| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused |
| In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bnep: Fix UAF read of dev->name
bnep_add_connection() needs to keep holding the bnep_session_sem while
reading dev->name (just like bnep_get_connlist() does); otherwise the
bnep_session() thread can concurrently free the net_device, which can for
example be triggered by a concurrent bnep_del_connection().
(This UAF is fairly uninteresting from a security perspective;
calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN)
check. It also requires completely tearing down a netdev during a fairly
tight race window.) |
| In the Linux kernel, the following vulnerability has been resolved:
net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
The memory allocated in ipc_protocol_init() is not freed on the error
paths that follow in ipc_imem_init(). Fix that by calling the
corresponding release function ipc_protocol_deinit() in the error path. |
| In the Linux kernel, the following vulnerability has been resolved:
mm/memory_hotplug: fix memory block reference leak on remove
Patch series "mm: Fix memory block leaks and locking", v2.
This series fixes two memory block device reference leaks and one locking
issue around the per-memory_block hwpoison counter.
This patch (of 2):
remove_memory_blocks_and_altmaps() looks up each memory block with
find_memory_block(), which acquires a reference to the memory block
device.
That reference is never dropped on this path, resulting in a leaked device
reference when removing memory blocks and their altmaps. Drop the
reference after retrieving mem->altmap and clearing mem->altmap, before
removing the memory block device. |
| Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges. |
| A flaw was found in Red Hat Quay's repository-level mirror configuration
feature. The POST and PUT handlers in endpoints/api/mirror.py accept an
external_reference parameter without SSRF validation, unlike the
organization-level mirror handlers which apply validate_external_registry_url().
A repository administrator can supply a crafted hostname that causes the Quay
mirror worker to make requests via Skopeo to internal network services, cloud
metadata endpoints, or other resources not intended to be reachable from the
Quay application. |
| Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication. |
| AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
------
Summary: Out-of-Bounds Write and Information Disclosure via Unvalidated
IPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to
trust an inflated `ipv6_plen` larger than the actual received payload,
leading to MTU-bounded out-of-bounds reads and a potential one-byte
out-of-bounds write that may disclose data beyond the valid packet boundary.
Requirements to exploit: Adjacent-network access on the same L2 segment as
a system running `iscsiuio` on an interface that processes IPv6/NDP
traffic, plus the ability to send a crafted ICMPv6 Echo Request with a
forged `IPv6.plen`. No authentication or user interaction is required.
Component affected: `iscsi-initiator-utils` (`iscsiuio`):
`iscsiuio/src/uip/ipv6.c` in `ipv6_icmp_handle_echo_request()` and
`ipv6_insert_protocol_chksum()`.
Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` when
`iscsiuio` is processing IPv6/NDP traffic on a reachable interface.
Patch available: no released package fix established; proposed patch
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - 6.3 (MEDIUM)
AV:A - Reachability is limited to an attacker on the same L2 segment who
can send crafted IPv6/ICMPv6 traffic to the affected interface.
AC:L - The attack relies on forging `IPv6.plen`; no race or unusual
environment is needed beyond the vulnerable deployment.
PR:N - No privileges are required.
UI:N - No user interaction is required.
S:U - The impact remains within the `iscsiuio` process and its packet
buffer handling.
C:L - The reply/checksum path can read and potentially transmit data
beyond the valid packet boundary, but the demonstrated exposure is
MTU-bounded.
I:L - For odd forged lengths, the checksum path can write a single
padding byte past the valid protocol data, which may affect adjacent buffer
contents.
A:L - Invalid memory access may destabilize or crash the process, but
reliable high-impact denial of service is not established from the
available evidence.
Impact: Moderate. Under Red Hat's severity guidance, this is more
consistent with a flaw that can affect confidentiality, integrity, or
availability under constrained circumstances than with an Important issue.
The bug is unauthenticated and adjacent-network reachable, but the
currently supported outcome is MTU-bounded out-of-bounds access in a
deployment-dependent IPv6/NDP path, not easy remote system compromise or
clearly high-impact memory corruption.
Embargo: no
Reason: The currently supported impact is Moderate, exposure depends on
`iscsiuio` processing IPv6 traffic on a reachable L2 segment, and operators
can reduce exposure operationally by isolating or disabling the affected
path.
Acknowledgement: Aisle Research
Vulnerability Details: In the ICMPv6 echo-reply path, the code reuses the
inbound `ipv6_plen` field when sizing the reply instead of clamping it to
the bytes actually received:
```c
/* iscsiuio/src/uip/ipv6.c */
static void ipv6_icmp_handle_echo_request(struct ipv6_context *context)
{
...
ipv6_send(context, (u8_t *) icmp - (u8_t *) eth +
sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6->ipv6_plen));
}
```
Later, checksum generation also trusts `ipv6_plen` for memory traversal,
and for odd lengths it writes a padding byte at `ptr + protocol_data_len`
before iterating over `protocol_data_len` bytes:
```c
/* iscsiuio/src/uip/ipv6.c */
protocol_data_len = HOST_TO_NET16(ipv6->ipv6_plen);
...
if (protocol_data_len & 1) {
*((u8_t *) ptr + protocol_data_len) = 0;
protocol_data_len++;
}
for (i = 0; i < protocol_data_len / 2; i++) {
sum += HOST_TO_NET16(*ptr);
ptr++;
}
```
The available receive-side logic does not establish a payload-length bound
strong enough to eliminate this condition. `uip_input()` compares the IPv6
payload length against `uip_len`, but `uip_len` is treated as full frame
length in the observed path rather than the actual IPv6 payload length, and
`ipv6_rx_packet()` receives a `len` argument without using it to bound
parsing. A forged `ipv6_plen` can therefore exceed the real IPv6 payload
stored in the buffer. The available evidence supports MTU-bounded
out-of-bounds access in normal receive paths rather than the earlier
arbitrary 64KB worst case. The affected logic appears to be present in the
available 6.2.1.11 code base, but this report is scoped to the scanned SRPM
package.
Steps to reproduce:
1. Build `iscsiuio` with ASAN enabled.
2. Run `iscsiuio` with IPv6/NDP active on a test interface.
3. From the same L2 segment, send an ICMPv6 Echo Request with `IPv6.plen`
set larger than the actual payload bytes in the frame buffer; one tested
shape is `plen=1491` with an Ethernet frame size near 1500 bytes.
4. Observe the reply path: ASAN reports invalid access in
`ipv6_insert_protocol_chksum()` as the checksum walk reads past valid
packet data, odd lengths may also trigger a one-byte write, and reply
sizing is derived from the forged `ipv6_plen` rather than the actual
received payload size.
Mitigation: Until a fix is available, keep `iscsiuio`-managed interfaces on
trusted L2 segments only. Where operationally acceptable, disable IPv6 on
those interfaces or filter ICMPv6 Echo Requests before they reach
`iscsiuio`. If `iscsiuio` is not processing IPv6/NDP traffic, this specific
path is not reachable.
Proposed Fix: Clamp the reply payload length to the actual received payload
derived from `context->ustack->uip_len`, reject packets too short to
contain a complete ICMPv6 header, and rewrite `ipv6->ipv6_plen` before
calling `ipv6_send()`.
```diff
diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c
@@ -1100,6 +1100,8 @@ static void ipv6_icmp_handle_echo_request(struct
ipv6_context *context)
{
struct eth_hdr *eth =
(struct eth_hdr *)context->ustack->data_link_layer;
+u16_t rx_total, rx_payload, hdr_plen, safe_plen;
+u16_t l2_l3_len = sizeof(struct eth_hdr) + sizeof(struct ipv6_hdr);
struct ipv6_hdr *ipv6 =
(struct ipv6_hdr *)context->ustack->network_layer;
struct icmpv6_hdr *icmp = (struct icmpv6_hdr *)((u8_t *)ipv6 +
@@ -1126,8 +1128,20 @@ static void ipv6_icmp_handle_echo_request(struct
ipv6_context *context)
icmp->icmpv6_code = 0;
icmp->icmpv6_cksum = 0;
ILOG_DEBUG("IPv6: Send echo reply");
-ipv6_send(context, (u8_t *) icmp - (u8_t *) eth +
sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6>ipv6_plen));
+
+rx_total = context->ustack->uip_len;
+if (rx_total <= l2_l3_len)
+return;
+
+rx_payload = rx_total - l2_l3_len;
+hdr_plen = HOST_TO_NET16(ipv6->ipv6_plen);
+safe_plen = (hdr_plen <= rx_payload) ? hdr_plen : rx_payload;
+if (safe_plen < sizeof(struct icmpv6_hdr))
+return;
+
+ipv6->ipv6_plen = HOST_TO_NET16(safe_plen);
+ipv6_send(context, l2_l3_len + safe_plen);
+
return;
}
```
------
This report was generated using AI technology. Always review AI-generated
content prior to use |
| AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
------
Summary: Stack Buffer Overflow in idbm_recinfo_config via Malicious iSCSI
Target: a crafted SendTargets TargetName can inject an extra configuration
line into a persisted node record and later cause a stack buffer overflow
when that record is reparsed.
Requirements to exploit: An attacker must control an iSCSI target or tamper
with SendTargets discovery traffic, return a crafted `TargetName`
containing a newline and oversized injected key or value data, have the
victim run persistent discovery, and then trigger a later node-record read
such as update or login.
Component affected: `iscsi-initiator-utils`;
`usr/idbm.c:idbm_recinfo_config`, with attacker-controlled input reaching
it through SendTargets handling in `usr/discovery.c` and later record
serialization in `usr/idbm.c`.
Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10`
Patch available: no released package fix established; proposed patch
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - 7.5 (HIGH)
AV:N - The attacker can supply the malicious data over the network in a
SendTargets discovery response.
AC:L - The target-name length cap still leaves enough room for a newline
plus an overlong injected key; no race or unusual memory state is required.
PR:N - No prior access to the initiator is required.
UI:R - The victim must run SendTargets discovery that persists records
and later read the saved record.
S:U - The impact remains within the initiator-side component that parses
and stores its own database records.
C:L - Memory corruption could expose limited process memory, but
confidentiality impact is not demonstrated.
I:L - Process memory corruption can affect integrity, but reliable code
execution is not established.
A:H - The clearest supported outcome is a crash during config parsing.
Impact: Moderate. This issue could otherwise resemble an Important remote
denial-of-service flaw, but Red Hat rates such issues lower when they are
less easily exploited or depend on narrower conditions. Here, exploitation
requires a multi-step SendTargets discovery workflow, persistence of the
discovered record, and a later reread of that record. The strongest
supported outcome is denial of service or other memory corruption, while
code execution remains unproven.
Embargo: no
Reason: The available evidence supports a multi-step,
configuration-dependent denial-of-service or memory-corruption issue rather
than a demonstrated remote code execution flaw, so embargoed handling does
not appear necessary.
Acknowledgement: Aisle Research
Vulnerability Details: `idbm_recinfo_config()` copies config keys and
values into fixed stack buffers without bounds checks:
```c
while (*nl && !isspace(c = *nl) && *nl != '=') {
*(name+i) = *nl; i+; nl+;
}
...
while (*nl) {
*(value+i) = *nl; i+; nl+;
}
```
In this code path, `name` and `value` are 128-byte and 256-byte stack
buffers, so an injected key longer than 128 bytes or a value longer than
256 bytes can corrupt stack memory.
During SendTargets discovery, attacker-controlled `TargetName` text is
copied into the node record and later written back to disk without
control-character filtering:
```c
strlcpy(rec->name, targetname, TARGET_NAME_MAXLEN);
...
if (strlen(info[i].value))
fprintf(f, "%s = %s\n", info[i].name, info[i].value);
```
`process_sendtargets_response()` treats `TargetName=` records as discovery
input, and `add_target_record()` accepts names up to `TARGET_NAME_MAXLEN`.
That limit is 255 bytes in this package, which is still enough to carry a
newline plus a key longer than the 128-byte `name` buffer. A `TargetName`
such as `iqn.test\nAAAA...=B` can therefore split the serialized
`node.name` entry into two lines and inject a second config line.
Persistent SendTargets discovery stores discovered node records unless
nonpersistent mode is used, and later discovery update/login or explicit
node operations reread those saved records. The 2048-byte line buffer in
`idbm_recinfo_config()` does not prevent this because the injected line
only needs to exceed 128 bytes for the key or 256 bytes for the value.
Based on the available evidence, the supported impact is a crash or other
memory corruption during reparsing. Reliable code execution is plausible
but not established.
Steps to reproduce:
1. Run a malicious SendTargets responder, or intercept discovery traffic,
and return a `TargetName` value containing a newline and an oversized
injected key, for example `TargetName=iqn.test\nAAAAAAAA...(>=129 chars)=B`.
2. Run SendTargets discovery in its normal persistent mode. The default
`iscsiadm -m discovery ...` workflow persists records unless nonpersistent
mode is selected.
3. Inspect the saved node record and confirm that it contains both the
expected `node.name = ...` line and an injected `AAAA...=B` line.
4. Trigger any operation that rereads the node record, such as discovery
update, node update, or login.
5. Observe a crash during parsing. With instrumentation enabled, the
overflow should be reported in `idbm_recinfo_config()`.
Mitigation: Until a fix is available, avoid persistent SendTargets
discovery against untrusted or interceptable networks. Where operationally
acceptable, use nonpersistent discovery, and remove node records created
from untrusted discovery results before later update or login operations.
Proposed Fix: The fix should address both parts of the chain: bound the key
and value copies in `idbm_recinfo_config()` and reject control characters
in `TargetName` before persistence.
```diff
diff --git a/usr/idbm.c b/usr/idbm.c
@@ void idbm_recinfo_config(recinfo_t *info, FILE *f)
while (*nl && !isspace(c = *nl) && *nl != '=') {
*(name+i) = *nl; i+; nl+;
}
+ while (*nl && !isspace(c = *nl) && *nl != '=') {
+ if (i >= NAME_MAXVAL - 1) {
+ log_warning("Config file line %d key too long",
line_number);
+ break;
+ }
+ name[i++] = *nl++;
+ }
@@
while (*nl) {
*(value+i) = *nl; i+; nl+;
}
+ while (*nl) {
+ if (i >= VALUE_MAXVAL - 1) {
+ log_warning("Config file line %d value too long",
line_number);
+ break;
+ }
+ value[i++] = *nl++;
+ }
diff --git a/usr/discovery.c b/usr/discovery.c
@@ static int add_target_record(char *name, char *end, discovery_rec_t
*drec,
while ((nul < end) && (*nul != '\0'))
nul++;
+ for (char *p = name; p < nul; p++) {
+ if (*p == '\n' || *p == '\r' || (unsigned char)*p < 0x20) {
+ log_error("TargetName contains control characters,
rejecting");
+ return 0;
+ }
+ }
```
------
This report was generated using AI technology. Always review AI-generated
content prior to use |
| A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system. |
| A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running. |
| A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing. |
| Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance. |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. |
| Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. |
| A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution. |
| Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network. |
| A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system. |
