CVE-2023-3397

Kernel: slab-use-after-free write in txend due to race condition

A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Els

CVE-2024-2698

Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request. In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 2 more

CVE-2023-5236

Infinispan: circular reference on marshalling leads to dos

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

CVSS 3.1 · 4.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Infinispan Redhat

Products

Infinispan Camel Quarkus Camel Spring Boot and 9 more

CVE-2023-5178

Kernel: use after free in nvmet_tcp_free_crypto in nvme

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

CVSS 3.1 · 8.8 High EPSS 9.6% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Active Iq Unified Manager Solidfire \& Hci Management Node and 8 more

CVE-2023-5157

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Fedoraproject Mariadb Redhat

Products

Fedora Mariadb Enterprise Linux and 15 more

CVE-2023-4732

Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h

A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Codeready Linux Builder Codeready Linux Builder For Arm64 and 10 more

CVE-2023-4385

Kernel: jfs: null pointer dereference in dbfree()

A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Els

CVE-2023-39197

Kernel: dccp: conntrack out-of-bounds read in nf_conntrack_dccp_packet()

An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel Enterprise Linux and 1 more

CVE-2023-3772

Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 6 more

CVE-2024-2905

Rpm-ostree: world-readable /etc/shadow file

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Eus

CVE-2023-3812

Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Aus and 5 more

CVE-2023-5088

Qemu: improper ide controller reset can lead to mbr overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Advanced Virtualization Enterprise Linux and 1 more

CVE-2023-4527

Glibc: stack read overflow in getaddrinfo in no-aaaa mode

A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Glibc H300s and 30 more

CVE-2023-4387

Kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf()

A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Els

CVE-2023-4091

Samba: smb clients can truncate files with read-only permissions

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Fedoraproject Redhat Samba

Products

Fedora Enterprise Linux Enterprise Linux Eus and 5 more

CVE-2023-3773

Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 2 more

CVE-2023-2593

Kernel: ksmbd memory exhaustion denial-of-service vulnerability

A flaw exists within the Linux kernel's handling of new TCP connections. The issue results from the lack of memory release after its effective lifetime. This vulnerability allows an unauthenticated attacker to create a denial of service condition on the system.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2020-27792

Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000_print_page() in gdevlp8k.c

A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Artifex Debian Redhat

Products

Ghostscript Debian Linux Enterprise Linux and 1 more

CVE-2023-39418

Postgresql: merge fails to enforce update or select row security policies

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

CVSS 3.1 · 3.1 Low EPSS 1.1% KEV · Not listed

Vendors

Debian Postgresql Redhat

Products

Debian Linux Postgresql Enterprise Linux and 3 more

CVE-2026-18569

Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak Jboss Data Grid and 3 more