These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2024-36959 is a reference count leak vulnerability in the Linux kernel's pinctrl subsystem, specifically within the pinctrl_dt_to_map() function in the devicetree handling code. The flaw occurs when memory allocation for a property name buffer fails after a reference count has been incremented; without proper cleanup, this leads to a resource leak. The vulnerability has been resolved in the upstream L [truncated]
CVE-2024-36957 is an off-by-one read vulnerability in the Linux kernel's octeontx2-af driver. The flaw occurs when the driver attempts to allocate `count + 1` bytes via `memdup_user(buffer, count + 1)` while userspace only provides a buffer of `count` bytes. This results in reading one byte beyond the verified userspace buffer boundary. The vulnerability was resolved by replacing `memdup_user` with `memdu [truncated]
A memory leak vulnerability exists in the Linux kernel's Transparent Inter-Process Communication (TIPC) protocol implementation, specifically within the `tipc_buf_append` function. The issue arises because `__skb_linearize()` does not free the socket buffer (skb) when it fails, and the original code set `*buf = NULL` before calling this function. This sequence prevented proper deallocation of the skb on e [truncated]
A vulnerability in the Linux kernel's Phonet protocol implementation has been resolved. The issue was in the `rtm_phonet_notify()` function, which incorrectly calculated the required socket buffer (skb) allocation size when preparing route notification messages. The function failed to properly account for all three components stored by `fill_route()`: the `struct rtmsg` header, the `RTA_DST` attribute (1 [truncated]
A double-free vulnerability exists in the Linux kernel's pinctrl subsystem. The `pctldev` structure is allocated via `devm_pinctrl_register_and_init()` as a managed resource, meaning it is automatically freed by `devm_pinctrl_dev_release()`. However, `pinctrl_enable()` incorrectly frees this same structure, causing a double-free condition. This flaw can lead to kernel memory corruption and system instabil [truncated]
CVE-2024-36938 is a denial-of-service vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) socket message subsystem. The flaw involves NULL pointer dereference and data-race conditions in the sk_psock_skb_ingress_enqueue() function, which was reported by syzbot. The vulnerability has a CVSS score of 5.5 (MEDIUM severity). Siemens has identified this CVE as affecting certain industrial networki [truncated]
A vulnerability in the Linux kernel's Brocade BNA (Brocade Network Adapter) driver could allow an out-of-bounds (OOB) read when processing user-supplied data. The issue stems from improper string termination: the driver allocates a kernel buffer sized exactly to the number of bytes copied from userspace, then passes this buffer to sscanf without ensuring NUL termination. This can cause sscanf to read beyo [truncated]
CVE-2024-36933 is a vulnerability in the Linux kernel's NSH (Network Service Header) GSO (Generic Segmentation Offload) handling code, specifically in the `nsh_gso_segment()` function. The flaw involves improper restoration of SKB (socket buffer) header fields when processing segmented packets with outer headers, which could lead to header corruption and potential kernel crashes or undefined behavior. The [truncated]
CVE-2024-36929 is a medium-severity vulnerability in the Linux kernel's networking stack affecting SKB_GSO_FRAGLIST socket buffers. The issue stems from improper handling of fraglist GSO skbs in skb_copy() and skb_copy_expand() functions, which can linearize these buffers and render them invalid. This invalidation may subsequently trigger a crash when skb_gso_segment() is called on the corrupted buffer. T [truncated]
A vulnerability in the Linux kernel's TCP stack affects Siemens industrial networking products. The issue involves improper handling of shutdown(SEND_SHUTDOWN) for sockets in the TCP_SYN_RECV state, which could lead to denial of service conditions. The vulnerability has been resolved in the upstream Linux kernel by deferring the shutdown operation for sockets in this specific state. Siemens has addressed [truncated]
A use-after-free vulnerability exists in the Linux kernel's TCP implementation within the tcp_twsk_unique() function. The flaw stems from improper reference counting when handling TCP TIME_WAIT sockets, potentially allowing a local attacker to trigger a denial of service condition. The vulnerability was resolved by replacing the reference count increment with refcount_inc_not_zero() to safely handle cases [truncated]
CVE-2024-36902 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 fib6_rules subsystem. The flaw exists in fib6_rule_action() where ip6_dst_idev() can return NULL but is used without validation, leading to a kernel crash. This vulnerability was discovered by syzbot and affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-fa [truncated]
A NULL pointer dereference vulnerability exists in the Linux kernel's IPv6 networking stack. The function ip6_dst_idev() may return NULL in ip6_output(), leading to a potential NULL dereference. This vulnerability was identified through syzbot automated kernel fuzzing. The issue affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switc [truncated]
A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation could allow improper initialization of sequence numbers during early fallback to TCP, potentially leading to memory corruption or denial of service conditions. The issue stems from uninitialized snd_nxt and write_seq values when MPTCP falls back to TCP on client sockets before proper initialization. This affects Siemens industrial [truncated]
This CVE addresses a race condition in the Linux kernel's networking subsystem that could lead to out-of-bounds memory access. The vulnerability exists in the `net_alloc_generic` function, which is called by `net_alloc` without proper locking. The function reads `max_gen_ptrs` twice—once to allocate an array and again to set `s.len`—creating a window where a concurrent thread registering new pernet operat [truncated]
A missing write memory barrier in the Linux kernel's TLS (Transport Layer Security) subsystem initialization function `tls_init()` can lead to NULL pointer dereference vulnerabilities. Under specific store-store reordering conditions on affected processors, this memory ordering bug may cause `tls_setsockopt()` or `tls_getsockopt()` to dereference a NULL pointer, resulting in local denial of service. The v [truncated]
A vulnerability in the Linux kernel's networking subsystem has been resolved. The issue involved overly strict socket state checks during the accept() system call, which could lead to unexpected connection handling behavior. The fix relaxes these state checks to improve network socket handling robustness.
A vulnerability in the Linux kernel's SUNRPC subsystem affects Siemens industrial networking products running SINEC OS. The flaw exists in the gss_free_in_token_pages() function, where the in_token->pages[] array lacks proper NULL termination, causing the loop to read beyond array bounds. This results in a KASAN-detected wild-memory-access condition. The vulnerability is rated MEDIUM severity (CVSS 5.5) w [truncated]
A vulnerability in the Linux kernel's netfilter nfnetlink_queue subsystem has been resolved. The issue involved a missing RCU read lock in the instance_destroy_rcu() function, which could lead to use-after-free conditions or race conditions during cleanup operations. This affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. Th [truncated]
CVE-2024-36270 is a medium-severity vulnerability (CVSS 5.5) in the Linux kernel's netfilter tproxy subsystem. The flaw occurs when the Transparent Proxy (TPROXY) functionality fails to properly validate whether IP networking has been disabled on a network device before processing packets. This can lead to a general protection fault due to dereferencing a non-canonical address, resulting in a local denial [truncated]
A critical vulnerability in the Linux kernel's key management subsystem allows unconditional overwriting of key expiration times during instantiation, causing DNS resolution failures by setting expiration to TIME64_MAX and disabling further DNS updates. The vulnerability affects Siemens industrial networking products running SINEC OS, including RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG [truncated]
CVE-2024-36017 is a Linux kernel vulnerability in the rtnetlink subsystem affecting nested IFLA_VF_VLAN_LIST attribute validation. The flaw exists because the size validation in do_setvfinfo checks against NLA_HDRLEN (4 bytes) rather than sizeof(struct ifla_vf_vlan_info) (14 bytes). This insufficient validation allows a too-small attribute to be cast to struct ifla_vf_vlan_info, potentially causing an out [truncated]
A NULL pointer dereference vulnerability exists in the Linux kernel's IPv4 routing subsystem. The flaw occurs in ip_route_use_hint() when the function fails to validate that the idev (in-device) pointer is non-NULL before use. This can lead to a kernel crash via NULL dereference in fib_validate_source(). The vulnerability was discovered by syzbot and affects current kernel trees. Siemens has identified th [truncated]
A vulnerability in the Linux kernel's Mellanox switch driver (mlxsw) could cause system warnings due to improper state handling during ACL TCAM rehash operations. The flaw occurs when error recovery fails to reset all migration markers, potentially causing the rehash work to resume from an invalid entry position. This can lead to a chunk structure being incorrectly processed as an entry, generating warnin [truncated]
A vulnerability in the Linux kernel's Mellanox switch driver (mlxsw) spectrum ACL TCAM component was resolved through a fix for incorrect list API usage. The issue, rated CVSS 3.1 5.5 (MEDIUM), could lead to local denial of service conditions. Siemens has identified this vulnerability as affecting certain industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-f [truncated]
CVE-2024-36005 is a vulnerability in the Linux kernel's netfilter nf_tables subsystem, specifically affecting how the table dormant flag is handled during netdev release events. The flaw could allow a local attacker to cause a denial of service condition. The vulnerability has been assigned a CVSS 3.1 score of 5.5 (MEDIUM severity) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local atta [truncated]
CVE-2024-35996 addresses a Linux kernel issue where CPU mitigations were not enabled by default on non-x86 architectures, potentially leaving systems vulnerable to speculative execution attacks. The vulnerability stems from the kernel's CPU mitigation framework defaulting to disabled states on architectures other than x86, contrary to security best practices. Siemens has identified this as affecting SINEC [truncated]
A locking issue in the Xilinx DPDMA driver for Linux kernel could allow a local attacker to cause a denial of service condition. The vulnerability exists in the DMA subsystem's Xilinx DPDMA implementation where improper locking mechanisms may lead to race conditions or resource contention. A successful exploit requires local access with low privileges and no user interaction, resulting in high availabilit [truncated]
A NULL function pointer dereference vulnerability exists in the I2C SMBus subsystem of the Linux kernel. This flaw can lead to a local denial-of-service condition when an attacker with low privileges triggers the dereference, resulting in system instability or crash. The vulnerability is classified as MEDIUM severity with a CVSS 3.1 score of 5.5, indicating localized impact without confidentiality or inte [truncated]
A bounds-checking vulnerability in the Linux kernel's CPU configuration handling affects Siemens industrial network devices. The flaw occurs when CONFIG_NR_CPUS is set to a power-of-two value, causing incorrect bit-width calculations that can lead to out-of-bounds access. This local vulnerability requires low privileges and no user interaction, resulting in high availability impact through potential denia [truncated]