CWE-775
Missing Release of File Descriptor or Handle after Effective Lifetime
Monthly
Privilege escalation in util-linux's nsenter --join-cgroup option allows an unprivileged local user to move and terminate root-owned host processes by exploiting a persistent file descriptor opened as root that survives across namespace and credential changes. The kernel evaluates cgroup migration requests against the credentials held at fd-open time rather than the current caller's credentials, so any program that inherits the still-open cgroup.procs fd effectively retains root's cgroup management authority. Red Hat Enterprise Linux 7-10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are confirmed affected; no public exploit has been identified at time of analysis.
FreeRDP clients running versions 3.13.0 up to (but not including) 3.32.0 can leak local file handles when drive redirection (the rdpdr drive channel) is enabled and the client connects to a malicious or compromised RDP server. A server-sent IRP_MJ_CREATE with AllocationSize set to UINT64_MAX makes the allocation-size seek fail after the opened local file has already been registered in the drive dictionary, so the file object and its underlying OS handle are not released until the drive channel is torn down at disconnect. Exploitation requires the user to have opted into drive redirection and to establish a session with an attacker-controlled server (unauthenticated from the network perspective but requiring user interaction), giving it a medium/low rating consistent with the CVSS 4.0 base score of 5.3; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Repeated processing of crafted Magick scripts in ImageMagick versions prior to 7.1.2-31 leaks a file descriptor on each invocation, allowing unauthenticated remote attackers to exhaust a process's open-file-descriptor table and deny service to applications that exercise the MagickWand script-token (MSL/conjure) path. The issue is rated CVSS 5.3 with availability-only impact (C:N/I:N/A:L) and requires sustained or repeated request volume to be effective, since a single invocation is harmless and the leak is cleared by a process restart. No public exploit identified at time of analysis, and the vendor-released patch is version 7.1.2-31.
TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability that allows local attackers to crash the application by importing a malformed .srp script file. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in OpenPLC v3's ModbusTCP server (build a931181e8b81e36fadf7b74d5cba99b73c3f6d58) allows unauthenticated remote attackers to open a series of TCP connections that cause the server to stop processing subsequent Modbus requests. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), and EPSS is low at 0.46% (38th percentile). No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation is not confirmed actively exploited.
Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) by repeatedly establishing SCTP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process crashes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a handle to a kernel object may be returned to the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Privilege escalation in util-linux's nsenter --join-cgroup option allows an unprivileged local user to move and terminate root-owned host processes by exploiting a persistent file descriptor opened as root that survives across namespace and credential changes. The kernel evaluates cgroup migration requests against the credentials held at fd-open time rather than the current caller's credentials, so any program that inherits the still-open cgroup.procs fd effectively retains root's cgroup management authority. Red Hat Enterprise Linux 7-10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are confirmed affected; no public exploit has been identified at time of analysis.
FreeRDP clients running versions 3.13.0 up to (but not including) 3.32.0 can leak local file handles when drive redirection (the rdpdr drive channel) is enabled and the client connects to a malicious or compromised RDP server. A server-sent IRP_MJ_CREATE with AllocationSize set to UINT64_MAX makes the allocation-size seek fail after the opened local file has already been registered in the drive dictionary, so the file object and its underlying OS handle are not released until the drive channel is torn down at disconnect. Exploitation requires the user to have opted into drive redirection and to establish a session with an attacker-controlled server (unauthenticated from the network perspective but requiring user interaction), giving it a medium/low rating consistent with the CVSS 4.0 base score of 5.3; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Repeated processing of crafted Magick scripts in ImageMagick versions prior to 7.1.2-31 leaks a file descriptor on each invocation, allowing unauthenticated remote attackers to exhaust a process's open-file-descriptor table and deny service to applications that exercise the MagickWand script-token (MSL/conjure) path. The issue is rated CVSS 5.3 with availability-only impact (C:N/I:N/A:L) and requires sustained or repeated request volume to be effective, since a single invocation is harmless and the leak is cleared by a process restart. No public exploit identified at time of analysis, and the vendor-released patch is version 7.1.2-31.
TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability that allows local attackers to crash the application by importing a malformed .srp script file. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in OpenPLC v3's ModbusTCP server (build a931181e8b81e36fadf7b74d5cba99b73c3f6d58) allows unauthenticated remote attackers to open a series of TCP connections that cause the server to stop processing subsequent Modbus requests. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), and EPSS is low at 0.46% (38th percentile). No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation is not confirmed actively exploited.
Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) by repeatedly establishing SCTP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process crashes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a handle to a kernel object may be returned to the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.