CVE-2024-53089

Overview

Linux
Linux

21 Nov 2024

Published

01 Oct 2025

Updated

CVSS

Pending

EPSS

0.04%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Mark hrtimer to expire in hard interrupt context Like commit 2c0d278f3293f ("KVM: LAPIC: Mark hrtimer to expire in hard interrupt context") and commit 9090825fa9974 ("KVM: arm/arm64: Let the timer expire in hardirq context on RT"), On PREEMPT_RT enabled kernels unmarked hrtimers are moved into soft interrupt expiry mode by default. Then the timers are canceled from an preempt-notifier which is invoked with disabled preemption which is not allowed on PREEMPT_RT. The timer callback is short so in could be invoked in hard-IRQ context. So let the timer expire on hard-IRQ context even on -RT. This fix a "scheduling while atomic" bug for PREEMPT_RT enabled kernels: BUG: scheduling while atomic: qemu-system-loo/1011/0x00000002 Modules linked in: amdgpu rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ns CPU: 1 UID: 0 PID: 1011 Comm: qemu-system-loo Tainted: G W 6.12.0-rc2+ #1774 Tainted: [W]=WARN Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 Stack : ffffffffffffffff 0000000000000000 9000000004e3ea38 9000000116744000 90000001167475a0 0000000000000000 90000001167475a8 9000000005644830 90000000058dc000 90000000058dbff8 9000000116747420 0000000000000001 0000000000000001 6a613fc938313980 000000000790c000 90000001001c1140 00000000000003fe 0000000000000001 000000000000000d 0000000000000003 0000000000000030 00000000000003f3 000000000790c000 9000000116747830 90000000057ef000 0000000000000000 9000000005644830 0000000000000004 0000000000000000 90000000057f4b58 0000000000000001 9000000116747868 900000000451b600 9000000005644830 9000000003a13998 0000000010000020 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d ... Call Trace: [<9000000003a13998>] show_stack+0x38/0x180 [<9000000004e3ea34>] dump_stack_lvl+0x84/0xc0 [<9000000003a71708>] __schedule_bug+0x48/0x60 [<9000000004e45734>] __schedule+0x1114/0x1660 [<9000000004e46040>] schedule_rtlock+0x20/0x60 [<9000000004e4e330>] rtlock_slowlock_locked+0x3f0/0x10a0 [<9000000004e4f038>] rt_spin_lock+0x58/0x80 [<9000000003b02d68>] hrtimer_cancel_wait_running+0x68/0xc0 [<9000000003b02e30>] hrtimer_cancel+0x70/0x80 [<ffff80000235eb70>] kvm_restore_timer+0x50/0x1a0 [kvm] [<ffff8000023616c8>] kvm_arch_vcpu_load+0x68/0x2a0 [kvm] [<ffff80000234c2d4>] kvm_sched_in+0x34/0x60 [kvm] [<9000000003a749a0>] finish_task_switch.isra.0+0x140/0x2e0 [<9000000004e44a70>] __schedule+0x450/0x1660 [<9000000004e45cb0>] schedule+0x30/0x180 [<ffff800002354c70>] kvm_vcpu_block+0x70/0x120 [kvm] [<ffff800002354d80>] kvm_vcpu_halt+0x60/0x3e0 [kvm] [<ffff80000235b194>] kvm_handle_gspr+0x3f4/0x4e0 [kvm] [<ffff80000235f548>] kvm_handle_exit+0x1c8/0x260 [kvm]

Statistics

1 Post

Last activity: 9 hours ago

Bluesky

SecQube | Harvey | AI Platform for MS Graph @secqube.com

CVE-2024-53089 LoongArch: KVM: Mark hrtimer to expire in hard interrupt context scq.ms/4iEvBUS #SecQube #MicrosoftSecurity

0
0
0
9h ago

CVE-2025-39748

Overview

Linux
Linux

11 Sep 2025

Published

29 Sep 2025

Updated

CVSS

Pending

EPSS

0.02%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 goto <exit> 2: if r0 & Oxffffffff goto <exit> The issue is on the path where we fall through both jumps. That path is unreachable at runtime: after insn 1, we know r0 != 0, but with the sign extension on the jset, we would only fallthrough insn 2 if r0 == 0. Unfortunately, is_branch_taken() isn't currently able to figure this out, so the verifier walks all branches. The verifier then refines the register bounds using the second condition and we end up with inconsistent bounds on this unreachable path: 1: if r0 == 0 goto <exit> r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff) 2: if r0 & 0xffffffff goto <exit> r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0) r0 after reg_bounds_sync: u64=[0x1, 0] var_off=(0, 0) Improving the range refinement for JSET to cover all cases is tricky. We also don't expect many users to rely on JSET given LLVM doesn't generate those instructions. So instead of improving the range refinement for JSETs, Eduard suggested we forget the ranges whenever we're narrowing tnums after a JSET. This patch implements that approach.

Statistics

1 Post

Last activity: 13 hours ago

Bluesky

SecQube | Harvey | AI Platform for MS Graph @secqube.com

CVE-2025-39748 bpf: Forget ranges when refining tnum after JSET scq.ms/4aB9lsZ #SecQube #MicrosoftSecurity

0
0
0
13h ago

CVE-2025-66478

Overview

Pending

Pending

Published

03 Dec 2025

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This CVE is a duplicate of CVE-2025-55182.

Statistics

1 Post
1 Interaction

Last activity: 9 hours ago

Bluesky

technews4869 @technews4869.bsky.social

zenn.dev/satoyoshi/article... 【緊急】Next.js (CVE-2025-66478) / React (CVE-2025-55182) の脆弱性について

1
0
0
9h ago

CVE-2025-40209

Overview

Linux
Linux

21 Nov 2025

Published

01 Dec 2025

Updated

CVSS

Pending

EPSS

0.02%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation When btrfs_add_qgroup_relation() is called with invalid qgroup levels (src >= dst), the function returns -EINVAL directly without freeing the preallocated qgroup_list structure passed by the caller. This causes a memory leak because the caller unconditionally sets the pointer to NULL after the call, preventing any cleanup. The issue occurs because the level validation check happens before the mutex is acquired and before any error handling path that would free the prealloc pointer. On this early return, the cleanup code at the 'out' label (which includes kfree(prealloc)) is never reached. In btrfs_ioctl_qgroup_assign(), the code pattern is: prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL); ret = btrfs_add_qgroup_relation(trans, sa->src, sa->dst, prealloc); prealloc = NULL; // Always set to NULL regardless of return value ... kfree(prealloc); // This becomes kfree(NULL), does nothing When the level check fails, 'prealloc' is never freed by either the callee or the caller, resulting in a 64-byte memory leak per failed operation. This can be triggered repeatedly by an unprivileged user with access to a writable btrfs mount, potentially exhausting kernel memory. Fix this by freeing prealloc before the early return, ensuring prealloc is always freed on all error paths.

Statistics

1 Post

Last activity: 17 hours ago

Bluesky

OMO @omo.bsky.social

SIOSセキュリティブログを更新しました。 Linux Kernelの脆弱性(CVE-2025-40209〜CVE-2025-40344) #security #vulnerability #セキュリティ #脆弱性 #linux #kernel security.sios.jp/vulnerabilit...

0
0
0
17h ago

CVE-2025-59808

Overview

Fortinet
FortiSOAR on-premise

09 Dec 2025

Published

09 Dec 2025

Updated

CVSS v3.1

MEDIUM (6.5)

EPSS

0.04%

MITRE

KEV

Description

An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an attacker who has already gained access to a victim's user account to reset the account credentials without being prompted for the account's password

Statistics

1 Post

Last activity: 14 hours ago

Bluesky

セキュリティ対策Lab @securitylab-jp.bsky.social

FortinetのFortiSOAR / FortiWebに新たな認証関連の脆弱性(CVE-2025-59808／CVE-2025-64471) rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security #サイバー攻撃

0
0
0
14h ago

CVE-2025-64471

Overview

Fortinet
FortiWeb

09 Dec 2025

Published

10 Dec 2025

Updated

CVSS v3.1

MEDIUM (4.4)

EPSS

0.02%

MITRE

KEV

Description

A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests

Statistics

1 Post

Last activity: 14 hours ago

Bluesky

セキュリティ対策Lab @securitylab-jp.bsky.social

FortinetのFortiSOAR / FortiWebに新たな認証関連の脆弱性(CVE-2025-59808／CVE-2025-64471) rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security #サイバー攻撃

0
0
0
14h ago

CVE-2025-14372

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post

Last activity: 9 hours ago

Fediverse

Cybersecurity & cyberwarfare @cybersecurity

Chrome sotto attacco! Google rilascia d’urgenza una patch per un bug senza CVE

Un aggiornamento urgente è stato pubblicato da Google per la versione stabile del browser Desktop, al fine di risolvere una vulnerabilità estremamente grave che è attualmente oggetto di sfruttamento.

Questo aggiornamento, che porta il browser alla versione 143.0.7499.109/.110, risolve tre vulnerabilità di sicurezza, compresa una falla zero-day contrassegnata come 466192044. Google, diversamente dal solito, ha tenuto nascosti i dettagli del suo identificatore CVE, limitandosi a indicarlo come “In fase di coordinamento”.

Google ha inoltre risolto, altre due vulnerabilità di media gravità segnalate da esperti di sicurezza esterni. Per questo, sono stati assegnati complessivamente 4.000 dollari nell’ambito del programma di bounty per i bug e sono:

CVE-2025-14372: una vulnerabilità di tipo “use-after-free” nel Password Manager. Questo bug di danneggiamento della memoria è stato segnalato da Weipeng Jiang (@Krace) di VRI il 14 novembre 2025, che ha fruttato una ricompensa di 2.000 dollari.
CVE-2025-14373: Un’implementazione inappropriata nella barra degli strumenti. Scoperta dal ricercatore Khalil Zhani il 18 novembre 2025, anche questa falla comportava una ricompensa di 2.000 dollari.

Ritornando alla precedente vulnerabilità senza CVE, l’azienda ha riportato un monito severo: “È noto a Google che esista un exploit specifico del numero 466192044″. Ciò conferma che gli autori della minaccia hanno già sfruttato la falla per colpire gli utenti.

La condizione di “coordinamento in corso” implica che la vulnerabilità potrebbe implicare un’ulteriore cooperazione con altri fornitori, prima di poter rendere pubblici i dettagli tecnici completi in piena sicurezza.

L’aggiornamento è ora disponibile per gli utenti Windows, Mac e Linux. Dato lo sfruttamento attivo della vulnerabilità ad alta gravità, si consiglia vivamente ad amministratori e utenti di non attendere il rilascio automatico.

L'articolo Chrome sotto attacco! Google rilascia d’urgenza una patch per un bug senza CVE proviene da Red Hot Cyber.

0
0
0
9h ago

CVE-2025-14373

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post

Last activity: 9 hours ago

Fediverse

Cybersecurity & cyberwarfare @cybersecurity

Chrome sotto attacco! Google rilascia d’urgenza una patch per un bug senza CVE

Un aggiornamento urgente è stato pubblicato da Google per la versione stabile del browser Desktop, al fine di risolvere una vulnerabilità estremamente grave che è attualmente oggetto di sfruttamento.

Questo aggiornamento, che porta il browser alla versione 143.0.7499.109/.110, risolve tre vulnerabilità di sicurezza, compresa una falla zero-day contrassegnata come 466192044. Google, diversamente dal solito, ha tenuto nascosti i dettagli del suo identificatore CVE, limitandosi a indicarlo come “In fase di coordinamento”.

Google ha inoltre risolto, altre due vulnerabilità di media gravità segnalate da esperti di sicurezza esterni. Per questo, sono stati assegnati complessivamente 4.000 dollari nell’ambito del programma di bounty per i bug e sono:

CVE-2025-14372: una vulnerabilità di tipo “use-after-free” nel Password Manager. Questo bug di danneggiamento della memoria è stato segnalato da Weipeng Jiang (@Krace) di VRI il 14 novembre 2025, che ha fruttato una ricompensa di 2.000 dollari.
CVE-2025-14373: Un’implementazione inappropriata nella barra degli strumenti. Scoperta dal ricercatore Khalil Zhani il 18 novembre 2025, anche questa falla comportava una ricompensa di 2.000 dollari.

Ritornando alla precedente vulnerabilità senza CVE, l’azienda ha riportato un monito severo: “È noto a Google che esista un exploit specifico del numero 466192044″. Ciò conferma che gli autori della minaccia hanno già sfruttato la falla per colpire gli utenti.

La condizione di “coordinamento in corso” implica che la vulnerabilità potrebbe implicare un’ulteriore cooperazione con altri fornitori, prima di poter rendere pubblici i dettagli tecnici completi in piena sicurezza.

L’aggiornamento è ora disponibile per gli utenti Windows, Mac e Linux. Dato lo sfruttamento attivo della vulnerabilità ad alta gravità, si consiglia vivamente ad amministratori e utenti di non attendere il rilascio automatico.

L'articolo Chrome sotto attacco! Google rilascia d’urgenza una patch per un bug senza CVE proviene da Red Hot Cyber.

0
0
0
9h ago

CVE-2025-61985

Overview

OpenBSD
OpenSSH

06 Oct 2025

Published

06 Oct 2025

Updated

CVSS v3.1

LOW (3.6)

EPSS

0.01%

MITRE

KEV

Description

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

Statistics

1 Post

Last activity: 22 hours ago

Bluesky

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

Technical Deep Dive: New #OpenSSH vulnerabilities patched in #SUSE Linux Micro 6.2. CVE-2025-61984 (control chars in username) & CVE-2025-61985 (NULL char in ssh:// URI) both exploit ProxyCommand parsing. Read more: 👉 tinyurl.com/4y7a4xx6 #Security

0
0
0
22h ago

CVE-2025-40344

Overview

Linux
Linux

09 Dec 2025

Published

09 Dec 2025

Updated

CVSS

Pending

EPSS

0.02%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context, these two operations shall be synchronized to avoid slab-use-after-free or worse errors.

Statistics

1 Post

Last activity: 17 hours ago

Bluesky

OMO @omo.bsky.social

SIOSセキュリティブログを更新しました。 Linux Kernelの脆弱性(CVE-2025-40209〜CVE-2025-40344) #security #vulnerability #セキュリティ #脆弱性 #linux #kernel security.sios.jp/vulnerabilit...

0
0
0
17h ago