Skip to content

Commit 9ce9d77

Browse files
author
Rohit Keshri
committed
1 parent 236ab55 commit 9ce9d77

11 files changed

+137
-0
lines changed

‎vulns/CVE-2022-50274.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
reachability: Local
2+
memory_corruption: yes
3+
bug_class: UAF
4+
impact: DoS
5+
privileges_required: yes
6+
notes:
7+
dvb_unregister_device() is known that prone to use-after-free.
8+
That is, the cleanup from dvb_unregister_device() releases the dvb_device
9+
even if there are pointers stored in file->private_data still refer to it.
10+
11+
author: RedHat
12+

‎vulns/CVE-2022-50310.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: UAF
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
A UAF issue in ip6mr_sk_done() when addrconf_init_net() failed
8+
If the initialization fails in calling addrconf_init_net(), devconf_all is
9+
the pointer that has been released. Then ip6mr_sk_done() is called to
10+
release the net, accessing devconf->mc_forwarding directly causes invalid
11+
pointer access.
12+
author: RedHat
13+

‎vulns/CVE-2023-53235.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: UAF
4+
impact: DoS
5+
privileges_required: yes
6+
notes:
7+
when using __drm_kunit_helper_alloc_drm_device() the driver may be
8+
dereferenced by device-managed resources up until the device is
9+
freed, which is typically later than the kunit-managed resource code
10+
frees it causing a UAF problem.
11+
author: RedHat
12+

‎vulns/CVE-2023-53241.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Double Free
4+
impact: DoS / Info Leak
5+
privileges_required: no
6+
notes:
7+
For ops with "trivial" replies, nfsd4_encode_operation will shortcut
8+
most of the encoding work and skip to just marshalling up the status.
9+
One of the things it skips is calling op_release. This could cause a
10+
memory leak in the layoutget codepath if there is an error at an
11+
inopportune time.
12+
13+
Have the compound processing engine always call op_release, even when
14+
op_func sets an error in op->status. With this change, we also need
15+
nfsd4_block_get_device_info_scsi to set the gd_device pointer to NULL
16+
on error to avoid a double free.
17+
author: RedHat
18+

‎vulns/CVE-2023-53329.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Race
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
A data race with the pwq->stats[] increment
8+
author: RedHat
9+

‎vulns/CVE-2023-53368.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Race
4+
impact: DoS
5+
privileges_required: yes
6+
notes:
7+
A race issue between cpu buffer write and swap, It is because the race between
8+
writing event into cpu buffer and swapping cpu buffer through file per_cpu/cpu0/snapshot
9+
author: RedHat
10+

‎vulns/CVE-2025-39702.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Info Leak
4+
impact: Info Leak
5+
privileges_required: no
6+
notes:
7+
MAC comparison to be constant-time, To prevent timing attacks, MACs need to be compared in constant time.
8+
Use the appropriate helper function for this.
9+
author: RedHat
10+

‎vulns/CVE-2025-39711.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: UAF
4+
impact: DoS
5+
privileges_required: Yes
6+
notes:
7+
A UAF was seen causing a crash at shutdown due to missing mei_cldev_disable() calls,
8+
Both the ACE and CSI driver are missing a mei_cldev_disable() call in
9+
their remove() function.
10+
11+
This causes the mei_cl client to stay part of the mei_device->file_list
12+
list even though its memory is freed by mei_cl_bus_dev_release() calling
13+
kfree(cldev->cl).
14+
15+
This leads to a use-after-free when mei_vsc_remove() runs mei_stop()
16+
which first removes all mei bus devices calling mei_ace_remove() and
17+
mei_csi_remove() followed by mei_cl_bus_dev_release() and then calls
18+
mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing
19+
the just freed cldev->cl.
20+
author: RedHat
21+

‎vulns/CVE-2025-39746.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
reachability: Adjacent
2+
memory_corruption: no
3+
bug_class: Logic Error
4+
impact: DoS
5+
privileges_required: yes
6+
notes:
7+
DoS due to unreliable hardwere, In rare cases, ath10k may lose connection with the PCIe bus due to
8+
some unknown reasons, which could further lead to system crashes during
9+
resuming due to watchdog timeout.
10+
author: RedHat
11+

‎vulns/CVE-2025-39790.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Double Free
4+
impact: DoS
5+
privileges_required: Yes
6+
notes:
7+
The host accesses an event ring while the device is
8+
updating it, the pointer inside of the event might still point to an old
9+
TRE. If the host uses the channel's xfer_cb() to directly free the buffer
10+
pointed to by the TRE, the buffer will be double-freed.
11+
author: RedHat
12+

0 commit comments

Comments
 (0)