CWE-908
AllowedUse of Uninitialized Resource
Abstraction: Base · Status: Incomplete
The product uses or accesses a resource that has not been initialized.
821 vulnerabilities reference this CWE, most recent first.
GHSA-WCPP-3X59-H8VP
Vulnerability from github – Published: 2026-03-12 21:34 – Updated: 2026-07-14 15:31Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.
{
"affected": [],
"aliases": [
"CVE-2026-3497"
],
"database_specific": {
"cwe_ids": [
"CWE-824",
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-12T19:16:19Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.",
"id": "GHSA-wcpp-3x59-h8vp",
"modified": "2026-07-14T15:31:40Z",
"published": "2026-03-12T21:34:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10065"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21690"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21695"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25096"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:5475"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6462"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6463"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7107"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9415"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9732"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-3497"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447085"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00014.html"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3497.json"
},
{
"type": "WEB",
"url": "https://ubuntu.com/security/CVE-2026-3497"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/03/12/3"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10714"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:12071"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13750"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13812"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14773"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14924"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:15087"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:15891"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:15893"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16008"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16009"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16030"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16174"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17596"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19724"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19725"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20040"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20087"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/03/12/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/03/14/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/03/14/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/03/18/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/03/18/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/03/18/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/03/18/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WG2F-J4PF-5GPX
Vulnerability from github – Published: 2022-12-22 21:30 – Updated: 2025-04-15 21:31A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
{
"affected": [],
"aliases": [
"CVE-2022-31741"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T20:15:00Z",
"severity": "HIGH"
},
"details": "A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird \u003c 91.10, Firefox \u003c 101, and Firefox ESR \u003c 91.10.",
"id": "GHSA-wg2f-j4pf-5gpx",
"modified": "2025-04-15T21:31:24Z",
"published": "2022-12-22T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31741"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1767590"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-20"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-21"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WG9W-JQP9-M5G6
Vulnerability from github – Published: 2024-08-06 00:31 – Updated: 2024-08-06 00:31oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23308.
{
"affected": [],
"aliases": [
"CVE-2024-7541"
],
"database_specific": {
"cwe_ids": [
"CWE-457",
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-06T00:15:35Z",
"severity": "LOW"
},
"details": "oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.\n\nThe specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23308.",
"id": "GHSA-wg9w-jqp9-m5g6",
"modified": "2024-08-06T00:31:20Z",
"published": "2024-08-06T00:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7541"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1081"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WGCR-4FM9-RF2F
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2022-05-24 17:08Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
{
"affected": [],
"aliases": [
"CVE-2020-6398"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-11T15:15:00Z",
"severity": "MODERATE"
},
"details": "Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.",
"id": "GHSA-wgcr-4fm9-rf2f",
"modified": "2022-05-24T17:08:39Z",
"published": "2022-05-24T17:08:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6398"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0514"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1032090"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202003-08"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4638"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WH96-X644-CVGJ
Vulnerability from github – Published: 2022-05-24 17:21 – Updated: 2022-05-24 17:21VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisor's memory. Additional conditions beyond the attacker's control need to be present for exploitation to be possible.
{
"affected": [],
"aliases": [
"CVE-2020-3964"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-25T15:15:00Z",
"severity": "LOW"
},
"details": "VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisor\u0027s memory. Additional conditions beyond the attacker\u0027s control need to be present for exploitation to be possible.",
"id": "GHSA-wh96-x644-cvgj",
"modified": "2022-05-24T17:21:40Z",
"published": "2022-05-24T17:21:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3964"
},
{
"type": "WEB",
"url": "https://www.vmware.com/security/advisories/VMSA-2020-0015.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/158459/VMware-ESXi-Use-After-Free-Out-Of-Bounds-Access.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Jul/22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WJH6-3XG7-C2H2
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-06-19 15:33In the Linux kernel, the following vulnerability has been resolved:
hfsplus: fix uninit-value by validating catalog record size
Syzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The root cause is that hfs_brec_read() doesn't validate that the on-disk record size matches the expected size for the record type being read.
When mounting a corrupted filesystem, hfs_brec_read() may read less data than expected. For example, when reading a catalog thread record, the debug output showed:
HFSPLUS_BREC_READ: rec_len=520, fd->entrylength=26 HFSPLUS_BREC_READ: WARNING - entrylength (26) < rec_len (520) - PARTIAL READ!
hfs_brec_read() only validates that entrylength is not greater than the buffer size, but doesn't check if it's less than expected. It successfully reads 26 bytes into a 520-byte structure and returns success, leaving 494 bytes uninitialized.
This uninitialized data in tmp.thread.nodeName then gets copied by hfsplus_cat_build_key_uni() and used by hfsplus_strcasecmp(), triggering the KMSAN warning when the uninitialized bytes are used as array indices in case_fold().
Fix by introducing hfsplus_brec_read_cat() wrapper that: 1. Calls hfs_brec_read() to read the data 2. Validates the record size based on the type field: - Fixed size for folder and file records - Variable size for thread records (depends on string length) 3. Returns -EIO if size doesn't match expected
For thread records, check against HFSPLUS_MIN_THREAD_SZ before reading nodeName.length to avoid reading uninitialized data at call sites that don't zero-initialize the entry structure.
Also initialize the tmp variable in hfsplus_find_cat() as defensive programming to ensure no uninitialized data even if validation is bypassed.
{
"affected": [],
"aliases": [
"CVE-2026-46169"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:32Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix uninit-value by validating catalog record size\n\nSyzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The\nroot cause is that hfs_brec_read() doesn\u0027t validate that the on-disk\nrecord size matches the expected size for the record type being read.\n\nWhen mounting a corrupted filesystem, hfs_brec_read() may read less data\nthan expected. For example, when reading a catalog thread record, the\ndebug output showed:\n\n HFSPLUS_BREC_READ: rec_len=520, fd-\u003eentrylength=26\n HFSPLUS_BREC_READ: WARNING - entrylength (26) \u003c rec_len (520) - PARTIAL READ!\n\nhfs_brec_read() only validates that entrylength is not greater than the\nbuffer size, but doesn\u0027t check if it\u0027s less than expected. It successfully\nreads 26 bytes into a 520-byte structure and returns success, leaving 494\nbytes uninitialized.\n\nThis uninitialized data in tmp.thread.nodeName then gets copied by\nhfsplus_cat_build_key_uni() and used by hfsplus_strcasecmp(), triggering\nthe KMSAN warning when the uninitialized bytes are used as array indices\nin case_fold().\n\nFix by introducing hfsplus_brec_read_cat() wrapper that:\n1. Calls hfs_brec_read() to read the data\n2. Validates the record size based on the type field:\n - Fixed size for folder and file records\n - Variable size for thread records (depends on string length)\n3. Returns -EIO if size doesn\u0027t match expected\n\nFor thread records, check against HFSPLUS_MIN_THREAD_SZ before reading\nnodeName.length to avoid reading uninitialized data at call sites that\ndon\u0027t zero-initialize the entry structure.\n\nAlso initialize the tmp variable in hfsplus_find_cat() as defensive\nprogramming to ensure no uninitialized data even if validation is\nbypassed.",
"id": "GHSA-wjh6-3xg7-c2h2",
"modified": "2026-06-19T15:33:13Z",
"published": "2026-05-28T12:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46169"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3003dbf62d151d47a6b90f71655292a51a05f244"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3bc337697c66db2e2a4a94f0509c282c1a014b86"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/61a790974ff7e533acbceca06c7d02f22bf96d4d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8be69532e399eec9d9d990f6958b4ff2383b19b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/93e8d613f1a01b6637f387cc93f184cf7fb881d6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a420904450962a562ad053a41a53a27755021b48"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b6b592275aeff184aa82fcf6abccd833fb71b393"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c91bbd6193c70a02c50c22e0fb1f60c3c5bd053a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJHP-5P5W-QMHH
Vulnerability from github – Published: 2026-05-01 15:30 – Updated: 2026-05-08 21:31In the Linux kernel, the following vulnerability has been resolved:
net: use skb_header_pointer() for TCPv4 GSO frag_off check
Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1].
gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths.
Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying.
[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407
{
"affected": [],
"aliases": [
"CVE-2026-43036"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-01T15:16:48Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: use skb_header_pointer() for TCPv4 GSO frag_off check\n\nSyzbot reported a KMSAN uninit-value warning in gso_features_check()\ncalled from netif_skb_features() [1].\n\ngso_features_check() reads iph-\u003efrag_off to decide whether to clear\nmangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr()\ncan rely on skb header offsets that are not always safe for direct\ndereference on packets injected from PF_PACKET paths.\n\nUse skb_header_pointer() for the TCPv4 frag_off check so the header read\nis robust whether data is already linear or needs copying.\n\n[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407",
"id": "GHSA-wjhp-5p5w-qmhh",
"modified": "2026-05-08T21:31:20Z",
"published": "2026-05-01T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43036"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cc91202fc20a44aab4c206f12a2bfe05da936051"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d970341cfa5594614c7a6634886c7688b4f5cafd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f7a6cd508e9e825a2c69fa9e13d41ee156852f25"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJWQ-GX2G-VRJG
Vulnerability from github – Published: 2024-04-28 15:30 – Updated: 2024-06-03 18:53In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()
nf_osf_find() incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nft_osf which can be used to leak stale kernel stack data to userspace.
{
"affected": [],
"aliases": [
"CVE-2022-48654"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-28T13:15:07Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()\n\nnf_osf_find() incorrectly returns true on mismatch, this leads to\ncopying uninitialized memory area in nft_osf which can be used to leak\nstale kernel stack data to userspace.",
"id": "GHSA-wjwq-gx2g-vrjg",
"modified": "2024-06-03T18:53:44Z",
"published": "2024-04-28T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48654"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/559c36c5a8d730c49ef805a72b213d3bba155cc8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5d75fef3e61e797fab5c3fbba88caa74ab92ad47"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/633c81c0449663f57d4138326d036dc6cfad674e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/721ea8ac063d70c2078c4e762212705de6151764"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/816eab147e5c6f6621922b8515ad9010ceb1735e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WPPH-CWVV-GCMQ
Vulnerability from github – Published: 2024-08-13 18:31 – Updated: 2024-08-13 18:31Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-38122"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T18:15:13Z",
"severity": "MODERATE"
},
"details": "Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability",
"id": "GHSA-wpph-cwvv-gcmq",
"modified": "2024-08-13T18:31:16Z",
"published": "2024-08-13T18:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38122"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38122"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WR2W-MF8C-JF9V
Vulnerability from github – Published: 2026-07-14 18:31 – Updated: 2026-07-14 18:31Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.
{
"affected": [],
"aliases": [
"CVE-2026-40422"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T17:16:47Z",
"severity": "MODERATE"
},
"details": "Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.",
"id": "GHSA-wr2w-mf8c-jf9v",
"modified": "2026-07-14T18:31:58Z",
"published": "2026-07-14T18:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40422"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40422"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
Mitigation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
Mitigation
Avoid race conditions (CWE-362) during initialization routines.
Mitigation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
No CAPEC attack patterns related to this CWE.