mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
File diff suppressed because one or more lines are too long
@@ -0,0 +1,45 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3c86-6wjp-hf8m",
|
||||
"modified": "2025-05-08T09:30:24Z",
|
||||
"published": "2025-05-08T09:30:24Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37815"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration\n\nResolve kernel panic while accessing IRQ handler associated with the\ngenerated IRQ. This is done by acquiring the spinlock and storing the\ncurrent interrupt state before handling the interrupt request using\ngeneric_handle_irq.\n\nA previous fix patch was submitted where 'generic_handle_irq' was\nreplaced with 'handle_nested_irq'. However, this change also causes\nthe kernel panic where after determining which GPIO triggered the\ninterrupt and attempting to call handle_nested_irq with the mapped\nIRQ number, leads to a failure in locating the registered handler.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37815"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/1263d5f581908602c618c6665e683c4436383a09"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/12cc2193f2b9548e8ea5fbce8201b44158222edf"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/18eb77c75ed01439f96ae5c0f33461eb5134b907"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/4e02059dc91068bc5017b8546f9ec3b930f6d6a6"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/62957f58ab3aa7fa792dc6ff3575624062539a4d"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:52Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3g6q-j56q-qw54",
|
||||
"modified": "2025-05-08T09:30:23Z",
|
||||
"published": "2025-05-08T09:30:23Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37800"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential NULL pointer dereference in dev_uevent()\n\nIf userspace reads \"uevent\" device attribute at the same time as another\nthreads unbinds the device from its driver, change to dev->driver from a\nvalid pointer to NULL may result in crash. Fix this by using READ_ONCE()\nwhen fetching the pointer, and take bus' drivers klist lock to make sure\ndriver instance will not disappear while we access it.\n\nUse WRITE_ONCE() when setting the driver pointer to ensure there is no\ntearing.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37800"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b64777294209d2622"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2b344e779d9afd0fcb5ee4000e4d0fc7d8d867eb"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3781e4b83e174364998855de777e184cf0b62c40"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/abe56be73eb10a677d16066f65ff9d30251f5eee"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:50Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3j4j-xg7r-jh7c",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-1253"
|
||||
],
|
||||
"details": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 4.5 before 6.1.2.23.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1253"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.rti.com/vulnerabilities/#cve-2025-1253"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-120"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T09:15:19Z"
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,53 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-42fq-x79v-5vv5",
|
||||
"modified": "2025-05-08T09:30:23Z",
|
||||
"published": "2025-05-08T09:30:23Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37803"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nudmabuf: fix a buf size overflow issue during udmabuf creation\n\nby casting size_limit_mb to u64 when calculate pglimit.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37803"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/021ba7f1babd029e714d13a6bf2571b08af96d0f"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/13fe12c037b470321436deec393030c6153cfeb9"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2b8419c6ecf69007dcff54ea0b9f0b215282c55a"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/373512760e13fdaa726faa9502d0f5be2abb3d33"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3f6c9d66e0f8eb9679b57913aa64b4d2266f6fbe"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/b2ff4e9c599b000833d16a917f519aa2e4a75de2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/e84a08fc7e25cdad5d9a3def42cc770ff711193f"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4q4q-jv3m-fqjr",
|
||||
"modified": "2025-05-08T09:30:24Z",
|
||||
"published": "2025-05-08T09:30:24Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37818"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Return NULL from huge_pte_offset() for invalid PMD\n\nLoongArch's huge_pte_offset() currently returns a pointer to a PMD slot\neven if the underlying entry points to invalid_pte_table (indicating no\nmapping). Callers like smaps_hugetlb_range() fetch this invalid entry\nvalue (the address of invalid_pte_table) via this pointer.\n\nThe generic is_swap_pte() check then incorrectly identifies this address\nas a swap entry on LoongArch, because it satisfies the \"!pte_present()\n&& !pte_none()\" conditions. This misinterpretation, combined with a\ncoincidental match by is_migration_entry() on the address bits, leads to\nkernel crashes in pfn_swap_entry_to_page().\n\nFix this at the architecture level by modifying huge_pte_offset() to\ncheck the PMD entry's content using pmd_none() before returning. If the\nentry is invalid (i.e., it points to invalid_pte_table), return NULL\ninstead of the pointer to the slot.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37818"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2ca9380b12711afe95b3589bd82b59623b3c96b3"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/34256805720993e37adf6127371a1265aea8376a"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/51424fd171cee6a33f01f7c66b8eb23ac42289d4"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/b49f085cd671addbda4802d6b9382513f7dd0f30"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/bd51834d1cf65a2c801295d230c220aeebf87a73"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:53Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4x4p-c635-2m6r",
|
||||
"modified": "2025-05-08T09:30:24Z",
|
||||
"published": "2025-05-08T09:30:24Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37816"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmei: vsc: Fix fortify-panic caused by invalid counted_by() use\n\ngcc 15 honors the __counted_by(len) attribute on vsc_tp_packet.buf[]\nand the vsc-tp.c code is using this in a wrong way. len does not contain\nthe available size in the buffer, it contains the actual packet length\n*without* the crc. So as soon as vsc_tp_xfer() tries to add the crc to\nbuf[] the fortify-panic handler gets triggered:\n\n[ 80.842193] memcpy: detected buffer overflow: 4 byte write of buffer size 0\n[ 80.842243] WARNING: CPU: 4 PID: 272 at lib/string_helpers.c:1032 __fortify_report+0x45/0x50\n...\n[ 80.843175] __fortify_panic+0x9/0xb\n[ 80.843186] vsc_tp_xfer.cold+0x67/0x67 [mei_vsc_hw]\n[ 80.843210] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[ 80.843229] ? lockdep_hardirqs_on+0x7c/0x110\n[ 80.843250] mei_vsc_hw_start+0x98/0x120 [mei_vsc]\n[ 80.843270] mei_reset+0x11d/0x420 [mei]\n\nThe easiest fix would be to just drop the counted-by but with the exception\nof the ack buffer in vsc_tp_xfer_helper() which only contains enough room\nfor the packet-header, all other uses of vsc_tp_packet always use a buffer\nof VSC_TP_MAX_XFER_SIZE bytes for the packet.\n\nInstead of just dropping the counted-by, split the vsc_tp_packet struct\ndefinition into a header and a full-packet definition and use a fixed\nsize buf[] in the packet definition, this way fortify-source buffer\noverrun checking still works when enabled.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37816"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/00f1cc14da0f06d2897b8c528df7c7dcf1b8da50"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3e243378f27cc7d11682a3ad720228b0723affa5"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/ac04663c67f244810b3492e9ecd9f7cdbefeca2d"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:52Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5427-cfr3-v9jm",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37820"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: handle NULL returned by xdp_convert_buff_to_frame()\n\nThe function xdp_convert_buff_to_frame() may return NULL if it fails\nto correctly convert the XDP buffer into an XDP frame due to memory\nconstraints, internal errors, or invalid data. Failing to check for NULL\nmay lead to a NULL pointer dereference if the result is used later in\nprocessing, potentially causing crashes, data corruption, or undefined\nbehavior.\n\nOn XDP redirect failure, the associated page must be released explicitly\nif it was previously retained via get_page(). Failing to do so may result\nin a memory leak, as the pages reference count is not decremented.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37820"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/5b83d30c63f9964acb1bc63eb8e670b9e0d2c240"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/cc3628dcd851ddd8d418bf0c897024b4621ddc92"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/eefccd889df3b49d92e7349d94c4aa7e1ba19f6c"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:53Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-56c5-8gc7-wj67",
|
||||
"modified": "2025-05-08T09:30:23Z",
|
||||
"published": "2025-05-08T09:30:23Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37802"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"\n\nwait_event_timeout() will set the state of the current\ntask to TASK_UNINTERRUPTIBLE, before doing the condition check. This\nmeans that ksmbd_durable_scavenger_alive() will try to acquire the mutex\nwhile already in a sleeping state. The scheduler warns us by giving\nthe following warning:\n\ndo not call blocking ops when !TASK_RUNNING; state=2 set at\n [<0000000061515a6f>] prepare_to_wait_event+0x9f/0x6c0\nWARNING: CPU: 2 PID: 4147 at kernel/sched/core.c:10099 __might_sleep+0x12f/0x160\n\nmutex lock is not needed in ksmbd_durable_scavenger_alive().",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37802"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/1df0d4c616138784e033ad337961b6e1a6bcd999"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/8f805b3746d2f41702c77cba22f94f8415fadd1a"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/cd161198e091e8a62b9bd631be970ea9a87d2d6a"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5c72-frqm-r8r4",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37819"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()\n\nWith ACPI in place, gicv2m_get_fwnode() is registered with the pci\nsubsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime\nduring a PCI host bridge probe. But, the call back is wrongly marked as\n__init, causing it to be freed, while being registered with the PCI\nsubsystem and could trigger:\n\n Unable to handle kernel paging request at virtual address ffff8000816c0400\n gicv2m_get_fwnode+0x0/0x58 (P)\n pci_set_bus_msi_domain+0x74/0x88\n pci_register_host_bridge+0x194/0x548\n\nThis is easily reproducible on a Juno board with ACPI boot.\n\nRetain the function for later use.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37819"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2f2803e4b5e4df2b08d378deaab78b1681ef9b30"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3318dc299b072a0511d6dfd8367f3304fb6d9827"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3939d6f29d34cdb60e3f68b76e39e00a964a1d51"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/47bee0081b483b077c7560bc5358ad101f89c8ef"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:53Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6qhx-rx44-6465",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37832"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: sun50i: prevent out-of-bounds access\n\nA KASAN enabled kernel reports an out-of-bounds access when handling the\nnvmem cell in the sun50i cpufreq driver:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in sun50i_cpufreq_nvmem_probe+0x180/0x3d4\nRead of size 4 at addr ffff000006bf31e0 by task kworker/u16:1/38\n\nThis is because the DT specifies the nvmem cell as covering only two\nbytes, but we use a u32 pointer to read the value. DTs for other SoCs\nindeed specify 4 bytes, so we cannot just shorten the variable to a u16.\n\nFortunately nvmem_cell_read() allows to return the length of the nvmem\ncell, in bytes, so we can use that information to only access the valid\nportion of the data.\nTo cover multiple cell sizes, use memcpy() to copy the information into a\nzeroed u32 buffer, then also make sure we always read the data in little\nendian fashion, as this is how the data is stored in the SID efuses.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37832"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/14c8a418159e541d70dbf8fc71225d1623beaf0f"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/40bf7f560ca4c2468d518cebf14561bc864f58f8"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/dba5a1f963cf781c0b60f4b7f07465a6c687c27e"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:54Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-73cw-j3wh-rf6g",
|
||||
"modified": "2025-05-08T09:30:24Z",
|
||||
"published": "2025-05-08T09:30:24Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37807"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix kmemleak warning for percpu hashmap\n\nVlad Poenaru reported the following kmemleak issue:\n\n unreferenced object 0x606fd7c44ac8 (size 32):\n backtrace (crc 0):\n pcpu_alloc_noprof+0x730/0xeb0\n bpf_map_alloc_percpu+0x69/0xc0\n prealloc_init+0x9d/0x1b0\n htab_map_alloc+0x363/0x510\n map_create+0x215/0x3a0\n __sys_bpf+0x16b/0x3e0\n __x64_sys_bpf+0x18/0x20\n do_syscall_64+0x7b/0x150\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nFurther investigation shows the reason is due to not 8-byte aligned\nstore of percpu pointer in htab_elem_set_ptr():\n *(void __percpu **)(l->key + key_size) = pptr;\n\nNote that the whole htab_elem alignment is 8 (for x86_64). If the key_size\nis 4, that means pptr is stored in a location which is 4 byte aligned but\nnot 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based\non 8 byte stride, so it won't detect above pptr, hence reporting the memory\nleak.\n\nIn htab_map_alloc(), we already have\n\n htab->elem_size = sizeof(struct htab_elem) +\n round_up(htab->map.key_size, 8);\n if (percpu)\n htab->elem_size += sizeof(void *);\n else\n htab->elem_size += round_up(htab->map.value_size, 8);\n\nSo storing pptr with 8-byte alignment won't cause any problem and can fix\nkmemleak too.\n\nThe issue can be reproduced with bpf selftest as well:\n 1. Enable CONFIG_DEBUG_KMEMLEAK config\n 2. Add a getchar() before skel destroy in test_hash_map() in prog_tests/for_each.c.\n The purpose is to keep map available so kmemleak can be detected.\n 3. run './test_progs -t for_each/hash_map &' and a kmemleak should be reported.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37807"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/11ba7ce076e5903e7bdc1fd1498979c331b3c286"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/1f1c29aa1934177349c17e3c32e68ec38a7a56df"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/7758e308aeda1038aba1944f7302d34161b3effe"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-7mcp-f35c-w4mw",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-1252"
|
||||
],
|
||||
"details": "Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 4.4 before 6.1.2.23.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1252"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.rti.com/vulnerabilities/#cve-2025-1252"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-122"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T09:15:18Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-7wf9-8x5x-fv67",
|
||||
"modified": "2025-05-08T09:30:24Z",
|
||||
"published": "2025-05-08T09:30:24Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37811"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: ci_hdrc_imx: fix usbmisc handling\n\nusbmisc is an optional device property so it is totally valid for the\ncorresponding data->usbmisc_data to have a NULL value.\n\nCheck that before dereferencing the pointer.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace static\nanalysis tool.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37811"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/0ee460498ced49196149197c9f6d29a10e5e0798"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/121e9f80ea5478bca3a8f3f26593fd66f87da649"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2aa87bd825377f5073b76701780a902cd0fc725a"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/4e28f79e3dffa52d327b46d1a78dac16efb5810b"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/8060b719676e8c0e5a2222c2977ba0458d9d9535"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/887902ca73490f38c69fd6149ef361a041cf912f"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:52Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8fxr-4vx8-rh8m",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37830"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()\n\ncpufreq_cpu_get_raw() can return NULL when the target CPU is not present\nin the policy->cpus mask. scmi_cpufreq_get_rate() does not check for\nthis case, which results in a NULL pointer dereference.\n\nAdd NULL check after cpufreq_cpu_get_raw() to prevent this issue.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37830"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/484d3f15cc6cbaa52541d6259778e715b2c83c54"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/4e3d1c1925d8e752992cd893d03d974e6807ac16"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/7ccfadfb2562337b4f0462a86a9746a6eea89718"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/cfaca93b8fe317b7faa9af732e0ba8c9081fa018"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/ea834c90aa7cc80a1b456f7a91432734d5087d16"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/f9c5423855e3687262d881aeee5cfb3bc8577bff"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:54Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-cr4p-cqhr-xjwp",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37826"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()\n\nAdd a NULL check for the returned hwq pointer by ufshcd_mcq_req_to_hwq().\n\nThis is similar to the fix in commit 74736103fb41 (\"scsi: ufs: core: Fix\nufshcd_abort_one racing issue\").",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37826"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/08a966a917fe3d92150fa3cc15793ad5e57051eb"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/700128d67d57bb1de4251e563ab85202def36c50"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/eeab6618037be84e438e9d6ed5d9a53502faf81f"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:53Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-f4v2-fv46-7wx2",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37829"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()\n\ncpufreq_cpu_get_raw() can return NULL when the target CPU is not present\nin the policy->cpus mask. scpi_cpufreq_get_rate() does not check for\nthis case, which results in a NULL pointer dereference.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37829"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/124bddf123311cd1f18bffd63a5d974468d59c67"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/19e0eaa62e8831f2bc0285fef3bf8faaa7f3e09b"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/28fbd7b13b4d3074b16db913aedc9d8d37ab41e7"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/73b24dc731731edf762f9454552cb3a5b7224949"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/8fbaa76690f67a7cbad315f89d607b46e3e06ede"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/ad4796f2da495b2cbbd0fccccbcbf63f2aeee613"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/da8ee91e532486055ecf88478d38c2f3dc234182"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/fdf035d9c5436536ffcfea0ac6adeb5dda3c3a23"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:54Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fg4q-8p94-mj4j",
|
||||
"modified": "2025-05-08T09:30:24Z",
|
||||
"published": "2025-05-08T09:30:23Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37805"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsound/virtio: Fix cancel_sync warnings on uninitialized work_structs\n\nBetty reported hitting the following warning:\n\n[ 8.709131][ T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182\n...\n[ 8.713282][ T221] Call trace:\n[ 8.713365][ T221] __flush_work+0x8d0/0x914\n[ 8.713468][ T221] __cancel_work_sync+0xac/0xfc\n[ 8.713570][ T221] cancel_work_sync+0x24/0x34\n[ 8.713667][ T221] virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[ 8.713868][ T221] virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[ 8.714035][ T221] virtio_dev_probe+0x28c/0x390\n[ 8.714139][ T221] really_probe+0x1bc/0x4c8\n...\n\nIt seems we're hitting the error path in virtsnd_probe(), which\ntriggers a virtsnd_remove() which iterates over the substreams\ncalling cancel_work_sync() on the elapsed_period work_struct.\n\nLooking at the code, from earlier in:\nvirtsnd_probe()->virtsnd_build_devs()->virtsnd_pcm_parse_cfg()\n\nWe set snd->nsubstreams, allocate the snd->substreams, and if\nwe then hit an error on the info allocation or something in\nvirtsnd_ctl_query_info() fails, we will exit without having\ninitialized the elapsed_period work_struct.\n\nWhen that error path unwinds we then call virtsnd_remove()\nwhich as long as the substreams array is allocated, will iterate\nthrough calling cancel_work_sync() on the uninitialized work\nstruct hitting this warning.\n\nTakashi Iwai suggested this fix, which initializes the substreams\nstructure right after allocation, so that if we hit the error\npaths we avoid trying to cleanup uninitialized data.\n\nNote: I have not yet managed to reproduce the issue myself, so\nthis patch has had limited testing.\n\nFeedback or thoughts would be appreciated!",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37805"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3c7df2e27346eb40a0e86230db1ccab195c97cfe"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/54c7b864fbe4423a07b443a4ada0106052942116"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/5be9407b41eae20eef9140f5cfbfcbc3d01aaf45"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/66046b586c0aaa9332483bcdbd76e3305d6138e9"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/9908498ce929a5a052b79bb7942f9ea317312ce4"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/e03b10c45c7675b6098190c6e7de1b656d8bcdbe"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-gr82-7xxj-rqx8",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37823"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too\n\nSimilarly to the previous patch, we need to safe guard hfsc_dequeue()\ntoo. But for this one, we don't have a reliable reproducer.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37823"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/11bccb054c1462fb069219f8e98e97a5a730758e"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2f46d14919c39528c6e540ebc43f90055993eedc"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/68f256305ceb426d545a0dc31f83c2ab1d211a1e"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/6ccbda44e2cc3d26fd22af54c650d6d5d801addf"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/76c4c22c2437d3d3880efc0f62eca06ef078d290"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/c6936266f8bf98a53f28ef9a820e6a501e946d09"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/c6f035044104c6ff656f4565cd22938dc892528c"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/da7936518996d290e2fcfcaf6cd7e15bfd87804a"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-08T07:15:53Z"
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user