A vulnerability in the Linux kernel's cirrus-qemu DRM driver allows improper validation of the PCI BAR0 size during device probe. The driver assumes a fixed VRAM size of 4 MB but does not verify that the mapped BAR0 resource meets this size requirement. This can lead to framebuffer memory operations exceeding the actual mapped memory, causing a supervisor write page fault and kernel crash.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel watchdog driver for the msc313e platform. The issue occurs because the driver data for the platform device was not set during probe, causing subsequent power management callbacks to dereference a NULL pointer. This flaw was addressed by properly setting the platform device driver data in the probe function.
A use-after-free vulnerability was identified and fixed in the Linux kernel's tracing/probes subsystem affecting events with multiple probes. The issue arises because field name and type strings for probe-based dynamic events were not duplicated but referenced directly, leading to dangling pointers when one of multiple probes is removed. This can cause kernel memory corruption and crashes when accessing freed memory.
A use-after-free vulnerability was identified and fixed in the Linux kernel's MCTP I3C driver. The issue occurs because the probe function releases a lock too early, allowing concurrent removal of the bus device, which leads to adding a list node through a freed pointer. This flaw has been corrected by holding the lock until the device is fully added.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's macb network driver. The issue occurs when the device tree describes a fixed-link without an "mdio" child node, causing macb_mii_init() to return early without allocating the MDIO bus, leaving a NULL pointer. Subsequent cleanup code in macb_remove() and the probe error path dereferences this NULL pointer unconditionally, leading to a kernel oops (crash).
A resource leak vulnerability in the Linux kernel's macb network driver was fixed by ensuring the phylink instance is properly destroyed on error during probe initialization. The issue occurred because the phylink instance created by macb_mii_init() was not destroyed if certain initialization steps failed, leading to a resource leak.
A vulnerability in the Linux kernel's hwmon subsystem (corsair-cpro driver) was fixed by ensuring debugfs entries are removed when the probe fails. Previously, if hwmon_device_register_with_info() failed after debugfs files were registered, the probe would return without removing these entries, leaving behind debugfs files that referenced freed memory. This could lead to use-after-free conditions when reading those files.
A vulnerability in the Linux kernel's stmmac network driver involves the ptp_lock rwlock not being initialized at probe time. This lock is used even when the network interface is down and has never been opened, leading to undefined behavior due to use of an uninitialized lock. The issue is fixed by initializing ptp_lock during the driver probe phase.
A vulnerability in the Linux kernel's ath9k_htc wireless driver involved storing a usb_device_id that may not persist beyond the probe phase due to dynamic IDs. The issue was resolved by changing the code to store only driver_data, which is reliably accessible from the usb_device structure.
A social engineering campaign targeting security professionals uses fake consultancy offers and job opportunities to exploit trust. Attackers create sparse social media profiles claiming to be consultants, offering $300 for simple consultations on topics like digital transformation. The initial phone call serves as screening to identify targets with valuable access or knowledge. If successful, targets are asked to provide increasingly sensitive information through written reports, requiring them to abuse trusted access, probe internal systems, or leverage professional relationships. Similar variants include fake recruiters offering prestigious positions while requiring installation of trojanised software. These attacks exploit professional flattery and overconfidence, manipulating security practitioners into compromising their most valuable asset: professional integrity and trusted relationships within the industry.
A vulnerability in the Linux kernel's dpaa2-switch driver related to improper handling of NAPI instances on the remove path has been resolved. The issue arises because all NAPI instances for a DPSW device are attached to the first switch port's net_device but shared by all ports. During device removal, NAPI instances may be deleted prematurely before being disabled, due to unregister_netdev() and free_netdev() calls being combined. The fix separates these calls to ensure all ports go down before deleting NAPI instances and explicitly calls netif_napi_del() on the probe path.
A NULL pointer dereference vulnerability in the Linux kernel's usbip vhci_hcd driver was resolved. The issue occurs because platform_get_drvdata() can return NULL if a VHCI host controller's probe fails, but the code did not properly check for this before dereferencing. This could lead to a kernel crash or denial of service. The fix adds a NULL check before dereferencing and reorders function calls to handle error paths correctly.
A vulnerability in the Linux kernel related to the phy: fsl-imx8mq-usb driver has been fixed. The issue involved a resource leak of the typec switch when the probe function failed after a specific call succeeded. The cleanup was only performed during driver removal, which does not occur on probe failure, causing the leak. The fix ensures proper cleanup on both probe failure and driver removal.