Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-25 01:12Z
2024-05-21
2024-05-21 15:15Z
HIGH

CVE-2021-47390 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix stack-out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47390

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() KASAN reports the following issue: BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm] Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798 CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G X --------- --- Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 13/07/2020 CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

CWECWE 125TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-05-21
2024-05-21 15:15Z
HIGH

CVE-2021-47388 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47388

In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame"). Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to r CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-05-21
2024-05-21 15:15Z
HIGH

CVE-2021-47352 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: virtio-net: Add validation for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47352

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Add validation for used length This adds validation for used length (might come from an untrusted device) to avoid data corruption or loss. CVSSv3.1 8.4 (HIGH) · EPSS 18th percentile

CWECWE 787TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-05-21
2024-05-21 15:15Z
CRIT

CVE-2021-47328 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47328

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn use after free during resets If we haven't done a unbind target call we can race where iscsi_conn_teardown wakes up the EH thread and then frees the conn while those threads are still accessing the conn ehwait. We can only do one TMF per session so this just moves the TMF fields from the conn to the session. We can then rely on the iscsi_session_teardown->iscsi_remove_session->__iscsi CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-05-21
2024-05-21 15:15Z
HIGH

CVE-2021-47308 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix array

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47308

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix array index out of bound exception Fix array index out of bound exception in fc_rport_prli_resp(). CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile

CWECWE 125TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-05-21
2024-05-21 15:15Z
HIGH

CVE-2021-47245 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: Fix out

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47245

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: Fix out of bounds when parsing TCP options The TCP option parser in synproxy (synproxy_parse_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 ("ipv CVSSv3.1 8.2 (HIGH) · EPSS 18th percentile

CWECWE 125TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-05-21
2024-05-21 15:15Z
HIGH

CVE-2021-47244 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47244

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of bounds when parsing TCP options The TCP option parser in mptcp (mptcp_get_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stac CVSSv3.1 8.2 (HIGH) · EPSS 19th percentile

CWECWE 125TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-05-21
2024-05-21 15:15Z
HIGH

CVE-2021-47240 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47240

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtr_endpoint_post Syzbot reported slab-out-of-bounds Read in qrtr_endpoint_post. The problem was in wrong _size_ type: if (len != ALIGN(size, 4) + hdrlen) goto err; If size from qrtr_hdr is 4294967293 (0xfffffffd), the result of ALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293 in header this check won't fail and skb_put_data(skb, data + hdrlen, siz CVSSv3.1 8.4 (HIGH) · EPSS 14th percentile

CWECWE 125TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-05-21
2024-05-21 15:15Z
CRIT

CVE-2021-47232 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47232

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free, hold skb ref while in use This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to a Use-after-Free if the skb is taken concurrently from the session queue due to a CTS. CVSSv3.1 9.8 (CRITICAL) · EPSS 15th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-05-21
2024-05-21 07:15Z
CRIT

CVE-2024-4442 — Salonbookingsystem Salon_booking_system: The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4442

The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. This was partially patched in 9.9, and sufficiently patched in 10.0. C CVSSv3.1 9.1 (CRITICAL) · EPSS 97th percentile

CWECWE 22VNDSalonbookingsystemVNDSalonTYPVulnerability
9.1
CVSS v3.1
100
Edit Score
2024-05-20
2024-05-20 10:15Z
HIGH

CVE-2024-35987 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: riscv: Fix loading 64-bit

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35987

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix loading 64-bit NOMMU kernels past the start of RAM commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") added logic to allow using RAM below the kernel load address. However, this does not work for NOMMU, where PAGE_OFFSET is fixed to the kernel load address. Since that range of memory corresponds to PFNs below ARCH_PFN_OFFSET, mm initialization runs off the beginning of me CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-05-20
2024-05-20 10:15Z
HIGH

CVE-2024-35980 — Linux Linux_kernel: It leads to crash on the destination VM after live migration because TLBs aren't

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35980

In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Fix TLBI RANGE operand KVM/arm64 relies on TLBI RANGE feature to flush TLBs when the dirty pages are collected by VMM and the page table entries become write protected during live migration. Unfortunately, the operand passed to the TLBI RANGE instruction isn't correctly sorted out due to the commit 117940aa6e5f ("KVM: arm64: Define kvm_tlb_flush_vmid_range()"). It leads to crash on the destinati CVSSv3.1 8.4 (HIGH)

CWECWE 191TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-05-20
2024-05-20 10:15Z
HIGH

CVE-2024-35969 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happe CVSSv3.1 8.8 (HIGH) · EPSS 1th percentile

CWECWE 770TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-05-20
2024-05-20 10:15Z
CRIT

CVE-2024-35960 — Linux Linux_kernel: These two behaviors can result in a situation where create_flow_handle 1) creates a new

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35960

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, create_flow_handle tries hard to find and reference already existing identical rules instead of creating new ones. These two behaviors can result in a situation where create_flow_handle 1) creates a new rule and referen CVSSv3.1 9.1 (CRITICAL) · EPSS 83th percentile

CWECWE 476TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-05-20
2024-05-20 10:15Z
HIGH

CVE-2024-35955 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35955

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-05-19
2024-05-19 11:15Z
CRIT

CVE-2024-35939 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35939

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dma_set_decrypted() failure On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. DMA could CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2024-05-19
2024-05-19 11:15Z
HIGH

CVE-2024-35937 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35937

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to discard later. Make this a bit more careful and check if the subframe header can even be present. CVSSv3.1 8.1 (HIGH)

CWECWE 125TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-05-19
2024-05-19 09:15Z
HIGH

CVE-2024-35915 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35915

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be sil CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

CWECWE 908TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-05-19
2024-05-19 09:15Z
HIGH

CVE-2024-35889 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35889

In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic on unknown packet types In the very rare case where a packet type is unknown to the driver, idpf_rx_process_skb_fields would return early without calling eth_type_trans to set the skb protocol / the network layer handler. This is especially problematic if tcpdump is running when such a packet is received, i.e. it would cause a kernel panic. Instead, call eth_type_trans for every sing CVSSv3.1 8.6 (HIGH)

TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2024-05-19
2024-05-19 09:15Z
HIGH

CVE-2024-35887 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35887

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25_ds_del_timer When the ax25 device is detaching, the ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer. When the timer handler is running, the ax25_ds_del_timer() that calls del_timer() in it will return directly. As a result, the use-after-free bugs could happen, one of the scenarios is shown below: (Thread 1) | (Thr CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-05-19
2024-05-19 09:15Z
CRIT

CVE-2024-35884 — Linux Linux_kernel: In such cases the packets will be GROed at the UDP level, which leads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35884

In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in a tunnel When rx-udp-gro-forwarding is enabled UDP packets might be GROed when being forwarded. If such packets might land in a tunnel this can cause various issues and udp_gro_receive makes sure this isn't the case by looking for a matching socket. This is performed in udp4/6_gro_lookup_skb but only in the current netns. This is an issue with tunneled packe CVSSv3.1 9.8 (CRITICAL) · EPSS 3th percentile

CWECWE 617TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-05-19
2024-05-19 09:15Z
HIGH

CVE-2024-35875 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35875

In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted and may actively work against guests to extract secrets or manipulate computation. Since a malicious host can modify or observe nearly all inputs to guests, the only remaining source CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-05-19
2024-05-19 09:15Z
CRIT

CVE-2024-35870 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35870

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_reconnect_server() The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs_put_smb_ses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->ses_status again to something different than SES_EXITING. To fix this, we need CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-05-19
2024-05-19 09:15Z
CRIT

CVE-2024-35869 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35869

In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at it, too. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-05-19
2024-05-19 09:15Z
CRIT

CVE-2024-35865 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35865

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. CVSSv3.1 9.8 (CRITICAL) · EPSS 1th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score