CVE-2022-1586

pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.

CVSS 3.1 · 9.1 Critical EPSS 3.4% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 2 more

Products

Debian Linux Fedora Active Iq Unified Manager and 15 more

CVE-2023-31084

kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 5 more

CVE-2023-0045

Incorrect indirect branch prediction barrier in the Linux Kernel

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.  The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96

CVSS 3.1 · 4.7 Medium EPSS 2.4% KEV · Not listed

Vendors

Debian Linux Netapp

Products

Debian Linux Linux Kernel Active Iq Unified Manager and 10 more

CVE-2023-4236

named may terminate unexpectedly under high DNS-over-TLS query load

A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Debian Fedoraproject Isc and 1 more

Products

Debian Linux Fedora Bind and 10 more

CVE-2023-2911

Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0

If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed

Vendors

Debian Fedoraproject Isc and 1 more

Products

Debian Linux Fedora Bind and 11 more

CVE-2023-2829

Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled

A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Isc Netapp

Products

Bind Active Iq Unified Manager H300s and 9 more

CVE-2023-2828

named's configured cache size limit can be significantly exceeded

Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed

Vendors

Debian Fedoraproject Isc and 2 more

Products

Debian Linux Fedora Bind and 16 more

CVE-2023-1295

Privilege escalation with IO_RING_OP_CLOSE in the Linux Kernel

A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300s H410c and 3 more

CVE-2023-35828

kernel: renesas_usb3: race condition leading to use-after-free in renesas_usb3_remove()

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300s H410c and 3 more

CVE-2023-35826

kernel: cedrus: race condition leading to use-after-free in cedrus_remove()

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in cedrus_remove in drivers/staging/media/sunxi/cedrus/cedrus.c.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300s H410c and 3 more

CVE-2023-32252

Session null pointer dereference denial-of-service vulnerability

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s H300s Firmware and 9 more

CVE-2023-32248

Tree connection null pointer dereference denial-of-service vulnerability

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s H410c and 4 more

CVE-2023-2124

kernel: OOB access in the Linux kernel's XFS subsystem

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel H300s and 15 more

CVE-2023-2007

kernel: DPT I2O controller TOCTOU information disclosure vulnerability

The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp

Products

Debian Linux Linux Kernel H300s and 10 more

CVE-2023-28464

Kernel: double free in hci_conn_cleanup of the bluetooth subsystem

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s Firmware H410c Firmware and 4 more

CVE-2022-48502

kernel: ntfs3 subsystem does not properly check for correctness during disk reads

An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300s H410c and 3 more

CVE-2022-45919

kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s H300s Firmware and 11 more

CVE-2022-45886

kernel: use-after-free due to race condition occurring in dvb_net.c

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s H300s Firmware and 11 more

CVE-2022-45884

kernel: use-after-free due to race condition occurring in dvb_register_device()

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s H300s Firmware and 11 more

CVE-2022-3202

Kernel: jfs: Null Pointer Deference in jfs_evict_inode leads to Denial of Service

A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the system or leak kernel internal information.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300s H300s Firmware and 8 more