Common Weakness Enumeration

CWE-401

Allowed

Missing Release of Memory after Effective Lifetime

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

2014 vulnerabilities reference this CWE, most recent first.

GHSA-936G-6JG3-MGP5

Vulnerability from github – Published: 2024-11-07 12:30 – Updated: 2024-11-22 21:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve param->string when parsing mount options

In bpf_parse_param(), keep the value of param->string intact so it can be freed later. Otherwise, the kmalloc area pointed to by param->string will be leaked as shown below:

unreferenced object 0xffff888118c46d20 (size 8): comm "new_name", pid 12109, jiffies 4295580214 hex dump (first 8 bytes): 61 6e 79 00 38 c9 5c 7e any.8.\~ backtrace (crc e1b7f876): [<00000000c6848ac7>] kmemleak_alloc+0x4b/0x80 [<00000000de9f7d00>] __kmalloc_node_track_caller_noprof+0x36e/0x4a0 [<000000003e29b886>] memdup_user+0x32/0xa0 [<0000000007248326>] strndup_user+0x46/0x60 [<0000000035b3dd29>] __x64_sys_fsconfig+0x368/0x3d0 [<0000000018657927>] x64_sys_call+0xff/0x9f0 [<00000000c0cabc95>] do_syscall_64+0x3b/0xc0 [<000000002f331597>] entry_SYSCALL_64_after_hwframe+0x4b/0x53

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-50165"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-07T10:15:07Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve param-\u003estring when parsing mount options\n\nIn bpf_parse_param(), keep the value of param-\u003estring intact so it can\nbe freed later. Otherwise, the kmalloc area pointed to by param-\u003estring\nwill be leaked as shown below:\n\nunreferenced object 0xffff888118c46d20 (size 8):\n  comm \"new_name\", pid 12109, jiffies 4295580214\n  hex dump (first 8 bytes):\n    61 6e 79 00 38 c9 5c 7e                          any.8.\\~\n  backtrace (crc e1b7f876):\n    [\u003c00000000c6848ac7\u003e] kmemleak_alloc+0x4b/0x80\n    [\u003c00000000de9f7d00\u003e] __kmalloc_node_track_caller_noprof+0x36e/0x4a0\n    [\u003c000000003e29b886\u003e] memdup_user+0x32/0xa0\n    [\u003c0000000007248326\u003e] strndup_user+0x46/0x60\n    [\u003c0000000035b3dd29\u003e] __x64_sys_fsconfig+0x368/0x3d0\n    [\u003c0000000018657927\u003e] x64_sys_call+0xff/0x9f0\n    [\u003c00000000c0cabc95\u003e] do_syscall_64+0x3b/0xc0\n    [\u003c000000002f331597\u003e] entry_SYSCALL_64_after_hwframe+0x4b/0x53",
  "id": "GHSA-936g-6jg3-mgp5",
  "modified": "2024-11-22T21:32:12Z",
  "published": "2024-11-07T12:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50165"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1f97c03f43fadc407de5b5cb01c07755053e1c22"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5d7a0a426540319327309035509cb768a2f5c2c4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-938G-XVPF-6653

Vulnerability from github – Published: 2024-07-11 18:31 – Updated: 2025-09-04 03:30
VLAI
Details

A Missing Release of Memory after Effective Lifetime vulnerability in the rtlogd process of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, adjacent attacker to trigger internal events cause ( which can be done by repeated port flaps) to cause a slow memory leak, ultimately leading to a Denial of Service (DoS).

Memory can only be recovered by manually restarting rtlogd process.  The memory usage can be monitored using the below command.

????user@host> show system processes extensive | match rtlog 

This issue affects Junos OS on MX Series with SPC3 line card: 

  • from 21.2R3 before 21.2R3-S8, 
  • from 21.4R2 before 21.4R3-S6, 
  • from 22.1 before 22.1R3-S5, 
  • from 22.2 before 22.2R3-S3, 
  • from 22.3 before 22.3R3-S2, 
  • from 22.4 before 22.4R3-S1, 
  • from 23.2 before 23.2R2, 
  • from 23.4 before 23.4R2.
Severity
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.1 (High)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/R:U
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-39550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-11T17:15:15Z",
    "severity": "HIGH"
  },
  "details": "A Missing Release of Memory after Effective Lifetime vulnerability in the rtlogd process\u00a0of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, adjacent attacker to trigger internal events cause ( which can be done by repeated port flaps)\u00a0to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). \n\nMemory can only be recovered by manually restarting rtlogd process.\u00a0\nThe memory usage can be monitored using the below command.\n\n????user@host\u003e show system processes extensive | match rtlog\u00a0\n\n\n\nThis issue affects Junos OS on MX Series with SPC3 line card:\u00a0\n\n\n\n  *  from 21.2R3 before 21.2R3-S8,\u00a0\n  *  from 21.4R2 before 21.4R3-S6,\u00a0\n  *  from 22.1 before 22.1R3-S5,\u00a0\n  *  from 22.2 before 22.2R3-S3,\u00a0\n  *  from 22.3 before 22.3R3-S2,\u00a0\n  *  from 22.4 before 22.4R3-S1,\u00a0\n  *  from 23.2 before 23.2R2,\u00a0\n  *  from 23.4 before 23.4R2.",
  "id": "GHSA-938g-xvpf-6653",
  "modified": "2025-09-04T03:30:33Z",
  "published": "2024-07-11T18:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39550"
    },
    {
      "type": "WEB",
      "url": "https://supportportal.juniper.net/JSA83012"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-945J-P452-JCMX

Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-26 15:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()

Fix a chunk map leak in btrfs_map_block(): if we return early with -EINVAL, we're not freeing the chunk map that we've just looked up.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-43393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-08T15:16:50Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()\n\nFix a chunk map leak in btrfs_map_block(): if we return early with -EINVAL,\nwe\u0027re not freeing the chunk map that we\u0027ve just looked up.",
  "id": "GHSA-945j-p452-jcmx",
  "modified": "2026-05-26T15:32:08Z",
  "published": "2026-05-08T15:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43393"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0e4aaf5a3212b6a469c2489637c29a8e2a5062a5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4f90c5c2698383984102401b1724b0b67da832ab"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7bdf00ed75c477252578068dba19934cd825f20a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f15fb3d41543244d1179f423da4a4832a55bc050"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-948P-87WR-RW9M

Vulnerability from github – Published: 2022-10-20 12:00 – Updated: 2022-10-23 12:00
VLAI
Details

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-41624"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-19T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization.",
  "id": "GHSA-948p-87wr-rw9m",
  "modified": "2022-10-23T12:00:26Z",
  "published": "2022-10-20T12:00:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41624"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K43024307"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-94C2-F29F-CQQQ

Vulnerability from github – Published: 2025-06-18 12:30 – Updated: 2025-11-13 21:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE

There is no corresponding free routine if lpfc_sli4_issue_wqe fails to issue the CMF WQE in lpfc_issue_cmf_sync_wqe.

If ret_val is non-zero, then free the iocbq request structure.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-50027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-18T11:15:30Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix possible memory leak when failing to issue CMF WQE\n\nThere is no corresponding free routine if lpfc_sli4_issue_wqe fails to\nissue the CMF WQE in lpfc_issue_cmf_sync_wqe.\n\nIf ret_val is non-zero, then free the iocbq request structure.",
  "id": "GHSA-94c2-f29f-cqqq",
  "modified": "2025-11-13T21:31:17Z",
  "published": "2025-06-18T12:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50027"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2f67dc7970bce3529edce93a0a14234d88b3fcd5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4eb7a1beff03836d3df271cd23b790884e3facb9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c8e2e607270a368834a0ef72aa82d970f89c596"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-94G7-4R7X-4RFV

Vulnerability from github – Published: 2023-01-12 21:30 – Updated: 2025-11-25 21:32
VLAI
Details

A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-4743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-12T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.",
  "id": "GHSA-94g7-4r7x-4rfv",
  "modified": "2025-11-25T21:32:02Z",
  "published": "2023-01-12T21:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4743"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libsdl-org/SDL/pull/6269"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2022-4743"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156290"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00024.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-94JM-9M2W-WFHH

Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-15 18:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

most: core: fix leak on early registration failure

A recent commit fixed a resource leak on early registration failures but for some reason left out the first error path which still leaks the resources associated with the interface.

Fix up also the first error path so that the interface is always released on errors.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-43317"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-08T14:16:40Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmost: core: fix leak on early registration failure\n\nA recent commit fixed a resource leak on early registration failures but\nfor some reason left out the first error path which still leaks the\nresources associated with the interface.\n\nFix up also the first error path so that the interface is always\nreleased on errors.",
  "id": "GHSA-94jm-9m2w-wfhh",
  "modified": "2026-05-15T18:30:30Z",
  "published": "2026-05-08T15:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43317"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5fd4396c2e48e90cc2597a86c18227d56ea845f0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bbfe49ffb892bddf32c34bea95b7ff0fc30affb5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f1ba620f9e8d7291f80c0554e4b820f5fb30e819"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-94M8-5MHQ-PH6M

Vulnerability from github – Published: 2024-10-21 15:32 – Updated: 2024-10-22 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

nvdimm: Fix devs leaks in scan_labels()

scan_labels() leaks memory when label scanning fails and it falls back to just creating a default "seed" namespace for userspace to configure. Root can force the kernel to leak memory.

Allocate the minimum resources unconditionally and release them when unneeded to avoid the memory leak.

A kmemleak reports: unreferenced object 0xffff88800dda1980 (size 16): comm "kworker/u10:5", pid 69, jiffies 4294671781 hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): [<00000000c5dea560>] __kmalloc+0x32c/0x470 [<000000009ed43c83>] nd_region_register_namespaces+0x6fb/0x1120 [libnvdimm] [<000000000e07a65c>] nd_region_probe+0xfe/0x210 [libnvdimm] [<000000007b79ce5f>] nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm] [<00000000a5f3da2e>] really_probe+0xc6/0x390 [<00000000129e2a69>] __driver_probe_device+0x78/0x150 [<000000002dfed28b>] driver_probe_device+0x1e/0x90 [<00000000e7048de2>] __device_attach_driver+0x85/0x110 [<0000000032dca295>] bus_for_each_drv+0x85/0xe0 [<00000000391c5a7d>] __device_attach+0xbe/0x1e0 [<0000000026dabec0>] bus_probe_device+0x94/0xb0 [<00000000c590d936>] device_add+0x656/0x870 [<000000003d69bfaa>] nd_async_device_register+0xe/0x50 [libnvdimm] [<000000003f4c52a4>] async_run_entry_fn+0x2e/0x110 [<00000000e201f4b0>] process_one_work+0x1ee/0x600 [<000000006d90d5a9>] worker_thread+0x183/0x350

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-47755"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T13:15:05Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: Fix devs leaks in scan_labels()\n\nscan_labels() leaks memory when label scanning fails and it falls back\nto just creating a default \"seed\" namespace for userspace to configure.\nRoot can force the kernel to leak memory.\n\nAllocate the minimum resources unconditionally and release them when\nunneeded to avoid the memory leak.\n\nA kmemleak reports:\nunreferenced object 0xffff88800dda1980 (size 16):\n  comm \"kworker/u10:5\", pid 69, jiffies 4294671781\n  hex dump (first 16 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 0):\n    [\u003c00000000c5dea560\u003e] __kmalloc+0x32c/0x470\n    [\u003c000000009ed43c83\u003e] nd_region_register_namespaces+0x6fb/0x1120 [libnvdimm]\n    [\u003c000000000e07a65c\u003e] nd_region_probe+0xfe/0x210 [libnvdimm]\n    [\u003c000000007b79ce5f\u003e] nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm]\n    [\u003c00000000a5f3da2e\u003e] really_probe+0xc6/0x390\n    [\u003c00000000129e2a69\u003e] __driver_probe_device+0x78/0x150\n    [\u003c000000002dfed28b\u003e] driver_probe_device+0x1e/0x90\n    [\u003c00000000e7048de2\u003e] __device_attach_driver+0x85/0x110\n    [\u003c0000000032dca295\u003e] bus_for_each_drv+0x85/0xe0\n    [\u003c00000000391c5a7d\u003e] __device_attach+0xbe/0x1e0\n    [\u003c0000000026dabec0\u003e] bus_probe_device+0x94/0xb0\n    [\u003c00000000c590d936\u003e] device_add+0x656/0x870\n    [\u003c000000003d69bfaa\u003e] nd_async_device_register+0xe/0x50 [libnvdimm]\n    [\u003c000000003f4c52a4\u003e] async_run_entry_fn+0x2e/0x110\n    [\u003c00000000e201f4b0\u003e] process_one_work+0x1ee/0x600\n    [\u003c000000006d90d5a9\u003e] worker_thread+0x183/0x350",
  "id": "GHSA-94m8-5mhq-ph6m",
  "modified": "2024-10-22T18:32:10Z",
  "published": "2024-10-21T15:32:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47755"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/18a672c62d735744c6340eb3f5e58934a5d34cf2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/45db20bdb5695d06478d35e05fb2550441bed890"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/62c2aa6b1f565d2fc1ec11a6e9e8336ce37a6426"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/939053737edb49ba5bdc5846acb45f11d15b7ab4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cdf0dfb3d183bbe0d0b6a6622c53d105074ad384"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-94RJ-FRV4-2P83

Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36
VLAI
Details

In process of C2SoftVorbisDec.cpp, there is a possible resource exhaustion due to a memory leak. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154302257

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-27038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-15T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In process of C2SoftVorbisDec.cpp, there is a possible resource exhaustion due to a memory leak. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154302257",
  "id": "GHSA-94rj-frv4-2p83",
  "modified": "2022-05-24T17:36:30Z",
  "published": "2022-05-24T17:36:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27038"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2020-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-952P-3M9P-PRPF

Vulnerability from github – Published: 2022-05-12 00:01 – Updated: 2022-05-20 00:00
VLAI
Details

The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-29932"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-11T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request.",
  "id": "GHSA-952p-3m9p-prpf",
  "modified": "2022-05-20T00:00:52Z",
  "published": "2022-05-12T00:01:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29932"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Off3nS3c/CVE-2022-29932/blob/main/Proof-of-Concept.md"
    },
    {
      "type": "WEB",
      "url": "https://www.primeur.com/managed-file-transfer"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-41
Implementation

Strategy: Libraries or Frameworks

  • Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
  • For example, glibc in Linux provides protection against free of invalid pointers.
  • When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
  • To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Architecture and Design

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Mitigation
Architecture and Design Build and Compilation

Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list