Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
A flaw in the Linux kernel's ucs2_string.c code causes an out-of-bounds read in the ucs2_strnlen() function, which an attacker could potentially exploit to read memory beyond the intended buffer. This could be relevant where the Linux kernel is deployed in automotive systems, such as infotainment or telematics units. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's PCI sysfs legacy_io interface causes an out-of-bounds read when a user writes 1 or 2 bytes, because the code always loads 4 bytes from a smaller buffer; on little-endian PowerPC this could also cause an out-of-bounds write. The legacy_io file is root-only and exists only on Alpha and PowerPC systems, and the issue is a memory-safety bug rather than a confirmed vehicle or ECU vulnerability. This could be relevant where Linux-based PCI legacy I/O support is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's Rockchip Samsung DC-PHY driver sets the register map's maximum address one register past the end of the 64KB PHY register block, so reading the registers through the regmap debugfs interface accesses memory beyond the mapped region and crashes the kernel. Because the crash occurs while the regmap lock is held, subsequent PHY operations can deadlock. This could be relevant where this Rockchip PHY driver is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's zram compressed-RAM block device driver contains an out-of-bounds access in read_block_state() where a race during device reset and reinitialization with a smaller disksize can cause the code to access past the end of the newly allocated table. An attacker able to trigger this race could cause an out-of-bounds memory access, though the advisory does not state a severity rating. This could be relevant where the Linux kernel zram driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel zram compressed-RAM block device does not validate user-supplied deflate window-bits parameters before passing them to zlib, which can trigger a kernel BUG_ON and crash the system. An attacker able to supply crafted parameters could cause a denial of service. This could be relevant where the Linux kernel and zram are deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A reference leak in the Linux kernel's NFS localio code can occur when a file lookup races with teardown, causing the system to hold onto file and network resources that should have been released. An attacker able to trigger this race repeatedly could exhaust these resources and prevent network namespace cleanup, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's NFS localio feature is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A memory leak in the Linux kernel's NFSv4 client code causes roughly 4 KiB of kernel memory to be lost each time an NFSv4 mount attempt fails, and repeated failed mount attempts can exhaust kernel memory over time. The issue is triggered by unprivileged userspace actions such as retrying a mount against a server that does not support NFSv4, and the advisory does not state a formal severity rating. This could be relevant where the Linux NFS client is deployed in automotive systems, for example in telematics or fleet units mounting network storage. Confirm applicability through the product SBOM or dependency inventory.
A time-of-check-to-time-of-use flaw in the Linux kernel's NFS server (NFSD) could let a remote client bypass the append-only truncation permission check on a file, causing an unintended truncation. The advisory does not state a severity score. This could be relevant where the Linux kernel's NFS server component is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A use-after-free vulnerability in the Linux kernel's NFS server code (NFSD) could let an attacker crash or corrupt kernel memory when the server handles inter-server copy mounts, because a list entry can be freed by another thread while the expiry routine is still using it. The flaw is in the nfsd4_ssc_expire_umount function, which walks a list of source mounts and can dereference a freed item after dropping a lock. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NFS server (NFSD) contained a flaw where a warning check in the nfsd_mode_check function was based on an invalid assumption, which could be triggered when NFSD re-exports an NFS filesystem. The fix removes the flawed warning while keeping the error return that prevents a client lookup from dereferencing a NULL method pointer, which could otherwise cause a crash. This could be relevant where the Linux kernel's NFS server component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's NFSv4.1 client code can leak memory when a server returns a new layout state identifier while a valid one is still held, because a cleanup step on the error path was removed by an earlier change. An attacker able to act as a malicious or compromised NFS server could repeatedly trigger this path to exhaust kernel memory over time, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, for example in infotainment or telematics units that mount NFS shares; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NFS server component (nfsd) fails to release mount and dentry references when a cross-mount lookup fails, causing a resource leak that can block filesystem unmounts and pin memory. Any authenticated NFS client can trigger this repeatedly through normal lookup or directory-read operations, gradually exhausting resources. The advisory does not state a severity rating. This could be relevant where the Linux kernel's NFS server is deployed in automotive systems, for example in-vehicle infotainment or telematics backends that export filesystems over NFS. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NFS server component (nfsd) contains a flaw in its handling of asynchronous COPY operations: when the writeback of copied data fails, the server does not rotate its write verifier, so a client can wrongly conclude the data was made durable and silently lose it. An attacker or faulty storage could thereby cause data loss or corruption in NFS-served file systems, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's NFS server is deployed in automotive systems, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NFS server component (nfsd) has a flaw where a status counter is not reset correctly on several request-handling exit paths, leaving it in an inconsistent state. This can let a concurrent reader access request data while it is still being modified, potentially reading beyond the bounds of an internal operations array. The advisory does not state a severity rating. This could be relevant where the Linux kernel's NFS server is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's NFS server (nfsd) copy-offload code could cause a failed data write to be reported to the client as successfully committed, resulting in silent data loss. An attacker able to trigger concurrent write and copy operations on the same file could exploit this race condition, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's NFS server component is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's NFS server (nfsd) tracepoints for file-handle verification can, on NFSv2/v3 over UDP, write past the end of a trace ring-buffer slot, and in other cases leak prior ring-buffer contents to trace consumers. The advisory does not state a severity rating. This could be relevant where the Linux kernel's NFS server component is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's NFS server (nfsd) allows a malformed network request to supply an out-of-range nanosecond value that is not validated before being stored and passed on to disk operations. An attacker able to send crafted NFS requests could trigger this condition, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's NFS server component is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's NFS server (nfsd) netlink listener configuration allows a caller with CAP_NET_ADMIN privileges to send a malformed address that triggers a 12-byte out-of-bounds read, and the advisory does not state a severity rating. The issue is fixed by validating each listener entry's address length against its address family before any configuration changes are applied. This could be relevant where the Linux kernel's nfsd component is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NFS server component (nfsd) has a flaw where it accepts an unbounded symlink target length during NFSv4 CREATE operations, allowing a client to force large memory allocations of up to several megabytes per operation that persist until the request completes. An attacker could repeatedly trigger these allocations to exhaust server memory, though the advisory does not state a formal severity rating. This could be relevant where the Linux kernel's NFS server is deployed in automotive systems, such as in-vehicle infotainment or telematics back-end infrastructure. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NFS server component has a flaw where IPv6 client addresses are stored in a buffer that is too small, causing it to read and expose adjacent memory contents. Any unprivileged process in the network namespace can trigger this and obtain truncated IPv6 addresses plus 8 bytes of unrelated internal data through a netlink interface. This could be relevant where the Linux kernel's NFS server is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel NFS server (nfsd) has a flaw in its SETATTR handling where a file attribute change can run without holding a mount write reference. An attacker able to trigger this path could cause a write operation to proceed without the expected protection, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel NFS server component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's NFS server (nfsd) component, when a specific NFSv4.2 feature is enabled, allows a remote client to send a crafted request that triggers a NULL pointer dereference, crashing the nfsd kernel thread. The issue affects the kernel's NFS server code and has been fixed by restricting which operations may proceed after a foreign filehandle is used. This could be relevant where the Linux kernel's NFS server is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The advisory describes a flaw in the Linux kernel's nfsd component involving a failure to check client ownership when cancelling a copy-notify stateid. An attacker could potentially exploit this to cause improper stateid handling, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NFS server component (nfsd) fails to limit the number of POSIX ACL entries it accepts from a network client, allowing a client to supply an arbitrarily large count that drives excessive CPU use through an inefficient sorting routine. An attacker able to send crafted NFS requests could cause a denial of service on the affected server. This could be relevant where the Linux kernel's NFS server is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NFS server (nfsd) fails to check the return value of nfsd4_acl_to_attr() in nfsd4_create(), so errors translating an access control list are silently discarded and a CREATE request proceeds without the requested ACL. An attacker able to send such requests could create objects lacking the intended access controls, weakening access restrictions. The advisory does not state a severity rating. This could be relevant where the Linux kernel NFS server is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.