] __init_single_page.isra.74+0x14/0x4c\nLR [c0000000004c57d4] __init_zone_device_page+0x44/0xd0\nCall Trace:\n[c000000003632ed0] [c000000003632f60] 0xc000000003632f60 (unreliable)\n[c000000003632f10] [c0000000004c5ca0] memmap_init_zone_device+0x170/0x250\n[c000000003632fe0] [c0000000005575f8] memremap_pages+0x2c8/0x7f0\n[c0000000036330c0] [c000000000557b5c] devm_memremap_pages+0x3c/0xa0\n[c000000003633100] [c000000000d458a8] dev_dax_probe+0x108/0x3e0\n[c0000000036331a0] [c000000000d41430] dax_bus_probe+0xb0/0x140\n[c0000000036331d0] [c000000000cef27c] really_probe+0x19c/0x520\n[c000000003633260] [c000000000cef6b4] __driver_probe_device+0xb4/0x230\n[c0000000036332e0] [c000000000cef888] driver_probe_device+0x58/0x120\n[c000000003633320] [c000000000cefa6c] __device_attach_driver+0x11c/0x1e0\n[c0000000036333a0] [c000000000cebc58] bus_for_each_drv+0xa8/0x130\n[c000000003633400] [c000000000ceefcc] __device_attach+0x15c/0x250\n[c0000000036334a0] [c000000000ced458] bus_probe_device+0x108/0x110\n[c0000000036334f0] [c000000000ce92dc] device_add+0x7fc/0xa10\n[c0000000036335b0] [c000000000d447c8] devm_create_dev_dax+0x1d8/0x530\n[c000000003633640] [c000000000d46b60] __dax_pmem_probe+0x200/0x270\n[c0000000036337b0] [c000000000d46bf0] dax_pmem_probe+0x20/0x70\n[c0000000036337d0] [c000000000d2279c] nvdimm_bus_probe+0xac/0x2b0\n[c000000003633860] [c000000000cef27c] really_probe+0x19c/0x520\n[c0000000036338f0] [c000000000cef6b4] __driver_probe_device+0xb4/0x230\n[c000000003633970] [c000000000cef888] driver_probe_device+0x58/0x120\n[c0000000036339b0] [c000000000cefd08] __driver_attach+0x1d8/0x240\n[c000000003633a30] [c000000000cebb04] bus_for_each_dev+0xb4/0x130\n[c000000003633a90] [c000000000cee564] driver_attach+0x34/0x50\n[c000000003633ab0] [c000000000ced878] bus_add_driver+0x218/0x300\n[c000000003633b40] [c000000000cf1144] driver_register+0xa4/0x1b0\n[c000000003633bb0] [c000000000d21a0c] __nd_driver_register+0x5c/0x100\n[c000000003633c10] [c00000000206a2e8] dax_pmem_init+0x34/0x48\n[c000000003633c30] [c0000000000132d0] do_one_initcall+0x60/0x320\n[c000000003633d00] [c0000000020051b0] kernel_init_freeable+0x360/0x400\n[c000000003633de0] [c000000000013764] kernel_init+0x34/0x1d0\n[c000000003633e50] [c00000000000de14] ret_from_kernel_thread+0x5c/0x64"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/87a7ae75d7383afa998f57656d1d14e2a730cc47",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f4603588acf5807aa1f1b4b1ea2b0365acd71f0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53707.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2023-53707",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.303",
"lastModified": "2025-10-22T14:15:45.303",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix integer overflow in amdgpu_cs_pass1\n\nThe type of size is unsigned int, if size is 0x40000000, there will\nbe an integer overflow, size will be zero after size *= sizeof(uint32_t),\nwill cause uninitialized memory to be referenced later."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/87c2213e85bd81e4a9a4d0880c256568794ae388",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9f55d300541cb5b435984d269087810581580b00",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c3deb091398e9e469d08dd1599b6d76fd6b29df8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53708.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2023-53708",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.403",
"lastModified": "2025-10-22T14:15:45.403",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects\n\nIf a badly constructed firmware includes multiple `ACPI_TYPE_PACKAGE`\nobjects while evaluating the AMD LPS0 _DSM, there will be a memory\nleak. Explicitly guard against this."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1ea7e47807279369c82718efd2677ea25c6579e3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7b7964cd9db30bc84808a40d13a0633b4313f149",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/883cf0d4cf288313b71146ddebdf5d647b76c78b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9e8bbde9293151430884aed882a88eaa22298f72",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53709.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2023-53709",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.510",
"lastModified": "2025-10-22T14:15:45.510",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Handle race between rb_move_tail and rb_check_pages\n\nIt seems a data race between ring_buffer writing and integrity check.\nThat is, RB_FLAG of head_page is been updating, while at same time\nRB_FLAG was cleared when doing integrity check rb_check_pages():\n\n rb_check_pages() rb_handle_head_page():\n -------- --------\n rb_head_page_deactivate()\n rb_head_page_set_normal()\n rb_head_page_activate()\n\nWe do intergrity test of the list to check if the list is corrupted and\nit is still worth doing it. So, let's refactor rb_check_pages() such that\nwe no longer clear and set flag during the list sanity checking.\n\n[1] and [2] are the test to reproduce and the crash report respectively.\n\n1:\n``` read_trace.sh\n while true;\n do\n # the \"trace\" file is closed after read\n head -1 /sys/kernel/tracing/trace > /dev/null\n done\n```\n``` repro.sh\n sysctl -w kernel.panic_on_warn=1\n # function tracer will writing enough data into ring_buffer\n echo function > /sys/kernel/tracing/current_tracer\n ./read_trace.sh &\n ./read_trace.sh &\n ./read_trace.sh &\n ./read_trace.sh &\n ./read_trace.sh &\n ./read_trace.sh &\n ./read_trace.sh &\n ./read_trace.sh &\n```\n\n2:\n------------[ cut here ]------------\nWARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653\nrb_move_tail+0x450/0x470\nModules linked in:\nCPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\nRIP: 0010:rb_move_tail+0x450/0x470\nCode: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24\n83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83\nf8 02 0f 84 ce fb ff ff e9 db\nRSP: 0018:ffffb5564089bd00 EFLAGS: 00000203\nRAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18\nRDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400\nRBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2\nR10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000\nR13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108\nFS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0\nCall Trace:\n <TASK>\n ring_buffer_lock_reserve+0x136/0x360\n ? __do_softirq+0x287/0x2df\n ? __pfx_rcu_softirq_qs+0x10/0x10\n trace_function+0x21/0x110\n ? __pfx_rcu_softirq_qs+0x10/0x10\n ? __do_softirq+0x287/0x2df\n function_trace_call+0xf6/0x120\n 0xffffffffc038f097\n ? rcu_softirq_qs+0x5/0x140\n rcu_softirq_qs+0x5/0x140\n __do_softirq+0x287/0x2df\n run_ksoftirqd+0x2a/0x30\n smpboot_thread_fn+0x188/0x220\n ? __pfx_smpboot_thread_fn+0x10/0x10\n kthread+0xe7/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2c/0x50\n </TASK>\n---[ end trace 0000000000000000 ]---\n\n[ crash report and test reproducer credit goes to Zheng Yejian]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/09b1bf25f7f7a8f2bf8cd4278bba9c3172db8013",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6e02a43acd0691791df79ce538f2dd497a6c9b76",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8843e06f67b14f71c044bf6267b2387784c7e198",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9674390ac540ed06768e3fbc2dba553929fbd736",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d41db100bc386b9433a3fc87026f5e8b453653e3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53710.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2023-53710",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.613",
"lastModified": "2025-10-22T14:15:45.613",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: fix error code of return in mt7921_acpi_read\n\nKernel NULL pointer dereference when ACPI SAR table isn't implemented well.\nFix the error code of return to mark the ACPI SAR table as invalid.\n\n[ 5.077128] mt7921e 0000:06:00.0: sar cnt = 0\n[ 5.077381] BUG: kernel NULL pointer dereference, address:\n0000000000000004\n[ 5.077630] #PF: supervisor read access in kernel mode\n[ 5.077883] #PF: error_code(0x0000) - not-present page\n[ 5.078138] PGD 0 P4D 0\n[ 5.078398] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 5.079202] RIP: 0010:mt7921_init_acpi_sar+0x106/0x220\n[mt7921_common]\n...\n[ 5.080786] Call Trace:\n[ 5.080786] <TASK>\n[ 5.080786] mt7921_register_device+0x37d/0x490 [mt7921_common]\n[ 5.080786] mt7921_pci_probe.part.0+0x2ee/0x310 [mt7921e]\n[ 5.080786] mt7921_pci_probe+0x52/0x70 [mt7921e]\n[ 5.080786] local_pci_probe+0x47/0x90\n[ 5.080786] pci_call_probe+0x55/0x190\n[ 5.080786] pci_device_probe+0x84/0x120"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a9a5f88e0da71c8e4f30aacbda45b1a1af5469d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/59c2b0aec7a5aa350aa3edfb4363b19348c2269f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/888d89034f9eaeab9b5b75f13dbe35376c7dd471",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53711.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2023-53711",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.713",
"lastModified": "2025-10-22T14:15:45.713",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a potential data corruption\n\nWe must ensure that the subrequests are joined back into the head before\nwe can retransmit a request. If the head was not on the commit lists,\nbecause the server wrote it synchronously, we still need to add it back\nto the retransmission list.\nAdd a call that mirrors the effect of nfs_cancel_remove_inode() for\nO_DIRECT."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ec26716e45d615edfff46012e7dedcc0ac5f7ab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da302f1d476a44245823a74546debb5d160bf5bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dac14a1dbe20e003215dacb8a3a1a7e4ca4e0ad0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53712.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2023-53712",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.817",
"lastModified": "2025-10-22T14:15:45.817",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9317/1: kexec: Make smp stop calls asynchronous\n\nIf a panic is triggered by a hrtimer interrupt all online cpus will be\nnotified and set offline. But as highlighted by commit 19dbdcb8039c\n(\"smp: Warn on function calls from softirq context\") this call should\nnot be made synchronous with disabled interrupts:\n\n softdog: Initiating panic\n Kernel panic - not syncing: Software Watchdog Timer expired\n WARNING: CPU: 1 PID: 0 at kernel/smp.c:753 smp_call_function_many_cond\n unwind_backtrace:\n show_stack\n dump_stack_lvl\n __warn\n warn_slowpath_fmt\n smp_call_function_many_cond\n smp_call_function\n crash_smp_send_stop.part.0\n machine_crash_shutdown\n __crash_kexec\n panic\n softdog_fire\n __hrtimer_run_queues\n hrtimer_interrupt\n\nMake the smp call for machine_crash_nonpanic_core() asynchronous."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/46870eea5496ff277e86187a49ac5a667cfe60c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5590ba4560eefbd19a4ed07c7e7c8e4c51ffc628",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8922ba71c969d2a0c01a94372a71477d879470de",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ee378f45a70d09b51373ba495d30d99ef12219c1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53713.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2023-53713",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:45.930",
"lastModified": "2025-10-22T14:15:45.930",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: sme: Use STR P to clear FFR context field in streaming SVE mode\n\nThe FFR is a predicate register which can vary between 16 and 256 bits\nin size depending upon the configured vector length. When saving the\nSVE state in streaming SVE mode, the FFR register is inaccessible and\nso commit 9f5848665788 (\"arm64/sve: Make access to FFR optional\") simply\nclears the FFR field of the in-memory context structure. Unfortunately,\nit achieves this using an unconditional 8-byte store and so if the SME\nvector length is anything other than 64 bytes in size we will either\nfail to clear the entire field or, worse, we will corrupt memory\nimmediately following the structure. This has led to intermittent kfence\nsplats in CI [1] and can trigger kmalloc Redzone corruption messages\nwhen running the 'fp-stress' kselftest:\n\n | =============================================================================\n | BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten\n | -----------------------------------------------------------------------------\n |\n | 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc\n | Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531\n | __kmalloc+0x8c/0xcc\n | do_sme_acc+0x9c/0x220\n | ...\n\nReplace the 8-byte store with a store of a predicate register which has\nbeen zero-initialised with PFALSE, ensuring that the entire field is\ncleared in memory.\n\n[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1403a899153a12d93fd510e463fd6d0eafba4336",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8769a62faacbbb6cac5e35d9047ce445183d4e9f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/893b24181b4c4bf1fa2841b1ed192e5413a97cb1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/97669214944e80d3756657c21c4f286f3da6a423",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53714.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2023-53714",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.040",
"lastModified": "2025-10-22T14:15:46.040",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/stm: ltdc: fix late dereference check\n\nIn ltdc_crtc_set_crc_source(), struct drm_crtc was dereferenced in a\ncontainer_of() before the pointer check. This could cause a kernel panic.\n\nFix this smatch warning:\ndrivers/gpu/drm/stm/ltdc.c:1124 ltdc_crtc_set_crc_source() warn: variable dereferenced before check 'crtc' (see line 1119)"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/04fe3b82528232aa85a6c45464906d0727ef4f20",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/340dba127bbed51e8425cd8e097aacfadd175462",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/898a9e3f56db9860ab091d4bf41b6caa99aafc3d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53715.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2023-53715",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.140",
"lastModified": "2025-10-22T14:15:46.140",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex\n\nApparently the hex passphrase mechanism does not work on newer\nchips/firmware (e.g. BCM4387). It seems there was a simple way of\npassing it in binary all along, so use that and avoid the hexification.\n\nOpenBSD has been doing it like this from the beginning, so this should\nwork on all chips.\n\nAlso clear the structure before setting the PMK. This was leaking\nuninitialized stack contents to the device."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1687845eb8f37360a9ee849a3587ab659b090773",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2bc34facb90ceeff6f8c17d2006575a6d07c3825",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2fa3a5226b05e0a797c68b9609dcebe0cd236b27",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4e8dc0e5c7636efaadbd7e488acd34b4291c0431",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/56c7e9c39bd54fd753c0c4b1ed10278cbd3a5f02",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/89b89e52153fda2733562776c7c9d9d3ebf8dd6d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e242c66f7ecfe8f5b6eb308f4ea464fd8589c866",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f8a6c53ff1d91acd5a20eb627edbffd816eb9a4e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53716.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2023-53716",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.250",
"lastModified": "2025-10-22T14:15:46.250",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix skb leak in __skb_tstamp_tx()\n\nCommit 50749f2dd685 (\"tcp/udp: Fix memleaks of sk and zerocopy skbs with\nTX timestamp.\") added a call to skb_orphan_frags_rx() to fix leaks with\nzerocopy skbs. But it ended up adding a leak of its own. When\nskb_orphan_frags_rx() fails, the function just returns, leaking the skb\nit just cloned. Free it before returning.\n\nThis bug was discovered and resolved using Coverity Static Analysis\nSecurity Testing (SAST) by Synopsys, Inc."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/58766252f6b2c0487cda6976a53d2bb03ae28e2a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/779332447108545ef04682ea29af5f85c0202aee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/82501f1ead557cbee1c2467654ec109a80334d22",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a02fb71d7192ff1a9a47c9d937624966c6e09af",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a594382ec6d0cc8cff5a8bc7e61b54e3858fb243",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cc18b4685910d5d9de8314bae9c55790701b1811",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e06841a2abf9c82735cee39e88b1d79464088840",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f4d928c00254cfc9dd0ee7076f4a59bceec675f4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53717.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2023-53717",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.367",
"lastModified": "2025-10-22T14:15:46.367",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()\n\nFix a stack-out-of-bounds write that occurs in a WMI response callback\nfunction that is called after a timeout occurs in ath9k_wmi_cmd().\nThe callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that\ncould no longer be valid when a timeout occurs. Set wmi->last_seq_id to\n0 when a timeout occurred.\n\nFound by a modified version of syzkaller.\n\nBUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx\nWrite of size 4\nCall Trace:\n memcpy\n ath9k_wmi_ctrl_rx\n ath9k_htc_rx_msg\n ath9k_hif_usb_reg_in_cb\n __usb_hcd_giveback_urb\n usb_hcd_giveback_urb\n dummy_timer\n call_timer_fn\n run_timer_softirq\n __do_softirq\n irq_exit_rcu\n sysvec_apic_timer_interrupt"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1af7eacfad45149c54893a8a9df9e92ef89f0a90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/554048a72d7ecfdd58cc1bfb56e0a1864e64e82c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/78b56b0a613a87b61290b95be497fdfe2fe58aa6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/89a33c3c847b19b19205cde1d924df2a6c70d8eb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a2f35b9830692f7a616f2f627f943bc748af13a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f28513d9520184059530c01a9f928a1b3809d3f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf6dc175a2b53098a69db1236d9d53982f4b1bc0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53718.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2023-53718",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.483",
"lastModified": "2025-10-22T14:15:46.483",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Do not swap cpu_buffer during resize process\n\nWhen ring_buffer_swap_cpu was called during resize process,\nthe cpu buffer was swapped in the middle, resulting in incorrect state.\nContinuing to run in the wrong state will result in oops.\n\nThis issue can be easily reproduced using the following two scripts:\n/tmp # cat test1.sh\n//#! /bin/sh\nfor i in `seq 0 100000`\ndo\n echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb\n sleep 0.5\n echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb\n sleep 0.5\ndone\n/tmp # cat test2.sh\n//#! /bin/sh\nfor i in `seq 0 100000`\ndo\n echo irqsoff > /sys/kernel/debug/tracing/current_tracer\n sleep 1\n echo nop > /sys/kernel/debug/tracing/current_tracer\n sleep 1\ndone\n/tmp # ./test1.sh &\n/tmp # ./test2.sh &\n\nA typical oops log is as follows, sometimes with other different oops logs.\n\n[ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8\n[ 231.713375] Modules linked in:\n[ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15\n[ 231.716750] Hardware name: linux,dummy-virt (DT)\n[ 231.718152] Workqueue: events update_pages_handler\n[ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 231.721171] pc : rb_update_pages+0x378/0x3f8\n[ 231.722212] lr : rb_update_pages+0x25c/0x3f8\n[ 231.723248] sp : ffff800082b9bd50\n[ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000\n[ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0\n[ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a\n[ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000\n[ 231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510\n[ 231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002\n[ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558\n[ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001\n[ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000\n[ 231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208\n[ 231.744196] Call trace:\n[ 231.744892] rb_update_pages+0x378/0x3f8\n[ 231.745893] update_pages_handler+0x1c/0x38\n[ 231.746893] process_one_work+0x1f0/0x468\n[ 231.747852] worker_thread+0x54/0x410\n[ 231.748737] kthread+0x124/0x138\n[ 231.749549] ret_from_fork+0x10/0x20\n[ 231.750434] ---[ end trace 0000000000000000 ]---\n[ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[ 233.721696] Mem abort info:\n[ 233.721935] ESR = 0x0000000096000004\n[ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 233.722596] SET = 0, FnV = 0\n[ 233.722805] EA = 0, S1PTW = 0\n[ 233.723026] FSC = 0x04: level 0 translation fault\n[ 233.723458] Data abort info:\n[ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000\n[ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n[ 233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[ 233.726720] Modules linked in:\n[ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15\n[ 233.727777] Hardware name: linux,dummy-virt (DT)\n[ 233.728225] Workqueue: events update_pages_handler\n[ 233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 233.729054] pc : rb_update_pages+0x1a8/0x3f8\n[ 233.729334] lr : rb_update_pages+0x154/0x3f8\n[ 233.729592] sp : ffff800082b9bd50\n[ 233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 00000000\n---truncated---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/02e52d7daaa3f0f48819f198092cf4871065bbf7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/128c06a34cfe55212632533a706b050d54552741",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/49b830d75f03d5dd41146d10e4d3e2a8211c4b94",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/66a3b2a121386702663065d5c9e5a33c03d3f4a2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a96c0288d0737ad77882024974c075345c72011",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53719.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2023-53719",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.590",
"lastModified": "2025-10-22T14:15:46.590",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: arc_uart: fix of_iomap leak in `arc_serial_probe`\n\nSmatch reports:\n\ndrivers/tty/serial/arc_uart.c:631 arc_serial_probe() warn:\n'port->membase' from of_iomap() not released on lines: 631.\n\nIn arc_serial_probe(), if uart_add_one_port() fails,\nport->membase is not released, which would cause a resource leak.\n\nTo fix this, I replace of_iomap with devm_platform_ioremap_resource."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/081790eee6b47389a0d895262086d64c6a38d6e5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/153017561d2804cfae87cc9aa377aa84dd906ae1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3f00df24a5021a6f02c1830a290acd4bceb22a2d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/40a462313ba4f337a2b419e7fb4a670f3dd95e14",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7525aa211758cc023a371e010d16ceaae1057807",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ab5fc55d7f65d58a3c3aeadf11bdf60267cd2bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f76a18e53a66c0ef2938276110717b3805720cd9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53720.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2023-53720",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.700",
"lastModified": "2025-10-22T14:15:46.700",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Release the label when replacing existing ct entry\n\nCited commit doesn't release the label mapping when replacing existing ct\nentry which leads to following memleak report:\n\nunreferenced object 0xffff8881854cf280 (size 96):\n comm \"kworker/u48:74\", pid 23093, jiffies 4296664564 (age 175.944s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<000000002722d368>] __kmalloc+0x4b/0x1c0\n [<00000000cc44e18f>] mapping_add+0x6e8/0xc90 [mlx5_core]\n [<000000003ad942a7>] mlx5_get_label_mapping+0x66/0xe0 [mlx5_core]\n [<00000000266308ac>] mlx5_tc_ct_entry_create_mod_hdr+0x1c4/0xf50 [mlx5_core]\n [<000000009a768b4f>] mlx5_tc_ct_entry_add_rule+0x16f/0xaf0 [mlx5_core]\n [<00000000a178f3e5>] mlx5_tc_ct_block_flow_offload_add+0x10cb/0x1f90 [mlx5_core]\n [<000000007b46c496>] mlx5_tc_ct_block_flow_offload+0x14a/0x630 [mlx5_core]\n [<00000000a9a18ac5>] nf_flow_offload_tuple+0x1a3/0x390 [nf_flow_table]\n [<00000000d0881951>] flow_offload_work_handler+0x257/0xd30 [nf_flow_table]\n [<000000009e4935a4>] process_one_work+0x7c2/0x13e0\n [<00000000f5cd36a7>] worker_thread+0x59d/0xec0\n [<00000000baed1daf>] kthread+0x28f/0x330\n [<0000000063d282a4>] ret_from_fork+0x1f/0x30\n\nFix the issue by correctly releasing the label mapping."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/3db903a71f1f4bbf30baae166a4a49f2e8aceb61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ac04a28144cfa89b61be518268233742c23d88d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53721.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2023-53721",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.803",
"lastModified": "2025-10-22T14:15:46.803",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()\n\nIn ath12k_mac_op_hw_scan(), the return value of kzalloc() is directly\nused in memcpy(), which may lead to a NULL pointer dereference on\nfailure of kzalloc().\n\nFix this bug by adding a check of arg.extraie.ptr.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5a263df398b581189fe632b4ab8440f3dd76c251",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ad314da54c6dd223a6b6cc85019160aa842f659",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53722.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2023-53722",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.920",
"lastModified": "2025-10-22T14:15:46.920",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: raid1: fix potential OOB in raid1_remove_disk()\n\nIf rddev->raid_disk is greater than mddev->raid_disks, there will be\nan out-of-bounds in raid1_remove_disk(). We have already found\nsimilar reports as follows:\n\n1) commit d17f744e883b (\"md-raid10: fix KASAN warning\")\n2) commit 1ebc2cec0b7d (\"dm raid: fix KASAN warning in raid5_remove_disk\")\n\nFix this bug by checking whether the \"number\" variable is\nvalid."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/25a68f2286be56fb3a6f9fa0e269c04b5e6c6e24",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4bdb92eaf645e312975357adc3c4e9523b6e67f1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f7d853b4590fc20e90dd50e346c02811a8c5b08",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f96c0665f9f4cf70130c9757750dc43dc679c82",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7993cfc041481a3a9cd4a3858088fc846b8ccaf7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b0472b50bcf0f19a5119b00a53b63579c8e1e4d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/91fbd4e75cb573f44d2619a9dc2f9ba927040760",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/beedf40f73939f248c81802eda08a2a8148ea13e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53723.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2023-53723",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:47.480",
"lastModified": "2025-10-22T14:15:47.480",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend\n\nsdma_v4_0_ip is shared on a few asics, but in sdma_v4_0_hw_fini,\ndriver unconditionally disables ecc_irq which is only enabled on\nthose asics enabling sdma ecc. This will introduce a warning in\nsuspend cycle on those chips with sdma ip v4.0, while without\nsdma ecc. So this patch correct this.\n\n[ 7283.166354] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu]\n[ 7283.167001] RSP: 0018:ffff9a5fc3967d08 EFLAGS: 00010246\n[ 7283.167019] RAX: ffff98d88afd3770 RBX: 0000000000000001 RCX: 0000000000000000\n[ 7283.167023] RDX: 0000000000000000 RSI: ffff98d89da30390 RDI: ffff98d89da20000\n[ 7283.167025] RBP: ffff98d89da20000 R08: 0000000000036838 R09: 0000000000000006\n[ 7283.167028] R10: ffffd5764243c008 R11: 0000000000000000 R12: ffff98d89da30390\n[ 7283.167030] R13: ffff98d89da38978 R14: ffffffff999ae15a R15: ffff98d880130105\n[ 7283.167032] FS: 0000000000000000(0000) GS:ffff98d996f00000(0000) knlGS:0000000000000000\n[ 7283.167036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7283.167039] CR2: 00000000f7a9d178 CR3: 00000001c42ea000 CR4: 00000000003506e0\n[ 7283.167041] Call Trace:\n[ 7283.167046] <TASK>\n[ 7283.167048] sdma_v4_0_hw_fini+0x38/0xa0 [amdgpu]\n[ 7283.167704] amdgpu_device_ip_suspend_phase2+0x101/0x1a0 [amdgpu]\n[ 7283.168296] amdgpu_device_suspend+0x103/0x180 [amdgpu]\n[ 7283.168875] amdgpu_pmops_freeze+0x21/0x60 [amdgpu]\n[ 7283.169464] pci_pm_freeze+0x54/0xc0"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a179117a3b29e7136e4045c57090a05bb97f373",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3decf3a750a924362bf4e2680dd3b07242fe56e8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/71e1f44077db83e205db70a684c1f2c5d2247174",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/823787470e320f90372c3ef506769520026c571f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b229ada2669b74fdae06c83fbfda5a5a99fc253",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c1420276be7a98df0074584bb9c1709cbc1a9df5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c5123c193696bf97fdf259c825ebfac517b54e44",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53724.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2023-53724",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:47.600",
"lastModified": "2025-10-22T14:15:47.600",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()\n\n`req` is allocated in pcf50633_adc_async_read(), but\nadc_enqueue_request() could fail to insert the `req` into queue.\nWe need to check the return value and free it in the case of failure."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ee13bdf0d25ae8752ae6185b6d13bbb0d5a8e30",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/41cdf082ae006ea002135dfaf43b2897de3bded8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/588edb4fb1f1e6487a0f60a5f7b9a24d2d0c9f8e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/66616eed76dfa6f3e442907760325a023c6da7e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6a8a02dcfae13ab07dc7bed2b409cec7f3d32e92",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b450dcff23aa254844492831a8e2b508a9d522d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9cca3a4933ca365cc664d5eefb0f942374ea8b41",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a62a5e79202967176a9c1a04e477860779accd6c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53725.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2023-53725",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:47.710",
"lastModified": "2025-10-22T14:15:47.710",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe\n\nSmatch reports:\ndrivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe()\nwarn: 'timer_baseaddr' from of_iomap() not released on lines: 498,508,516.\n\ntimer_baseaddr may have the problem of not being released after use,\nI replaced it with the devm_of_iomap() function and added the clk_put()\nfunction to cleanup the \"clk_ce\" and \"clk_cs\"."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/289e2054eeb63c9e133960731c342eeffad218d3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/54cc10a0f4b01b522e9519014200f1b33bf7e4aa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/67d7eebbc424935dec61fb352d1ccae5d16cf429",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b5bf64c89c7100c921bd807ba39b2eb003061ab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/919dd531ebb7514f205ae7aab87994337ebce1f6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/99744200f28b2cf5f50767447e51b4b4a977d145",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e0a9cc90ea44a50d76a84f9f9bf1703d31fe45e9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ebdff0986513a29be242aace0ef89b6c105b0bf0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53726.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2023-53726",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:47.837",
"lastModified": "2025-10-22T14:15:47.837",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: csum: Fix OoB access in IP checksum code for negative lengths\n\nAlthough commit c2c24edb1d9c (\"arm64: csum: Fix pathological zero-length\ncalls\") added an early return for zero-length input, syzkaller has\npopped up with an example of a _negative_ length which causes an\nundefined shift and an out-of-bounds read:\n\n | BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39\n | Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5975\n |\n | CPU: 0 PID: 5975 Comm: syz-executor412 Not tainted 6.4.0-rc4-syzkaller-g908f31f2a05b #0\n | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023\n | Call trace:\n | dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233\n | show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240\n | __dump_stack lib/dump_stack.c:88 [inline]\n | dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106\n | print_address_description mm/kasan/report.c:351 [inline]\n | print_report+0x174/0x514 mm/kasan/report.c:462\n | kasan_report+0xd4/0x130 mm/kasan/report.c:572\n | kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187\n | __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31\n | do_csum+0x44/0x254 arch/arm64/lib/csum.c:39\n | csum_partial+0x30/0x58 lib/checksum.c:128\n | gso_make_checksum include/linux/skbuff.h:4928 [inline]\n | __udp_gso_segment+0xaf4/0x1bc4 net/ipv4/udp_offload.c:332\n | udp6_ufo_fragment+0x540/0xca0 net/ipv6/udp_offload.c:47\n | ipv6_gso_segment+0x5cc/0x1760 net/ipv6/ip6_offload.c:119\n | skb_mac_gso_segment+0x2b4/0x5b0 net/core/gro.c:141\n | __skb_gso_segment+0x250/0x3d0 net/core/dev.c:3401\n | skb_gso_segment include/linux/netdevice.h:4859 [inline]\n | validate_xmit_skb+0x364/0xdbc net/core/dev.c:3659\n | validate_xmit_skb_list+0x94/0x130 net/core/dev.c:3709\n | sch_direct_xmit+0xe8/0x548 net/sched/sch_generic.c:327\n | __dev_xmit_skb net/core/dev.c:3805 [inline]\n | __dev_queue_xmit+0x147c/0x3318 net/core/dev.c:4210\n | dev_queue_xmit include/linux/netdevice.h:3085 [inline]\n | packet_xmit+0x6c/0x318 net/packet/af_packet.c:276\n | packet_snd net/packet/af_packet.c:3081 [inline]\n | packet_sendmsg+0x376c/0x4c98 net/packet/af_packet.c:3113\n | sock_sendmsg_nosec net/socket.c:724 [inline]\n | sock_sendmsg net/socket.c:747 [inline]\n | __sys_sendto+0x3b4/0x538 net/socket.c:2144\n\nExtend the early return to reject negative lengths as well, aligning our\nimplementation with the generic code in lib/checksum.c"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5a85727239a23de1cc8d93985f1056308128f3e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8bd795fedb8450ecbef18eeadbd23ed8fc7630f5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9a43563cfd6b9200ff2f76b3f9fcdcb217ceb523",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a5ad2f87d8e74e351d3f500ad9d5b3a5653e1c6f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ba0b46166b8e547024d02345a68b747841931ad2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fcdf904e866de0e3715835e50409fda3b2590527",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53727.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2023-53727",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:47.977",
"lastModified": "2025-10-22T14:15:47.977",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fq_pie: avoid stalls in fq_pie_timer()\n\nWhen setting a high number of flows (limit being 65536),\nfq_pie_timer() is currently using too much time as syzbot reported.\n\nAdd logic to yield the cpu every 2048 flows (less than 150 usec\non debug kernels).\nIt should also help by not blocking qdisc fast paths for too long.\nWorst case (65536 flows) would need 31 jiffies for a complete scan.\n\nRelevant extract from syzbot report:\n\nrcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2663 jiffies s: 873 root: 0x1/.\nrcu: blocking rcu_node structures (internal RCU debug):\nSending NMI from CPU 1 to CPUs 0:\nNMI backtrace for cpu 0\nCPU: 0 PID: 5177 Comm: syz-executor273 Not tainted 6.5.0-syzkaller-00453-g727dbda16b83 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023\nRIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]\nRIP: 0010:write_comp_data+0x21/0x90 kernel/kcov.c:236\nCode: 2e 0f 1f 84 00 00 00 00 00 65 8b 05 01 b2 7d 7e 49 89 f1 89 c6 49 89 d2 81 e6 00 01 00 00 49 89 f8 65 48 8b 14 25 80 b9 03 00 <a9> 00 01 ff 00 74 0e 85 f6 74 59 8b 82 04 16 00 00 85 c0 74 4f 8b\nRSP: 0018:ffffc90000007bb8 EFLAGS: 00000206\nRAX: 0000000000000101 RBX: ffffc9000dc0d140 RCX: ffffffff885893b0\nRDX: ffff88807c075940 RSI: 0000000000000100 RDI: 0000000000000001\nRBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000dc0d178\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS: 0000555555d54380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f6b442f6130 CR3: 000000006fe1c000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <NMI>\n </NMI>\n <IRQ>\n pie_calculate_probability+0x480/0x850 net/sched/sch_pie.c:415\n fq_pie_timer+0x1da/0x4f0 net/sched/sch_fq_pie.c:387\n call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c21ab1bae945686c602c5bfa4e3f3352c2452c5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/94d527c3759d76c29220758362f622954612bea7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/973a4c302d7f3804098ff9824d9f56926901f293",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e093000e7d13569c9cb07d7500acd5142c3c43cb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f39b49077abec4c9c3a4c2966532004851c51006",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53728.json
+49
View File
@@ -0,0 +1,49 @@
{
"id": "CVE-2023-53728",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:48.083",
"lastModified": "2025-10-22T14:15:48.083",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-timers: Ensure timer ID search-loop limit is valid\n\nposix_timer_add() tries to allocate a posix timer ID by starting from the\ncached ID which was stored by the last successful allocation.\n\nThis is done in a loop searching the ID space for a free slot one by\none. The loop has to terminate when the search wrapped around to the\nstarting point.\n\nBut that's racy vs. establishing the starting point. That is read out\nlockless, which leads to the following problem:\n\nCPU0\t \t \t \t CPU1\nposix_timer_add()\n start = sig->posix_timer_id;\n lock(hash_lock);\n ...\t\t\t\t posix_timer_add()\n if (++sig->posix_timer_id < 0)\n \t\t\t start = sig->posix_timer_id;\n sig->posix_timer_id = 0;\n\nSo CPU1 can observe a negative start value, i.e. -1, and the loop break\nnever happens because the condition can never be true:\n\n if (sig->posix_timer_id == start)\n break;\n\nWhile this is unlikely to ever turn into an endless loop as the ID space is\nhuge (INT_MAX), the racy read of the start value caught the attention of\nKCSAN and Dmitry unearthed that incorrectness.\n\nRewrite it so that all id operations are under the hash lock."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/322377cc909defcca9451487484845e7e1d20d1b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/37175e25edf7cc0d5a2cd2c2a1cbe2dcbf4a1937",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6a0ac84501b4fec73a1a823c55cf13584c43f418",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ad6679a5bb97cdb3e14942729292b4bfcc0e223",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ce8849dd1e78dadcee0ec9acbd259d239b7069f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8dc52c200b889bc1cb34288fbf623d4ff381d2ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9ea26a8494a0a9337e7415eafd6f3ed940327dc5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ef535e0315afd098c4beb1da364847eca4b56a20",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53729.json
+45
View File
@@ -0,0 +1,45 @@
{
"id": "CVE-2023-53729",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:48.193",
"lastModified": "2025-10-22T14:15:48.193",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: qmi_encdec: Restrict string length in decode\n\nThe QMI TLV value for strings in a lot of qmi element info structures\naccount for null terminated strings with MAX_LEN + 1. If a string is\nactually MAX_LEN + 1 length, this will cause an out of bounds access\nwhen the NULL character is appended in decoding."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53730.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2023-53730",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:48.310",
"lastModified": "2025-10-22T14:15:48.310",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost\n\nadjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled\nwhen unlock. DEADLOCK might happen if we have held other locks and disabled\nIRQ before invoking it.\n\nFix it by using spin_lock_irqsave() instead, which can keep IRQ state\nconsistent with before when unlock.\n\n ================================\n WARNING: inconsistent lock state\n 5.10.0-02758-g8e5f91fd772f #26 Not tainted\n --------------------------------\n inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.\n kworker/2:3/388 [HC0[0]:SC0[0]:HE0:SE1] takes:\n ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq\n ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390\n {IN-HARDIRQ-W} state was registered at:\n __lock_acquire+0x3d7/0x1070\n lock_acquire+0x197/0x4a0\n __raw_spin_lock_irqsave\n _raw_spin_lock_irqsave+0x3b/0x60\n bfq_idle_slice_timer_body\n bfq_idle_slice_timer+0x53/0x1d0\n __run_hrtimer+0x477/0xa70\n __hrtimer_run_queues+0x1c6/0x2d0\n hrtimer_interrupt+0x302/0x9e0\n local_apic_timer_interrupt\n __sysvec_apic_timer_interrupt+0xfd/0x420\n run_sysvec_on_irqstack_cond\n sysvec_apic_timer_interrupt+0x46/0xa0\n asm_sysvec_apic_timer_interrupt+0x12/0x20\n irq event stamp: 837522\n hardirqs last enabled at (837521): [<ffffffff84b9419d>] __raw_spin_unlock_irqrestore\n hardirqs last enabled at (837521): [<ffffffff84b9419d>] _raw_spin_unlock_irqrestore+0x3d/0x40\n hardirqs last disabled at (837522): [<ffffffff84b93fa3>] __raw_spin_lock_irq\n hardirqs last disabled at (837522): [<ffffffff84b93fa3>] _raw_spin_lock_irq+0x43/0x50\n softirqs last enabled at (835852): [<ffffffff84e00558>] __do_softirq+0x558/0x8ec\n softirqs last disabled at (835845): [<ffffffff84c010ff>] asm_call_irq_on_stack+0xf/0x20\n\n other info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(&bfqd->lock);\n <Interrupt>\n lock(&bfqd->lock);\n\n *** DEADLOCK ***\n\n 3 locks held by kworker/2:3/388:\n #0: ffff888107af0f38 ((wq_completion)kthrotld){+.+.}-{0:0}, at: process_one_work+0x742/0x13f0\n #1: ffff8881176bfdd8 ((work_completion)(&td->dispatch_work)){+.+.}-{0:0}, at: process_one_work+0x777/0x13f0\n #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq\n #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390\n\n stack backtrace:\n CPU: 2 PID: 388 Comm: kworker/2:3 Not tainted 5.10.0-02758-g8e5f91fd772f #26\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n Workqueue: kthrotld blk_throtl_dispatch_work_fn\n Call Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x107/0x167\n print_usage_bug\n valid_state\n mark_lock_irq.cold+0x32/0x3a\n mark_lock+0x693/0xbc0\n mark_held_locks+0x9e/0xe0\n __trace_hardirqs_on_caller\n lockdep_hardirqs_on_prepare.part.0+0x151/0x360\n trace_hardirqs_on+0x5b/0x180\n __raw_spin_unlock_irq\n _raw_spin_unlock_irq+0x24/0x40\n spin_unlock_irq\n adjust_inuse_and_calc_cost+0x4fb/0x970\n ioc_rqos_merge+0x277/0x740\n __rq_qos_merge+0x62/0xb0\n rq_qos_merge\n bio_attempt_back_merge+0x12c/0x4a0\n blk_mq_sched_try_merge+0x1b6/0x4d0\n bfq_bio_merge+0x24a/0x390\n __blk_mq_sched_bio_merge+0xa6/0x460\n blk_mq_sched_bio_merge\n blk_mq_submit_bio+0x2e7/0x1ee0\n __submit_bio_noacct_mq+0x175/0x3b0\n submit_bio_noacct+0x1fb/0x270\n blk_throtl_dispatch_work_fn+0x1ef/0x2b0\n process_one_work+0x83e/0x13f0\n process_scheduled_works\n worker_thread+0x7e3/0xd80\n kthread+0x353/0x470\n ret_from_fork+0x1f/0x30"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/3376c4fe2db4aea2dc721a27a999c41fdb45b54f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8563b58a4360e648ce18f0e98a75a4be51667431",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ceeb3fc86a83700bb1585c189006080a47e8506",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8d211554679d0b23702bd32ba04aeac0c1c4f660",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9279a1b74ad98039d5d44d26b9e7a9cfe655b6d3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eb120c0aff5ceab9c9c46b87f302465bbf2bbaed",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53731.json
+53
View File
@@ -0,0 +1,53 @@
{
"id": "CVE-2023-53731",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:48.423",
"lastModified": "2025-10-22T14:15:48.423",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: fix potential deadlock in netlink_set_err()\n\nsyzbot reported a possible deadlock in netlink_set_err() [1]\n\nA similar issue was fixed in commit 1d482e666b8e (\"netlink: disable IRQs\nfor netlink_lock_table()\") in netlink_lock_table()\n\nThis patch adds IRQ safety to netlink_set_err() and __netlink_diag_dump()\nwhich were not covered by cited commit.\n\n[1]\n\nWARNING: possible irq lock inversion dependency detected\n6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted\n\nsyz-executor.2/23011 just changed the state of lock:\nffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612\nbut this lock was taken by another, SOFTIRQ-safe lock in the past:\n (&local->queue_stop_reason_lock){..-.}-{2:2}\n\nand interrupts could create inverse lock ordering between them.\n\nother info that might help us debug this:\n Possible interrupt unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(nl_table_lock);\n local_irq_disable();\n lock(&local->queue_stop_reason_lock);\n lock(nl_table_lock);\n <Interrupt>\n lock(&local->queue_stop_reason_lock);\n\n *** DEADLOCK ***"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1556ba034b95cfd4f75ea93c1a2679ae0444bba1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4b9adb8d4a62ff7608d4a7d4eb42036a88f30980",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/61ffe8b1ee084e5c82a4e4bbf9e7b68e0c06e464",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8d61f926d42045961e6b65191c09e3678d86a9cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f6652ed2ad98fe6d13b903483d9257762ab2ec6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a641240b7e071c5538dc0e7894ece833fce459dd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c09e8e3f7fd432984bf5422302b093d2371dfc48",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cde7b90e0539a3b11da377e463dfd2288a162dbf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eb8e27c8fa9397b4a7b181c48fa58157dbe9902e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2023/CVE-2023-537xx/CVE-2023-53732.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2023-53732",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:48.547",
"lastModified": "2025-10-22T14:15:48.547",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix NULL dereference in ni_write_inode\n\nSyzbot reports a NULL dereference in ni_write_inode.\nWhen creating a new inode, if allocation fails in mi_init function\n(called in mi_format_new function), mi->mrec is set to NULL.\nIn the error path of this inode creation, mi->mrec is later\ndereferenced in ni_write_inode.\n\nAdd a NULL check to prevent NULL dereference."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/8dae4f6341e335a09575be60b4fdf697c732a470",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b1135fbaf8ebef93df326761ac70ebcc3c2e3d63",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b3152afc0eb864f7c6ecad134a15b577ef7aec77",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d4b74482529516477cf7b12502538e51827c699f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2024/CVE-2024-324xx/CVE-2024-32499.json
+3 -3
View File
@@ -2,7 +2,7 @@
"id": "CVE-2024-32499",
"sourceIdentifier": "[email protected]",
"published": "2025-04-28T17:15:47.073",
"lastModified": "2025-05-10T01:03:36.457",
"lastModified": "2025-10-22T15:06:49.100",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@@ -90,9 +90,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:newforma:project_center_server:*:*:*:*:*:*:*:*",
"criteria": "cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2023.3.0.32259",
"matchCriteriaId": "E0006AF7-CBDA-459F-B2E5-A1D6E6CB952E"
"matchCriteriaId": "1CAA26E8-D5AC-43B6-81C2-7A04A76053EA"
}
]
}
CVE-2024/CVE-2024-582xx/CVE-2024-58274.json
+6 -2
View File
@@ -2,7 +2,7 @@
"id": "CVE-2024-58274",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T04:15:55.680",
"lastModified": "2025-10-22T04:15:55.680",
"lastModified": "2025-10-22T14:15:48.660",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -38,7 +38,7 @@
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"type": "Secondary",
"description": [
{
"lang": "en",
@@ -59,6 +59,10 @@
{
"url": "https://xz.aliyun.com/news/14639",
"source": "[email protected]"
},
{
"url": "https://xz.aliyun.com/news/14639",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2025/CVE-2025-117xx/CVE-2025-11750.json
+60
View File
@@ -0,0 +1,60 @@
{
"id": "CVE-2025-11750",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T14:15:49.037",
"lastModified": "2025-10-22T14:15:49.037",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system responds with a message such as \"account not found.\" Conversely, when the username or email exists but the password is incorrect, a different error message is returned. This discrepancy allows an attacker to enumerate valid user accounts by analyzing the error responses, potentially facilitating targeted social engineering, brute force, or credential stuffing attacks."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-544"
}
]
}
],
"references": [
{
"url": "https://huntr.com/bounties/e7359f9f-c004-4304-9de9-753622d370a1",
"source": "[email protected]"
},
{
"url": "https://huntr.com/bounties/e7359f9f-c004-4304-9de9-753622d370a1",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2025/CVE-2025-118xx/CVE-2025-11844.json
+64
View File
@@ -0,0 +1,64 @@
{
"id": "CVE-2025-11844",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T14:15:49.457",
"lastModified": "2025-10-22T14:15:49.457",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-643"
}
]
}
],
"references": [
{
"url": "https://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794",
"source": "[email protected]"
},
{
"url": "https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4",
"source": "[email protected]"
},
{
"url": "https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2025/CVE-2025-119xx/CVE-2025-11965.json
+78
View File
@@ -0,0 +1,78 @@
{
"id": "CVE-2025-11965",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T15:15:31.590",
"lastModified": "2025-10-22T15:15:31.590",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config')."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-552"
}
]
}
],
"references": [
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/304",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-119xx/CVE-2025-11966.json
+82
View File
@@ -0,0 +1,82 @@
{
"id": "CVE-2025-11966",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T15:15:31.730",
"lastModified": "2025-10-22T15:15:31.730",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when \"directory listing\" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.3,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-80"
}
]
}
],
"references": [
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-221xx/CVE-2025-22167.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-22167",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T01:16:08.753",
"lastModified": "2025-10-22T01:16:08.753",
"lastModified": "2025-10-22T14:15:49.967",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
@@ -57,6 +57,18 @@
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034",
CVE-2025/CVE-2025-233xx/CVE-2025-23355.json
+64 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-23355",
"sourceIdentifier": "[email protected]",
"published": "2025-10-01T22:15:30.663",
"lastModified": "2025-10-02T19:11:46.753",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T15:50:29.027",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -32,6 +32,26 @@
},
"exploitabilityScore": 0.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
@@ -47,18 +67,57 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nvidia:nsight_graphics:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2025.3",
"matchCriteriaId": "5B99B8AA-3435-45C5-BEFE-45B3E93A254B"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23355",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"US Government Resource"
]
},
{
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5704",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23355",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-257xx/CVE-2025-25732.json
+11 -11
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-25732",
"sourceIdentifier": "[email protected]",
"published": "2025-08-26T15:15:42.080",
"lastModified": "2025-09-17T17:54:02.850",
"vulnStatus": "Analyzed",
"lastModified": "2025-10-22T15:15:31.900",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
@@ -22,20 +22,20 @@
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 6.5,
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5
"exploitabilityScore": 0.9,
"impactScore": 5.9
}
]
},
@@ -46,7 +46,7 @@
"description": [
{
"lang": "en",
"value": "CWE-284"
"value": "CWE-922"
}
]
}
CVE-2025/CVE-2025-257xx/CVE-2025-25733.json
+10 -10
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-25733",
"sourceIdentifier": "[email protected]",
"published": "2025-08-26T15:15:42.270",
"lastModified": "2025-09-18T15:31:39.373",
"vulnStatus": "Analyzed",
"lastModified": "2025-10-22T15:15:32.110",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
@@ -22,20 +22,20 @@
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 3.5,
"baseSeverity": "LOW",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
"exploitabilityScore": 0.9,
"impactScore": 2.5
}
]
},
@@ -46,7 +46,7 @@
"description": [
{
"lang": "en",
"value": "CWE-284"
"value": "CWE-1233"
}
]
}
CVE-2025/CVE-2025-257xx/CVE-2025-25734.json
+11 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-25734",
"sourceIdentifier": "[email protected]",
"published": "2025-08-26T15:15:42.453",
"lastModified": "2025-09-16T19:37:16.167",
"vulnStatus": "Analyzed",
"lastModified": "2025-10-22T15:15:32.290",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
@@ -22,10 +22,10 @@
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
@@ -34,7 +34,7 @@
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"exploitabilityScore": 0.9,
"impactScore": 5.9
}
]
@@ -44,6 +44,10 @@
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
},
{
"lang": "en",
"value": "CWE-1233"
CVE-2025/CVE-2025-257xx/CVE-2025-25735.json
+9 -9
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-25735",
"sourceIdentifier": "[email protected]",
"published": "2025-08-26T15:15:42.617",
"lastModified": "2025-09-16T19:33:52.560",
"vulnStatus": "Analyzed",
"lastModified": "2025-10-22T15:15:32.477",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
@@ -22,19 +22,19 @@
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"exploitabilityScore": 0.9,
"impactScore": 3.6
}
]
CVE-2025/CVE-2025-257xx/CVE-2025-25736.json
+7 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-25736",
"sourceIdentifier": "[email protected]",
"published": "2025-08-26T15:15:42.793",
"lastModified": "2025-09-16T19:27:50.197",
"vulnStatus": "Analyzed",
"lastModified": "2025-10-22T15:15:32.663",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
@@ -22,10 +22,10 @@
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
@@ -34,7 +34,7 @@
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"exploitabilityScore": 0.9,
"impactScore": 5.9
}
]
CVE-2025/CVE-2025-257xx/CVE-2025-25737.json
+7 -15
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-25737",
"sourceIdentifier": "[email protected]",
"published": "2025-08-26T15:15:43.107",
"lastModified": "2025-09-16T19:22:37.060",
"vulnStatus": "Analyzed",
"lastModified": "2025-10-22T15:15:32.847",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
@@ -22,10 +22,10 @@
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
@@ -34,7 +34,7 @@
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"exploitabilityScore": 0.9,
"impactScore": 5.9
}
]
@@ -170,14 +170,6 @@
"tags": [
"Product"
]
},
{
"url": "https://phrack.org/issues/72/16_md",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-309xx/CVE-2025-30944.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-30944",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T15:15:33.033",
"lastModified": "2025-10-22T15:15:33.033",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Essekia Tablesome Table Premium tablesome-premium allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tablesome Table Premium: from n/a through <= 1.1.23."
}
],
"metrics": {},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/tablesome-premium/vulnerability/wordpress-tablesome-table-premium-1-1-23-broken-access-control-vulnerability",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-316xx/CVE-2025-31634.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-31634",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T15:15:33.180",
"lastModified": "2025-10-22T15:15:33.180",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5."
}
],
"metrics": {},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://vdp.patchstack.com/database/Wordpress/Theme/insurance/vulnerability/wordpress-insurance-3-5-php-object-injection-vulnerability",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-322xx/CVE-2025-32283.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-32283",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T15:15:33.307",
"lastModified": "2025-10-22T15:15:33.307",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5."
}
],
"metrics": {},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://vdp.patchstack.com/database/Wordpress/Theme/solar/vulnerability/wordpress-solar-energy-3-5-php-object-injection-vulnerability",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-326xx/CVE-2025-32657.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-32657",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T15:15:33.443",
"lastModified": "2025-10-22T15:15:33.443",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.1.7."
}
],
"metrics": {},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/testimonial-slider-showcase-pro/vulnerability/wordpress-testimonial-slider-and-showcase-pro-plugin-2-1-7-local-file-inclusion-vulnerability",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-350xx/CVE-2025-35052.json
+28 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-35052",
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"published": "2025-10-09T21:15:36.040",
"lastModified": "2025-10-14T19:37:28.107",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T15:56:25.910",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -91,14 +91,38 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2024.3",
"matchCriteriaId": "71630A80-6292-4C7B-A5C9-8C6877EE229E"
}
]
}
]
}
],
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35052",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-350xx/CVE-2025-35053.json
+52 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-35053",
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"published": "2025-10-09T21:15:36.203",
"lastModified": "2025-10-14T19:37:28.107",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T15:19:32.160",
"vulnStatus": "Undergoing Analysis",
"cveTags": [],
"descriptions": [
{
@@ -76,6 +76,26 @@
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
@@ -95,18 +115,45 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2024.3.",
"matchCriteriaId": "70F904CF-DA5A-46A9-BD34-4FF07076A2C1"
}
]
}
]
}
],
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35053",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35062",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-350xx/CVE-2025-35054.json
+48 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-35054",
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"published": "2025-10-09T21:15:36.357",
"lastModified": "2025-10-14T19:37:28.107",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T15:18:27.027",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -76,6 +76,26 @@
},
"exploitabilityScore": 1.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.8,
"impactScore": 3.4
}
]
},
@@ -99,14 +119,38 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2024.3",
"matchCriteriaId": "71630A80-6292-4C7B-A5C9-8C6877EE229E"
}
]
}
]
}
],
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35054",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-350xx/CVE-2025-35055.json
+32 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-35055",
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"published": "2025-10-09T21:15:36.517",
"lastModified": "2025-10-14T19:37:28.107",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T15:17:05.643",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -95,18 +95,45 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2023.1",
"matchCriteriaId": "FCD3AAE4-4F00-480B-899E-D0389BC7DC4B"
}
]
}
]
}
],
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35055",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35062",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-350xx/CVE-2025-35056.json
+52 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-35056",
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"published": "2025-10-09T21:15:36.670",
"lastModified": "2025-10-14T19:37:28.107",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T15:16:36.560",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -76,6 +76,26 @@
},
"exploitabilityScore": 3.1,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 1.4
}
]
},
@@ -91,18 +111,45 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2024.1",
"matchCriteriaId": "BBC6EAB6-B5A7-4557-8C51-AB1CB186EB3C"
}
]
}
]
}
],
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35056",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35062",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-350xx/CVE-2025-35057.json
+28 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-35057",
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"published": "2025-10-09T21:15:36.827",
"lastModified": "2025-10-14T19:37:28.107",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T15:12:44.357",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -91,14 +91,38 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2024.3",
"matchCriteriaId": "EC2FF0A6-51C4-404B-9DC4-B056BC0DD65A"
}
]
}
]
}
],
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35057",
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-38xx/CVE-2025-3872.json
+57 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-3872",
"sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"published": "2025-04-24T10:15:17.093",
"lastModified": "2025-04-29T13:52:47.470",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T14:10:02.373",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,14 +51,67 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "22.10.0",
"versionEndExcluding": "22.10.28",
"matchCriteriaId": "B762A216-341C-4989-8E32-46087A42CB48"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "23.04.0",
"versionEndExcluding": "23.04.25",
"matchCriteriaId": "92132FF0-1099-4F1B-B5E6-8FE0577770C6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "23.10.0",
"versionEndExcluding": "23.10.20",
"matchCriteriaId": "F9BECCFC-C3C6-4A0D-B10A-29FC01486CD4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.04.0",
"versionEndExcluding": "24.04.10",
"matchCriteriaId": "BB5744F8-A08E-4775-A63C-594A301D3AAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.10.0",
"versionEndExcluding": "24.10.4",
"matchCriteriaId": "4F80239D-00CD-4A74-84B5-429897AC4B0A"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/centreon/centreon/releases",
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"tags": [
"Release Notes"
]
},
{
"url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55571-centreon-web-high-severity-4496",
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-395xx/CVE-2025-39534.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-39534",
"sourceIdentifier": "[email protected]",
"published": "2025-10-22T15:15:33.580",
"lastModified": "2025-10-22T15:15:33.580",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through <= 1.5.1."
}
],
"metrics": {},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/terms-dictionary/vulnerability/wordpress-terms-dictionary-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-406xx/CVE-2025-40657.json
+46 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-40657",
"sourceIdentifier": "[email protected]",
"published": "2025-06-10T10:15:28.043",
"lastModified": "2025-06-12T16:06:39.330",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-10-22T14:00:13.857",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -59,6 +59,28 @@
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
@@ -73,10 +95,31 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:acc:dm_corporative_cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2025.01",
"matchCriteriaId": "8424AC64-05AA-48EF-B312-CABE5A4437D0"
}
]
}
]
}
],
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-46xx/CVE-2025-4646.json
+36 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-4646",
"sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"published": "2025-05-13T10:15:29.113",
"lastModified": "2025-10-08T10:15:37.677",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T14:13:47.513",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,14 +51,46 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.04.0",
"versionEndExcluding": "24.04.10",
"matchCriteriaId": "BB5744F8-A08E-4775-A63C-594A301D3AAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.10.0",
"versionEndExcluding": "24.10.4",
"matchCriteriaId": "4F80239D-00CD-4A74-84B5-429897AC4B0A"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/centreon/centreon/releases",
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"tags": [
"Release Notes"
]
},
{
"url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55572-centreon-web-high-severity-4460",
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-46xx/CVE-2025-4647.json
+77 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-4647",
"sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"published": "2025-05-13T10:15:29.317",
"lastModified": "2025-05-13T19:35:18.080",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T14:13:18.460",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -36,6 +36,26 @@
},
"exploitabilityScore": 1.7,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7
}
]
},
@@ -51,14 +71,67 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "22.10.0",
"versionEndExcluding": "22.10.29",
"matchCriteriaId": "E8987E24-3449-4436-BBE0-BF3ECD4A79AD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "23.04.0",
"versionEndExcluding": "23.04.27",
"matchCriteriaId": "1CA620D6-AB8C-494E-9008-F4372C234F3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "23.10.0",
"versionEndExcluding": "23.10.22",
"matchCriteriaId": "22F4DBC4-34EA-4B74-B049-B48C8A368438"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.04.0",
"versionEndExcluding": "24.04.11",
"matchCriteriaId": "5F7169A7-4C43-440B-A7A1-BE6191FB676E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.10.0",
"versionEndExcluding": "24.10.5",
"matchCriteriaId": "58D9F6C2-9EDA-43B1-B18D-E6E6EDB17DDB"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/centreon/centreon/releases",
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"tags": [
"Release Notes"
]
},
{
"url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55574-centreon-web-high-severity-4435",
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-46xx/CVE-2025-4648.json
+77 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-4648",
"sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"published": "2025-05-13T10:15:29.503",
"lastModified": "2025-10-08T10:15:38.000",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-10-22T14:12:11.843",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -36,6 +36,26 @@
},
"exploitabilityScore": 1.7,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
@@ -51,14 +71,67 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "22.10.0",
"versionEndExcluding": "22.10.29",
"matchCriteriaId": "E8987E24-3449-4436-BBE0-BF3ECD4A79AD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "23.04.0",
"versionEndExcluding": "23.04.27",
"matchCriteriaId": "1CA620D6-AB8C-494E-9008-F4372C234F3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "23.10.0",
"versionEndExcluding": "23.10.22",
"matchCriteriaId": "22F4DBC4-34EA-4B74-B049-B48C8A368438"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.04.0",
"versionEndExcluding": "24.04.11",
"matchCriteriaId": "5F7169A7-4C43-440B-A7A1-BE6191FB676E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.10.0",
"versionEndExcluding": "24.10.5",
"matchCriteriaId": "58D9F6C2-9EDA-43B1-B18D-E6E6EDB17DDB"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/centreon/centreon/releases",
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"tags": [
"Release Notes"
]
},
{
"url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55575-centreon-web-high-severity-4434",
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
"tags": [
"Vendor Advisory"
]
}
]
}
Loaded 100 of 380 files, more files were not shown because too many files have changed in this diff. Show more