Reverse tabnabbing in PILOS versions 2.1.0 through 4.14.1 exposes authenticated users to session hijacking via phishing by omitting the Cross-Origin-Opener-Policy (COOP) response header on pages that open links in new browser tabs. When an authenticated user clicks a target="_blank" link within PILOS, the newly opened page retains a live window.opener reference to the original PILOS tab, allowing the destination page to silently redirect that tab to an attacker-controlled site mimicking PILOS login. No public exploit has been identified at time of analysis, and the vendor-confirmed fix is available in v4.14.1.
Timing side-channel exposure in Apache Portable Runtime Utility (APR-util) versions 1.2.0 through 1.6.3 allows network-accessible attackers to statistically recover passwords or hashes by measuring response-time variance in the `apr_password_validate()` function, which performs non-constant-time comparisons. The risk is materially elevated on platforms lacking native `crypt()` support - specifically Windows, Android, BeOS, and NetWare - where the non-constant-time code path is always exercised rather than conditionally. No public exploit has been identified at time of analysis, though the SSVC framework assesses the attack as automatable with partial technical impact.
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid access tokens from a single code. Concurrent requests to the token endpoint during the brief window between code validation and invalidation exploit the TOCTOU race condition (CWE-367), allowing an attacker in possession of a valid authorization code to obtain additional access tokens beyond the one they are entitled to. No public exploit has been identified at time of analysis, and fixed versions are available across all maintained branches.
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 authorization parameter map, including security-sensitive fields that must not be client-controlled: code_challenge, code_challenge_method, nonce, and state. Affected are all Apache CXF deployments using this filter for OAuth2/OIDC authorization code flows prior to versions 4.2.3, 4.1.8, and 3.6.12. An OAuth2 client with a known or compromised client_secret can craft a signed request JWT that overrides the PKCE parameters established in the outer HTTP request, effectively nullifying PKCE authorization code binding and OIDC replay protection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge self-issued ID tokens that skip all required OpenID Connect claim checks - issuer, subject, audience, time bounds, and sub_jwk binding - effectively impersonating any user identity. Affected are all Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 when the relying party is explicitly configured to accept self-issued OIDC tokens, a non-default setting. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is constrained to a narrow set of deliberately misconfigured deployments.
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited number of times, violating RFC 6749's single-use requirement. The removeCodeGrant() method that should invalidate a code after first exchange fails to do so, meaning any attacker who intercepts or obtains a legitimate authorization code can replay it repeatedly to obtain additional access tokens. No public exploit has been identified at time of analysis, and the issue is addressed in patched releases 4.2.3, 4.1.8, and 3.6.12.
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh tokens to remain functionally valid indefinitely - the provider continues to decrypt them successfully and TokenIntrospectionService returns active:true in direct violation of RFC 7009 and RFC 7662 mandates. All Apache CXF deployments using this built-in OAuth data provider and relying on token revocation as a security control are affected across the 3.6.x, 4.1.x, and 4.2.x branches. An attacker or suspended user who retains a revoked token can continue accessing protected resources as though revocation never occurred, bypassing intended authorization boundaries. No public exploit has been identified at time of analysis, though the attack requires no tooling beyond a standard HTTP client.
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to hijack authenticated sessions when CXF is deployed in Hybrid Flow mode with a non-compliant or misconfigured Identity Provider that omits the c_hash parameter. Successful exploitation yields full authenticated access equivalent to account takeover, with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but SSVC classifies the attack as automatable with total technical impact once the prerequisite IdP condition is present.
Uncontrolled resource consumption in Apache CXF's JAX-RS form parameter processing enables remote denial-of-service attacks against any exposed endpoint accepting form-encoded requests. The framework provides a 'maxFormParameterCount' configuration knob but sets no default ceiling, meaning unpatched deployments will parse arbitrarily large parameter sets until memory or CPU is exhausted. Fixed versions (4.2.3, 4.1.8, and 3.6.12) enforce a default cap of 500 parameters; no public exploit or CISA KEV listing has been identified at time of analysis.
Unbounded attachment ingestion in Apache CXF enables remote denial-of-service against any endpoint that processes multipart messages. Versions prior to 4.2.3, 4.1.8, and 3.6.12 imposed no default ceiling on the 'attachment-max-size' parameter, allowing attackers to exhaust server memory or processing capacity by submitting arbitrarily large attachments. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity makes this a realistic threat for internet-exposed CXF deployments.
Cross-organizational secret deletion in WSO2 Identity Server's Secret Type Management REST API allows an administrator with delete permissions to inadvertently remove secrets across all organizations in a multi-tenant deployment. The on-delete cascade logic, triggered when a secret type is deleted, fails to enforce organizational boundaries - a multi-tenancy isolation failure classified as CWE-281 (Improper Preservation of Permissions). Exploitation yields availability and integrity impact across the entire deployment, though it is constrained to high-privilege administrator accounts. No public exploit is identified and this vulnerability is not listed in the CISA KEV catalog.
Rate-limiting in OpenReception's appointment booking software prior to version 1.0.6 is defeated by two compounding weaknesses: a SHA-256 proof-of-work configured at only 16 bits of difficulty (solvable in under 200ms on modern hardware) and a per-binding throttle service whose key is derived entirely from attacker-controlled parameters. Remote unauthenticated attackers can automate high-volume requests to the `/api/tenants/{id}/appointments/bootstrap-challenge` endpoint - rotating fresh `tunnelId` and `clientPublicKey` values each attempt to generate a new throttle namespace - bypassing both controls and flooding the patient appointment booking flow. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
GitHub CLI's `gh auth status` command in versions prior to 2.97.0 partially exposed fine-grained personal access tokens and GitHub App tokens in terminal and CI output due to a flawed masking algorithm. The defect used `strings.LastIndexByte` to find the last underscore as the masking boundary - for tokens like `github_pat_APPID_secretbody` or `ghs_APPID_JWT`, this left the middle segment (between the type prefix and the last underscore) visible in plain text. Affected token types include fine-grained PATs (`github_pat_*`), GitHub App installation tokens (`ghs_*`), user access tokens (`ghu_*`), and the Actions `GITHUB_TOKEN`; classic tokens (`gho_*`, `ghp_*`) are not affected. No public exploit is identified at time of analysis.
Local privilege abuse in pardus-domain-joiner (TÜBİTAK BİLGEM Software Technologies Research Institute) before version 0.5.5 exposes Pardus Linux systems to unauthorized resource access through unverified ownership checks (CWE-283). A locally authenticated user with low privileges can trigger a code path where ownership of a resource is not validated before access or privileged operations are permitted, enabling privilege abuse. No public exploit code or active exploitation has been identified; the CVSS score of 3.3 reflects limited real-world impact confined to local sessions on Pardus Linux systems.
Cross-origin data leakage in Google Chrome's Skia graphics library (versions prior to 151.0.7922.109) enables a remote attacker who has already achieved renderer process compromise to extract cross-origin data through a specially crafted HTML page. The vulnerability is classified CWE-457 (Use of Uninitialized Variable) and carries a low CVSS base score of 3.1, reflecting its dependency on a pre-existing renderer compromise as a prerequisite. No public exploit code has been identified at time of analysis, SSVC exploitation status is rated none, and a vendor-released patch is available in Chrome 151.0.7922.109.
Cross-origin data leakage in Google Chrome's GPU process - caused by an integer overflow (CWE-190) - enables a remote attacker who has already achieved renderer process compromise to read data across origin boundaries by delivering a crafted HTML page. All Chrome desktop releases prior to 151.0.7922.109 are affected. No public exploit or CISA KEV listing exists at time of analysis; the chained nature of the attack (requiring a prior renderer compromise) substantially constrains real-world risk despite the broad deployment footprint of Chrome.
Uninitialized memory use in Skia, Chrome's 2D graphics engine, exposes a cross-origin data leak primitive in Google Chrome prior to 151.0.7922.109. Exploitation is constrained to attackers who have already achieved renderer process compromise - making this a second-stage, chained vulnerability rather than a standalone initial-access vector. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact, consistent with the low CVSS base score of 3.1.
Cross-tenant invite deletion in OpenReception's appointment booking software (prior to 1.0.6) allows an authenticated TENANT_ADMIN to destroy pending onboarding invites belonging to unrelated tenants on the same platform instance. The flaw exists because the invite cleanup query inside `StaffService.deleteStaffMember()` matches only on email address without constraining to the acting tenant's ID, causing any staff deletion to silently cascade-delete matching invites across all tenants. No active exploitation has been identified and no public exploit code exists; the issue is fully remediated in version 1.0.6 via a single ORM predicate addition.
Shortcode allowlist bypass in the Easy Appointments WordPress plugin (≤ 3.12.26) allows authenticated contributors to execute arbitrary registered shortcodes by exploiting a validation flaw in a block-rendering action. The plugin checks only the first tag of a supplied string against an approved shortcode list, but renders the entire string - meaning a contributor can prepend an allowed tag and append any registered shortcode to bypass the restriction entirely. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor-assigned CVSS score of 2.7 (Low) reflects constrained scope, though real-world impact depends on the registered shortcode ecosystem of the targeted site.
Passster WordPress plugin before 4.3.7 allows any authenticated Contributor or higher to bypass global password protection and read protected content via the WordPress core REST API without supplying the protection password. When global protection is enabled, the plugin enforces its access controls only on direct front-end page requests, leaving the REST API path unrestricted for users holding the edit_posts capability. No public exploit has been identified at time of analysis; the CVSS score of 2.7 reflects realistic low risk, constrained to sites with untrusted registered contributors.
Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors to navigate to attacker-controlled URLs by injecting `<meta http-equiv="refresh">` elements that the HTML5 scrubber (HtmlSanitizeEx.Scrubber.HTML5) passes through intact into sanitized output. Because a meta refresh acts at document scope rather than fragment scope, it overrides the host page's navigation regardless of where the sanitized fragment is embedded. The CVE description explicitly rules out JavaScript execution - this is a pure redirect primitive - and no public exploit has been identified at time of analysis.
Command injection in MissionSquad mcp-api through version 1.11.8 enables remote authenticated users to execute arbitrary OS-level commands on the host by supplying a crafted version string to the NPM package installation endpoint. The root cause is string interpolation of unvalidated user input into a Node.js `exec()` call, which passes the resulting string through a shell interpreter - making shell metacharacters in the version parameter an effective injection vector. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no active exploitation has been confirmed by CISA KEV. A patched release (v1.11.9) is available.
Insufficient refresh token invalidation in WSO2 Identity Server's user impersonation flow allows a privileged attacker who has already obtained an impersonated access token to silently renew that authorization via the OAuth refresh token grant, sustaining unauthorized access well beyond the intended session lifetime. The integrity impact is two-fold: the attacker continues performing actions on behalf of the legitimate user, and audit logs attribute those actions to the victim identity rather than the true actor, corrupting traceability and compliance posture. No public exploit is identified and exploitation is bounded by high privilege prerequisites (PR:H) and adjacent network access (AV:A), placing realistic risk firmly in insider-threat and compromised-administrator scenarios.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the `data` attribute of `<object>` elements after a trivially bypassed case-sensitive prefix check, allowing remote attackers to embed arbitrary external or same-origin documents into sanitized pages viewed by victims. The `<object>` tag was never registered through the library's `allow_tag_with_uri_attributes/3` URI-validation mechanism, and its sole guard - a literal lowercase `javascript:` prefix match - is defeated by mixed-case variants, `data:` URIs, protocol-relative URLs, and same-origin relative paths. No public exploit has been identified at time of analysis, and no active exploitation (CISA KEV) has been confirmed; the CVSS 4.0 score of 2.3 correctly reflects constrained real-world impact due to browser-enforced origin isolation on embedded `<object>` content.
CSS at-rule injection in html_sanitize_ex (Elixir, versions 0.3.1-1.5.3) allows unauthenticated remote users to embed `@import` directives that survive sanitization and are rendered in other users' browsers. The `HtmlSanitizeEx.Scrubber.CSS.scrub/1` function applied its allowlist exclusively to `property: value` declaration patterns; `@import` at-rules, which are syntactically distinct, were never inspected and passed through verbatim. Three distinct bypass paths existed: bare `@import url(...)`, no-whitespace `@import"url"`, and CSS hex-escaped `@\69 mport`. No public exploit code is identified at time of analysis; a vendor patch is available as version 1.5.4.
Path traversal in MonomythDevelopment la-forge-mcp 1.0.0 enables low-privileged authenticated users to write files outside the server's intended reference directory via the `screenshot_element` MCP tool. The `screenshotElement` function in `src/index.ts` constructed output file paths using unsanitized user-supplied selector or `output_name` arguments, allowing traversal sequences to escape `REF_DIR` entirely. A public proof-of-concept exists (CVSS E:P; referenced in gongyaugugyy/public_exp/issues/12), though no CISA KEV listing has been identified and the overall CVSS 4.0 score of 2.1 reflects the bounded, low-impact nature of this finding.
Server-side request forgery in MissionSquad mcp-api up to version 1.11.9 allows authenticated remote attackers to coerce the server into issuing HTTP requests to arbitrary internal or external destinations via unsanitized OAuth Dynamic Client Registration (DCR) endpoint URLs. The vulnerability exists in the `registrationEndpoint` field of OAuth templates processed by `src/services/dcrClients.ts`, which was passed directly to `fetch()` without scheme validation or SSRF filtering. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental E:P flag indicates proof-of-concept evidence exists. A vendor-released patch is available in v1.11.10.
Business logic enforcement failure in WonderTrader's backtesting engine (versions up to 0.9.9) allows a low-privileged authenticated remote attacker to manipulate the internal limit order book cache through the MatchEngine::update_lob function in src/WtBtCore/MatchEngine.cpp. The flaw enables integrity-affecting manipulation of simulated or processed order book state in violation of expected matching workflow constraints. No vendor patch exists - the vendor did not respond to responsible disclosure - and proof-of-concept exploit code is publicly available (CVSS 4.0 E:P), though real-world risk is substantially bounded by the authentication requirement, low-only integrity impact, and niche deployment footprint.
Sigstore attestation verification in GitHub CLI prior to 2.97.0 can be defeated when an attacker registers a lookalike repository whose name contains dot characters that function as regex wildcards - for example, github/artifact.attestations-workflows matching a matcher intended solely for github/artifact-attestations-workflows. The `gh attestation verify` command in pkg/cmd/attestation/verify/policy.go constructed Certificate Subject Alternative Name (SAN) matchers by interpolating `--signer-repo` and `--signer-workflow` flag values directly into regex patterns without calling regexp.QuoteMeta(), allowing any dot or other metacharacter in a GitHub-permitted name to act as a wildcard. No public exploit has been identified at time of analysis; the CVSS 4.0 AT:P designator confirms exploitation requires the attacker to first position a valid lookalike repository with legitimate Sigstore attestations, making this a targeted rather than opportunistic threat.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment deletion endpoint `/viewappointment.php` to database manipulation by authenticated low-privileged users via the `delid` parameter. The vulnerability allows partial read, write, and availability impact against the underlying database. A proof-of-concept exploit has been publicly published (CVSS 4.0 E:P), lowering the bar for abuse. No public KEV listing or vendor patch has been identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewadmin.php endpoint to database manipulation via the unsanitized `delid` parameter. Authenticated low-privileged attackers with network access can craft malicious requests to read, modify, or delete records from the underlying database. A public exploit exists (POC confirmed via VulDB submission); no KEV listing at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-privilege credentials to manipulate database queries via the unsanitized `editid` parameter in `/treatmentrecord.php`. Exploitation can expose or alter sensitive patient treatment records stored in the backend database. A publicly disclosed exploit exists (E:P), though no confirmed active exploitation appears in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries by supplying crafted input via the `patientid` parameter in `/treatmentdetail.php`. Successful exploitation can result in unauthorized read or modification of patient records and other database contents. Publicly available exploit code exists (CVSS 4.0 supplemental E:P), raising practical risk above the low numeric score of 2.1 suggests; however, no confirmed active exploitation has been identified in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/treatment.php` endpoint to database manipulation via the `editid` parameter, accessible to remote low-privilege authenticated users. Public exploit code has been released and is referenced via a GitHub issue, making exploitation straightforward for attackers who have obtained any valid session. The CVSS 4.0 score of 2.1 reflects bounded impact (low C/I/A, no subsequent-system scope), but the healthcare context - where treatment records carry regulatory and patient-safety weight - elevates real-world consequence beyond the raw score.
Certificate validation bypass in OpenVPN 2.7 alpha series (mbedTLS builds) causes the --x509-username-field directive to unintentionally accept certificates that should be rejected, potentially granting unauthorized VPN network access. Only deployments running a 2.7 alpha or pre-release build compiled against mbedTLS and explicitly configured with --x509-username-field are exposed; OpenVPN 2.6.x stable series and OpenSSL-backend builds are not affected. The vendor characterizes this as a low-priority security finding; no public exploit has been identified at time of analysis and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
Command injection in Kino-Kafkaesque ssh-mcp-server's SSH Command Handler allows a local low-privilege attacker to execute arbitrary commands by manipulating the host or username arguments passed to the ssh_exec function in src/index.ts up to commit 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Proof-of-concept code exists (CVSS E:P), though the maintainer explicitly disputes the severity, stating the tool's intended threat model assumes fully trusted local callers who already possess meaningful shell execution capability via the MCP interface. The actual existence of this vulnerability is formally in question per the CVE description, and no CISA KEV listing is present.
Command injection in LeeSinLiang's godot-mcp 0.1.0 allows local low-privileged users to execute arbitrary OS commands by supplying a crafted projectPath argument to the executeOperation function in src/index.ts, specifically through the create_scene and add_node MCP operation handlers. This Model Context Protocol server for the Godot game engine was disclosed via a GitHub issue report that the project maintainer has not yet addressed. No active exploitation has been confirmed and no CISA KEV listing exists, though the CVSS 4.0 temporal metric E:P confirms publicly available proof-of-concept exploit code.
Command injection in NocteDefensor LudusMCP through version 1.0.24 allows a local attacker with low privileges to execute arbitrary OS commands by supplying crafted input to the `command` or `args` parameters of the `executeArbitraryCommand` and `executeCommand` functions in `src/ludusMCP/cliWrapper.ts`. A proof-of-concept exploit is publicly referenced (CVSS 4.0 E:P; GitHub issue at gongyaugugyy/public_exp), and the vendor has not responded to the coordinated disclosure. No active exploitation has been confirmed via CISA KEV, but the public POC lowers the exploitation barrier for any local attacker on systems running this MCP server.
Command injection in NocteDefensor LudusMCP (all versions through 1.0.24) permits a local low-privileged attacker to execute arbitrary OS commands by manipulating the Description argument passed to SecretDialog.showSecretDialog within the get_credential_from_user component (src/utils/secretDialog.ts). Exploitation is constrained to the local host and requires at minimum low-privilege OS credentials, consistent with the CVSS 4.0 AV:L/PR:L metrics and a final score of 1.9. A proof-of-concept exploit has been publicly posted (CVSS 4.0 E:P; GitHub issue at gongyaugugyy/public_exp), but no vendor patch has been released - the project has not responded to the coordinated disclosure as of this analysis.
Stored cross-site scripting in DataGear up to version 5.0.0 allows a high-privileged authenticated attacker to inject malicious script into dashboard chart titles, which executes in the browser of any user who subsequently views the affected dashboard. The vulnerability resides in HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler, where the Title argument is rendered without adequate output encoding. A proof-of-concept has been publicly disclosed; the vendor did not respond to pre-disclosure contact, meaning no official patch is confirmed at time of analysis.
Path traversal in MetaGPT versions 0.8.0 through 0.8.2 (FoundationAgents) allows a local low-privileged attacker to read arbitrary files on the host system via the `read` function in `metagpt/tools/libs/editor.py`. Impact is limited to confidentiality - no write or availability impact is present. A public proof-of-concept exploit has been disclosed on GitHub; no vendor patch exists as the vendor did not respond to coordinated disclosure.
Code injection in FoundationAgents MetaGPT versions 0.8.0 through 0.8.2 allows a local attacker with low-privilege credentials to inject and execute arbitrary code within the application's process context. The vulnerability (CWE-74) affects an unspecified function and produces low-severity confidentiality, integrity, and availability impacts with no lateral scope change to other systems. A public exploit is available via GitHub gists linked in the CVE references; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 base score of 1.9 reflects the constrained local-only attack surface.
Code injection in MetaGPT's DataInterpreter role (versions 0.8.0-0.8.2) enables a local low-privileged user to inject and execute arbitrary code through the `DataInterpreter` function in `metagpt/roles/di/data_interpreter.py`. A public proof-of-concept exploit is available via GitHub Gist, though the CVSS 4.0 score of 1.9 reflects the constrained blast radius: local-only access, low-privilege requirement, and limited impact (low C/I/A, no scope change to subsequent systems). The vendor did not respond to pre-disclosure notification, leaving patch status unresolved.
Path traversal in lspace-server's Repositories File API permits low-privileged local attackers to escape the intended repository directory by manipulating the filePath argument passed to the fileExists, readFile, writeFile, and deleteFile functions in src/core/repository.ts. All commits up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71 are affected; the project uses rolling continuous delivery with no discrete versioned releases. A proof-of-concept exists (CVSS 4.0 E:P modifier), the vendor has not responded to responsible disclosure, and no patch has been released - though no active exploitation (CISA KEV) has been identified.
Improper input validation in OMICRON StationGuard 4.00 allows an adjacent network attacker to crash the IEC 61850 Sampled Values processing component by sending a specially crafted SV frame. The disruption is self-healing - the process restarts automatically and the failure is immediately surfaced to operators - leaving overall system availability and all other monitored traffic types unaffected. No public exploit code exists and this vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 1.3 reflects the accurately bounded, minimal real-world impact.
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return sequence, potentially leading to data leakage through speculative execution. Fixup register state as if the Safe-RET sequence executed successfully by "emulating" it, in a manner of speaking, and avoid executing a RET instruction after returning from the interrupt.
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion. ------------[ cut here ]------------ debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count)) WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879 WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879 Modules linked in: CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline] RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879 Call Trace: <TASK> apic_update_ppr arch/x86/kvm/lapic.c:984 [inline] kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023 kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986 kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847 kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201 kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> No functional change intended.
In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic. The probe path, in spear_adc_probe(): iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ ... retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0, LPC32XXAD_NAME, st); /* register handler */ ... init_completion(&st->completion); /* initialize completion */ spear_adc_isr() calls complete(): complete(&st->completion); If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access." Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: initialize reset_work at allocation time ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on ffs->reset_work when a functionfs instance is unmounted: ffs_data_reset(ffs); cancel_work_sync(&ffs->reset_work); However ffs->reset_work is only ever initialized via INIT_WORK() in ffs_func_set_alt() and ffs_func_disable(), and only on the FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed() when the instance is mounted with the "no_disconnect" option, so for the common case (no "no_disconnect", or mounted and unmounted without ever being deactivated) reset_work is never initialized. ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch it either, so reset_work.func is left NULL. cancel_work_sync() on such a work then trips the WARN_ON(!work->func) guard in __flush_work(): WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount Call trace: __flush_work cancel_work_sync ffs_fs_kill_sb [usb_f_fs] deactivate_locked_super deactivate_super cleanup_mnt __cleanup_mnt task_work_run exit_to_user_mode_loop el0_svc On older kernels cancel_work_sync() on a zero-initialized work struct was a silent no-op, which hid the missing initialization. Initialize reset_work once in ffs_data_new() so it is always valid for the lifetime of the ffs_data, and drop the now-redundant INIT_WORK() calls from the two deactivation paths.