{
  "affected": [],
  "aliases": [
    "CVE-2021-34911"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-13T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14884.",
  "id": "GHSA-vc8g-ghqr-pr2v",
  "modified": "2022-01-15T00:02:21Z",
  "published": "2022-01-14T00:01:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34911"
    },
    {
      "type": "WEB",
      "url": "https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1500"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-53182"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-27T14:15:25Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()\"\n\nThis reverts commit bc3b1e9e7c50e1de0f573eea3871db61dd4787de.\n\nThe bic is associated with sync_bfqq, and bfq_release_process_ref cannot\nbe put into bfq_put_cooperator.\n\nkasan report:\n[  400.347277] ==================================================================\n[  400.347287] BUG: KASAN: slab-use-after-free in bic_set_bfqq+0x200/0x230\n[  400.347420] Read of size 8 at addr ffff88881cab7d60 by task dockerd/5800\n[  400.347430]\n[  400.347436] CPU: 24 UID: 0 PID: 5800 Comm: dockerd Kdump: loaded Tainted: G E 6.12.0 #32\n[  400.347450] Tainted: [E]=UNSIGNED_MODULE\n[  400.347454] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022\n[  400.347460] Call Trace:\n[  400.347464]  \u003cTASK\u003e\n[  400.347468]  dump_stack_lvl+0x5d/0x80\n[  400.347490]  print_report+0x174/0x505\n[  400.347521]  kasan_report+0xe0/0x160\n[  400.347541]  bic_set_bfqq+0x200/0x230\n[  400.347549]  bfq_bic_update_cgroup+0x419/0x740\n[  400.347560]  bfq_bio_merge+0x133/0x320\n[  400.347584]  blk_mq_submit_bio+0x1761/0x1e20\n[  400.347625]  __submit_bio+0x28b/0x7b0\n[  400.347664]  submit_bio_noacct_nocheck+0x6b2/0xd30\n[  400.347690]  iomap_readahead+0x50c/0x680\n[  400.347731]  read_pages+0x17f/0x9c0\n[  400.347785]  page_cache_ra_unbounded+0x366/0x4a0\n[  400.347795]  filemap_fault+0x83d/0x2340\n[  400.347819]  __xfs_filemap_fault+0x11a/0x7d0 [xfs]\n[  400.349256]  __do_fault+0xf1/0x610\n[  400.349270]  do_fault+0x977/0x11a0\n[  400.349281]  __handle_mm_fault+0x5d1/0x850\n[  400.349314]  handle_mm_fault+0x1f8/0x560\n[  400.349324]  do_user_addr_fault+0x324/0x970\n[  400.349337]  exc_page_fault+0x76/0xf0\n[  400.349350]  asm_exc_page_fault+0x26/0x30\n[  400.349360] RIP: 0033:0x55a480d77375\n[  400.349384] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 ae 02 00 00 55 48 89 e5 48 83 ec 58 48 8b 10 \u003c83\u003e 7a 10 00 0f 84 27 02 00 00 44 0f b6 42 28 44 0f b6 4a 29 41 80\n[  400.349392] RSP: 002b:00007f18c37fd8b8 EFLAGS: 00010216\n[  400.349401] RAX: 00007f18c37fd9d0 RBX: 0000000000000000 RCX: 0000000000000000\n[  400.349407] RDX: 000055a484407d38 RSI: 000000c000e8b0c0 RDI: 0000000000000000\n[  400.349412] RBP: 00007f18c37fd910 R08: 000055a484017f60 R09: 000055a484066f80\n[  400.349417] R10: 0000000000194000 R11: 0000000000000005 R12: 0000000000000008\n[  400.349422] R13: 0000000000000000 R14: 000000c000476a80 R15: 0000000000000000\n[  400.349430]  \u003c/TASK\u003e\n[  400.349452]\n[  400.349454] Allocated by task 5800:\n[  400.349459]  kasan_save_stack+0x30/0x50\n[  400.349469]  kasan_save_track+0x14/0x30\n[  400.349475]  __kasan_slab_alloc+0x89/0x90\n[  400.349482]  kmem_cache_alloc_node_noprof+0xdc/0x2a0\n[  400.349492]  bfq_get_queue+0x1ef/0x1100\n[  400.349502]  __bfq_get_bfqq_handle_split+0x11a/0x510\n[  400.349511]  bfq_insert_requests+0xf55/0x9030\n[  400.349519]  blk_mq_flush_plug_list+0x446/0x14c0\n[  400.349527]  __blk_flush_plug+0x27c/0x4e0\n[  400.349534]  blk_finish_plug+0x52/0xa0\n[  400.349540]  _xfs_buf_ioapply+0x739/0xc30 [xfs]\n[  400.350246]  __xfs_buf_submit+0x1b2/0x640 [xfs]\n[  400.350967]  xfs_buf_read_map+0x306/0xa20 [xfs]\n[  400.351672]  xfs_trans_read_buf_map+0x285/0x7d0 [xfs]\n[  400.352386]  xfs_imap_to_bp+0x107/0x270 [xfs]\n[  400.353077]  xfs_iget+0x70d/0x1eb0 [xfs]\n[  400.353786]  xfs_lookup+0x2ca/0x3a0 [xfs]\n[  400.354506]  xfs_vn_lookup+0x14e/0x1a0 [xfs]\n[  400.355197]  __lookup_slow+0x19c/0x340\n[  400.355204]  lookup_one_unlocked+0xfc/0x120\n[  400.355211]  ovl_lookup_single+0x1b3/0xcf0 [overlay]\n[  400.355255]  ovl_lookup_layer+0x316/0x490 [overlay]\n[  400.355295]  ovl_lookup+0x844/0x1fd0 [overlay]\n[  400.355351]  lookup_one_qstr_excl+0xef/0x150\n[  400.355357]  do_unlinkat+0x22a/0x620\n[  400.355366]  __x64_sys_unlinkat+0x109/0x1e0\n[  400.355375]  do_syscall_64+0x82/0x160\n[  400.355384]  entry_SYSCALL_64_after_hwframe+0x76/0x7\n---truncated---",
  "id": "GHSA-vc8x-p7xj-72gr",
  "modified": "2025-03-06T18:30:59Z",
  "published": "2024-12-27T15:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53182"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7baf94232651f39f7108c23bc9548bff89bdc77b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cf5a60d971c7b59efb89927919404be655a9e35a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-7068"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-09-09T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In PHP versions 7.2.x below 7.3.21, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.",
  "id": "GHSA-vc9g-5348-gqwv",
  "modified": "2022-07-02T00:00:29Z",
  "published": "2022-05-24T17:27:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7068"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=79797"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202009-10"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20200918-0005"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2021/dsa-4856"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/tns-2021-14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-10991"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T23:17:02Z",
    "severity": "HIGH"
  },
  "details": "Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-vc9q-5cjg-hv9j",
  "modified": "2026-06-05T03:31:33Z",
  "published": "2026-06-05T00:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10991"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/503553614"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1679"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-16T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "A use-after-free flaw was found in the Linux kernel\u2019s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
  "id": "GHSA-vcc2-324q-xw5m",
  "modified": "2024-01-19T18:30:22Z",
  "published": "2022-05-17T00:00:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1679"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/lkml/87ilqc7jv9.fsf%40kernel.org/t"
    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/lkml/87ilqc7jv9.fsf@kernel.org/t"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220629-0007"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "nokogiri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "nokogiri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.16.0"
            },
            {
              "fixed": "1.16.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-18T20:38:40Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xc9x-jj77-9p9j. This link is maintained to preserve external references.\n\n# Original Description\n\n### Summary\n\nNokogiri upgrades its dependency libxml2 as follows:\n- v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6\n- v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4\n\nlibxml2 v2.11.7 and v2.12.5 address the following vulnerability:\n\nCVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062\n- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604\n- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri, and only if\nthe packaged libraries are being used. If you\u0027ve overridden defaults at installation time to use\nsystem libraries instead of packaged libraries, you should instead pay attention to your distro\u0027s\nlibxml2 release announcements.\n\nJRuby users are not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as **Moderate**.\n\n### Impact\n\nFrom the CVE description, this issue applies to the `xmlTextReader` module (which underlies\n`Nokogiri::XML::Reader`):\n\n\u003e When using the XML Reader interface with DTD validation and XInclude expansion enabled,\n\u003e processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.\n\n### Mitigation\n\nUpgrade to Nokogiri `~\u003e 1.15.6` or `\u003e= 1.16.2`.\n\nUsers who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile\nand link Nokogiri against patched external libxml2 libraries which will also address these same\nissues.",
  "id": "GHSA-vcc3-rw6f-jv97",
  "modified": "2025-05-23T20:02:12Z",
  "published": "2024-03-18T20:38:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sparklemotion/nokogiri"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader",
  "withdrawn": "2025-05-23T20:02:12Z"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-48912"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-22T02:15:05Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: fix use-after-free in __nf_register_net_hook()\n\nWe must not dereference @new_hooks after nf_hook_mutex has been released,\nbecause other threads might have freed our allocated hooks already.\n\nBUG: KASAN: use-after-free in nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline]\nBUG: KASAN: use-after-free in hooks_validate net/netfilter/core.c:171 [inline]\nBUG: KASAN: use-after-free in __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438\nRead of size 2 at addr ffff88801c1a8000 by task syz-executor237/4430\n\nCPU: 1 PID: 4430 Comm: syz-executor237 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\n nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline]\n hooks_validate net/netfilter/core.c:171 [inline]\n __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438\n nf_register_net_hook+0x114/0x170 net/netfilter/core.c:571\n nf_register_net_hooks+0x59/0xc0 net/netfilter/core.c:587\n nf_synproxy_ipv6_init+0x85/0xe0 net/netfilter/nf_synproxy_core.c:1218\n synproxy_tg6_check+0x30d/0x560 net/ipv6/netfilter/ip6t_SYNPROXY.c:81\n xt_check_target+0x26c/0x9e0 net/netfilter/x_tables.c:1038\n check_target net/ipv6/netfilter/ip6_tables.c:530 [inline]\n find_check_entry.constprop.0+0x7f1/0x9e0 net/ipv6/netfilter/ip6_tables.c:573\n translate_table+0xc8b/0x1750 net/ipv6/netfilter/ip6_tables.c:735\n do_replace net/ipv6/netfilter/ip6_tables.c:1153 [inline]\n do_ip6t_set_ctl+0x56e/0xb90 net/ipv6/netfilter/ip6_tables.c:1639\n nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101\n ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1024\n rawv6_setsockopt+0xd3/0x6a0 net/ipv6/raw.c:1084\n __sys_setsockopt+0x2db/0x610 net/socket.c:2180\n __do_sys_setsockopt net/socket.c:2191 [inline]\n __se_sys_setsockopt net/socket.c:2188 [inline]\n __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f65a1ace7d9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f65a1a7f308 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f65a1ace7d9\nRDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003\nRBP: 00007f65a1b574c8 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000020000000 R11: 0000000000000246 R12: 00007f65a1b55130\nR13: 00007f65a1b574c0 R14: 00007f65a1b24090 R15: 0000000000022000\n \u003c/TASK\u003e\n\nThe buggy address belongs to the page:\npage:ffffea0000706a00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c1a8\nflags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)\nraw: 00fff00000000000 ffffea0001c1b108 ffffea000046dd08 0000000000000000\nraw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\npage_owner tracks the page as freed\npage last allocated via order 2, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 4430, ts 1061781545818, free_ts 1061791488993\n prep_new_page mm/page_alloc.c:2434 [inline]\n get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165\n __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389\n __alloc_pages_node include/linux/gfp.h:572 [inline]\n alloc_pages_node include/linux/gfp.h:595 [inline]\n kmalloc_large_node+0x62/0x130 mm/slub.c:4438\n __kmalloc_node+0x35a/0x4a0 mm/slub.\n---truncated---",
  "id": "GHSA-vcfw-6vgj-6mgp",
  "modified": "2024-08-27T18:31:35Z",
  "published": "2024-08-22T03:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48912"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/05f7927b25d2635e87267ff6c79db79fb46cf313"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/49c24579cec41e32f13d57b337fd28fb208d4a5b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/56763f12b0f02706576a088e85ef856deacc98a0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a8076e98dde17224dd47283b894a8b1dbe1bc72"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8b0142c4143c1ca297dcf2c0cdd045d65dae2344"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd61f192a339b1095dfd6d56073a5265934c2979"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bdd8fc1b826e6f23963f5bef3f7431c6188ec954"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-49695"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:44Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: fix a use-after-free issue in igb_clean_tx_ring\n\nFix the following use-after-free bug in igb_clean_tx_ring routine when\nthe NIC is running in XDP mode. The issue can be triggered redirecting\ntraffic into the igb NIC and then closing the device while the traffic\nis flowing.\n\n[   73.322719] CPU: 1 PID: 487 Comm: xdp_redirect Not tainted 5.18.3-apu2 #9\n[   73.330639] Hardware name: PC Engines APU2/APU2, BIOS 4.0.7 02/28/2017\n[   73.337434] RIP: 0010:refcount_warn_saturate+0xa7/0xf0\n[   73.362283] RSP: 0018:ffffc9000081f798 EFLAGS: 00010282\n[   73.367761] RAX: 0000000000000000 RBX: ffffc90000420f80 RCX: 0000000000000000\n[   73.375200] RDX: ffff88811ad22d00 RSI: ffff88811ad171e0 RDI: ffff88811ad171e0\n[   73.382590] RBP: 0000000000000900 R08: ffffffff82298f28 R09: 0000000000000058\n[   73.390008] R10: 0000000000000219 R11: ffffffff82280f40 R12: 0000000000000090\n[   73.397356] R13: ffff888102343a40 R14: ffff88810359e0e4 R15: 0000000000000000\n[   73.404806] FS:  00007ff38d31d740(0000) GS:ffff88811ad00000(0000) knlGS:0000000000000000\n[   73.413129] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   73.419096] CR2: 000055cff35f13f8 CR3: 0000000106391000 CR4: 00000000000406e0\n[   73.426565] Call Trace:\n[   73.429087]  \u003cTASK\u003e\n[   73.431314]  igb_clean_tx_ring+0x43/0x140 [igb]\n[   73.436002]  igb_down+0x1d7/0x220 [igb]\n[   73.439974]  __igb_close+0x3c/0x120 [igb]\n[   73.444118]  igb_xdp+0x10c/0x150 [igb]\n[   73.447983]  ? igb_pci_sriov_configure+0x70/0x70 [igb]\n[   73.453362]  dev_xdp_install+0xda/0x110\n[   73.457371]  dev_xdp_attach+0x1da/0x550\n[   73.461369]  do_setlink+0xfd0/0x10f0\n[   73.465166]  ? __nla_validate_parse+0x89/0xc70\n[   73.469714]  rtnl_setlink+0x11a/0x1e0\n[   73.473547]  rtnetlink_rcv_msg+0x145/0x3d0\n[   73.477709]  ? rtnl_calcit.isra.0+0x130/0x130\n[   73.482258]  netlink_rcv_skb+0x8d/0x110\n[   73.486229]  netlink_unicast+0x230/0x340\n[   73.490317]  netlink_sendmsg+0x215/0x470\n[   73.494395]  __sys_sendto+0x179/0x190\n[   73.498268]  ? move_addr_to_user+0x37/0x70\n[   73.502547]  ? __sys_getsockname+0x84/0xe0\n[   73.506853]  ? netlink_setsockopt+0x1c1/0x4a0\n[   73.511349]  ? __sys_setsockopt+0xc8/0x1d0\n[   73.515636]  __x64_sys_sendto+0x20/0x30\n[   73.519603]  do_syscall_64+0x3b/0x80\n[   73.523399]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   73.528712] RIP: 0033:0x7ff38d41f20c\n[   73.551866] RSP: 002b:00007fff3b945a68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\n[   73.559640] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff38d41f20c\n[   73.567066] RDX: 0000000000000034 RSI: 00007fff3b945b30 RDI: 0000000000000003\n[   73.574457] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000\n[   73.581852] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff3b945ab0\n[   73.589179] R13: 0000000000000000 R14: 0000000000000003 R15: 00007fff3b945b30\n[   73.596545]  \u003c/TASK\u003e\n[   73.598842] ---[ end trace 0000000000000000 ]---",
  "id": "GHSA-vcgf-2jcf-5569",
  "modified": "2025-02-27T21:32:15Z",
  "published": "2025-02-27T21:32:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49695"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2af944210dc23d43d8208dafac4df7be7e3c168b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3f6a57ee8544ec3982f8a3cbcbf4aea7d47eb9ec"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/68a0ed06dcd5d3ea732d011c0b83d66e4791f521"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c12a2c9b1b460ed72e6b3c33aac1ef51b0329b66"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-33029"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-03T06:15:27Z",
    "severity": "HIGH"
  },
  "details": "Memory corruption in DSP Service during a remote call from HLOS to DSP.",
  "id": "GHSA-vchp-mc49-g36w",
  "modified": "2024-04-04T08:03:26Z",
  "published": "2023-10-03T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33029"
    },
    {
      "type": "WEB",
      "url": "https://www.qualcomm.com/company/product-security/bulletins/october-2023-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-22083"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-16T15:16:02Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint\n\nIf vhost_scsi_set_endpoint is called multiple times without a\nvhost_scsi_clear_endpoint between them, we can hit multiple bugs\nfound by Haoran Zhang:\n\n1. Use-after-free when no tpgs are found:\n\nThis fixes a use after free that occurs when vhost_scsi_set_endpoint is\ncalled more than once and calls after the first call do not find any\ntpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds\ntpgs to add to the vs_tpg array match=true, so we will do:\n\nvhost_vq_set_backend(vq, vs_tpg);\n...\n\nkfree(vs-\u003evs_tpg);\nvs-\u003evs_tpg = vs_tpg;\n\nIf vhost_scsi_set_endpoint is called again and no tpgs are found\nmatch=false so we skip the vhost_vq_set_backend call leaving the\npointer to the vs_tpg we then free via:\n\nkfree(vs-\u003evs_tpg);\nvs-\u003evs_tpg = vs_tpg;\n\nIf a scsi request is then sent we do:\n\nvhost_scsi_handle_vq -\u003e vhost_scsi_get_req -\u003e vhost_vq_get_backend\n\nwhich sees the vs_tpg we just did a kfree on.\n\n2. Tpg dir removal hang:\n\nThis patch fixes an issue where we cannot remove a LIO/target layer\ntpg (and structs above it like the target) dir due to the refcount\ndropping to -1.\n\nThe problem is that if vhost_scsi_set_endpoint detects a tpg is already\nin the vs-\u003evs_tpg array or if the tpg has been removed so\ntarget_depend_item fails, the undepend goto handler will do\ntarget_undepend_item on all tpgs in the vs_tpg array dropping their\nrefcount to 0. At this time vs_tpg contains both the tpgs we have added\nin the current vhost_scsi_set_endpoint call as well as tpgs we added in\nprevious calls which are also in vs-\u003evs_tpg.\n\nLater, when vhost_scsi_clear_endpoint runs it will do\ntarget_undepend_item on all the tpgs in the vs-\u003evs_tpg which will drop\ntheir refcount to -1. Userspace will then not be able to remove the tpg\nand will hang when it tries to do rmdir on the tpg dir.\n\n3. Tpg leak:\n\nThis fixes a bug where we can leak tpgs and cause them to be\nun-removable because the target name is overwritten when\nvhost_scsi_set_endpoint is called multiple times but with different\ntarget names.\n\nThe bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup\na vhost-scsi device to target/tpg mapping, then calls\nVHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we\nhaven\u0027t seen before (target1 has tpg1 but target2 has tpg2). When this\nhappens we don\u0027t teardown the old target tpg mapping and just overwrite\nthe target name and the vs-\u003evs_tpg array. Later when we do\nvhost_scsi_clear_endpoint, we are passed in either target1 or target2\u0027s\nname and we will only match that target\u0027s tpgs when we loop over the\nvs-\u003evs_tpg. We will then return from the function without doing\ntarget_undepend_item on the tpgs.\n\nBecause of all these bugs, it looks like being able to call\nvhost_scsi_set_endpoint multiple times was never supported. The major\nuser, QEMU, already has checks to prevent this use case. So to fix the\nissues, this patch prevents vhost_scsi_set_endpoint from being called\nif it\u0027s already successfully added tpgs. To add, remove or change the\ntpg config or target name, you must do a vhost_scsi_clear_endpoint\nfirst.",
  "id": "GHSA-vcjc-q999-g4p2",
  "modified": "2026-07-14T15:31:21Z",
  "published": "2025-04-16T15:34:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22083"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b34bdc42df047794542f3e220fe989124e4499a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3a19eb3d9818e28f14c818a18dc913344a52ca92"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3fd054baf382a426bbf5135ede0fc5673db74d3e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/451c72f5e7cf5d339a6410a635cee0825687c3dc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}