Action not permitted
Modal body text goes here.
Modal Title
Modal Body
WID-SEC-W-2024-1875
Vulnerability from csaf_certbund
Published
2024-08-18 22:00
Modified
2025-01-13 23:00
Summary
Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder unbekannte Auswirkungen zu erzielen.
Betroffene Betriebssysteme
- Linux
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Der Kernel stellt den Kern des Linux Betriebssystems dar.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren oder unbekannte Auswirkungen zu erzielen.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-1875 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1875.json" }, { "category": "self", "summary": "WID-SEC-2024-1875 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1875" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2023-52889 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081739-CVE-2023-52889-cdd0@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42260 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081734-CVE-2024-42260-0ce0@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42261 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081736-CVE-2024-42261-f6a2@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42262 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081736-CVE-2024-42262-7156@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42263 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081737-CVE-2024-42263-31b3@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42264 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081737-CVE-2024-42264-5d23@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42265 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081737-CVE-2024-42265-a943@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42266 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081738-CVE-2024-42266-529f@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42267 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081738-CVE-2024-42267-9f79@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42268 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081738-CVE-2024-42268-2084@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42269 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081739-CVE-2024-42269-7d0a@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42270 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081739-CVE-2024-42270-c752@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42271 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081739-CVE-2024-42271-c501@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42272 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081739-CVE-2024-42272-c687@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42273 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081740-CVE-2024-42273-9b87@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42274 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081740-CVE-2024-42274-9dc6@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42275 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081740-CVE-2024-42275-8f91@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42276 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081741-CVE-2024-42276-cb0a@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42277 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081741-CVE-2024-42277-997a@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42278 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081742-CVE-2024-42278-e639@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42279 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081742-CVE-2024-42279-91b0@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42280 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081742-CVE-2024-42280-b97c@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42281 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081743-CVE-2024-42281-780b@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42282 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081743-CVE-2024-42282-85ea@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42283 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081743-CVE-2024-42283-15a5@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42284 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081743-CVE-2024-42284-bbfa@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42285 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081744-CVE-2024-42285-37ec@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42286 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081744-CVE-2024-42286-e856@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42287 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081744-CVE-2024-42287-d635@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42288 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081745-CVE-2024-42288-c59b@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42289 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081745-CVE-2024-42289-fe68@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42290 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081745-CVE-2024-42290-c966@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42291 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081746-CVE-2024-42291-6f31@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42292 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081746-CVE-2024-42292-5387@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42293 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081746-CVE-2024-42293-0660@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42294 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081746-CVE-2024-42294-0145@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42295 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081747-CVE-2024-42295-4f43@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42296 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081747-CVE-2024-42296-3f50@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42297 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081747-CVE-2024-42297-fcec@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42298 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081748-CVE-2024-42298-d6a1@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42299 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081748-CVE-2024-42299-a588@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42300 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081748-CVE-2024-42300-0b29@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42301 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081749-CVE-2024-42301-4026@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42302 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081749-CVE-2024-42302-c0d9@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42303 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081749-CVE-2024-42303-4d12@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42304 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081749-CVE-2024-42304-d0e4@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42305 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081750-CVE-2024-42305-94ed@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42306 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081750-CVE-2024-42306-647c@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42307 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081750-CVE-2024-42307-7c2c@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42308 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081751-CVE-2024-42308-562d@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42309 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081751-CVE-2024-42309-9560@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42310 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081751-CVE-2024-42310-58b0@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42311 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081752-CVE-2024-42311-f825@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42312 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081752-CVE-2024-42312-bddc@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42313 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081752-CVE-2024-42313-09b9@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42314 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081752-CVE-2024-42314-de1f@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42315 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081753-CVE-2024-42315-a707@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42316 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081753-CVE-2024-42316-8b49@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42317 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081753-CVE-2024-42317-cf87@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42318 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081754-CVE-2024-42318-f0c9@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42319 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081754-CVE-2024-42319-ec7c@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42320 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081754-CVE-2024-42320-cdea@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42321 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081755-CVE-2024-42321-4b46@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-42322 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081755-CVE-2024-42322-e2ef@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43815 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081720-CVE-2024-43815-38e7@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43816 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081723-CVE-2024-43816-293f@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43817 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081723-CVE-2024-43817-2e95@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43818 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081723-CVE-2024-43818-71ec@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43819 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081723-CVE-2024-43819-88ce@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43820 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081724-CVE-2024-43820-1bd6@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43821 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081724-CVE-2024-43821-6ffc@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43822 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081724-CVE-2024-43822-6511@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43823 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081725-CVE-2024-43823-4bdd@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43824 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081725-CVE-2024-43824-fc04@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43825 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081725-CVE-2024-43825-20fc@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43826 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081726-CVE-2024-43826-2a5f@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43827 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081726-CVE-2024-43827-6486@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43828 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081726-CVE-2024-43828-6bcb@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43829 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081726-CVE-2024-43829-72cb@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43830 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081727-CVE-2024-43830-3b85@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43831 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081727-CVE-2024-43831-b13e@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43832 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081727-CVE-2024-43832-7746@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43833 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081728-CVE-2024-43833-4e73@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43834 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081728-CVE-2024-43834-0140@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43835 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081728-CVE-2024-43835-5f11@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43836 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081729-CVE-2024-43836-d81d@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43837 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081729-CVE-2024-43837-63d2@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43838 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081729-CVE-2024-43838-968a@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43839 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081729-CVE-2024-43839-ea03@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43840 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081730-CVE-2024-43840-69cb@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43841 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081730-CVE-2024-43841-8143@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43842 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081730-CVE-2024-43842-31e7@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43843 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081731-CVE-2024-43843-e436@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43844 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081731-CVE-2024-43844-97ea@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43845 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081731-CVE-2024-43845-a85d@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43846 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43846-2bd0@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43847 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43847-6828@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43848 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43848-4e24@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43849 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43849-fef0@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43850 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081733-CVE-2024-43850-4eec@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43851 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081733-CVE-2024-43851-26f9@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43852 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081733-CVE-2024-43852-61e2@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43853 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081734-CVE-2024-43853-da5b@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43854 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081734-CVE-2024-43854-5586@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43855 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081734-CVE-2024-43855-b78a@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43856 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43856-9087@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43857 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081733-CVE-2024-43857-b71b@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43858 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081733-CVE-2024-43858-0d3e@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43859 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081733-CVE-2024-43859-62b4@gregkh/T/" }, { "category": "external", "summary": "Linux CVE Announcement CVE-2024-43860 vom 2024-08-18", "url": "https://lore.kernel.org/linux-cve-announce/2024081734-CVE-2024-43860-d72f@gregkh/T/" }, { "category": "external", "summary": "Kernel Updates vom 2024-08-18", "url": "https://kernel.org" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3195-1 vom 2024-09-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019407.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3189-1 vom 2024-09-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019404.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3190-1 vom 2024-09-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019403.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3194-1 vom 2024-09-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019400.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3209-1 vom 2024-09-11", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YNWVZVIFSX7PLBJX3I3PDZ4MIBERTN2Y/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3225-1 vom 2024-09-12", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019432.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3227-1 vom 2024-09-12", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019430.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7004-1 vom 2024-09-12", "url": "https://ubuntu.com/security/notices/USN-7004-1" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3252-1 vom 2024-09-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019436.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3249-1 vom 2024-09-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019438.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3251-1 vom 2024-09-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019435.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:7001 vom 2024-09-24", "url": "https://access.redhat.com/errata/RHSA-2024:7001" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3383-1 vom 2024-09-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019497.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:7000 vom 2024-09-24", "url": "https://access.redhat.com/errata/RHSA-2024:7000" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3408-1 vom 2024-09-24", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/TGC7PQ5QNGEZWYIHCKH2KPZMGYJ4VN6B/" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7009-2 vom 2024-09-25", "url": "https://ubuntu.com/security/notices/USN-7009-2" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-7000 vom 2024-09-26", "url": "https://linux.oracle.com/errata/ELSA-2024-7000.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3483-1 vom 2024-09-29", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2HO244EHQ65DPDJ2NOBAXLG7QYWSCUMA/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3483-1 vom 2024-09-29", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2HO244EHQ65DPDJ2NOBAXLG7QYWSCUMA/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3499-1 vom 2024-09-30", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019536.html" }, { "category": "external", "summary": "Rocky Linux Security Advisory RLSA-2024:7001 vom 2024-09-30", "url": "https://errata.build.resf.org/RLSA-2024:7001" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12682 vom 2024-09-30", "url": "http://linux.oracle.com/errata/ELSA-2024-12682.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5782 vom 2024-10-03", "url": "https://lists.debian.org/debian-security-announce/2024/msg00195.html" }, { "category": "external", "summary": "Debian Security Advisory DLA-3912 vom 2024-10-07", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3547-1 vom 2024-10-08", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019566.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3553-1 vom 2024-10-08", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019560.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3551-1 vom 2024-10-08", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/Q7MIMQMCXNGMVS32KLTADYTPQCKF5HWU/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3551-1 vom 2024-10-08", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019562.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3564-1 vom 2024-10-09", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/R7FS3QARF7WUPH5GFL22NW3G3SDO2C7Z/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3569-1 vom 2024-10-09", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6GBL67LQ3MUSYQCQRQH2AZH3XWILTO5A/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3559-1 vom 2024-10-09", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019575.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3566-1 vom 2024-10-09", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019578.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3563-1 vom 2024-10-09", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019579.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3561-1 vom 2024-10-09", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LSUY4BSWS5WR46CHS4FPBIJIRLKHRDHV/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3592-1 vom 2024-10-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019589.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:3591-1 vom 2024-10-10", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019587.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12780 vom 2024-10-14", "url": "https://linux.oracle.com/errata/ELSA-2024-12780.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:8107 vom 2024-10-15", "url": "https://access.redhat.com/errata/RHSA-2024:8107" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12782 vom 2024-10-14", "url": "https://linux.oracle.com/errata/ELSA-2024-12782.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:8157 vom 2024-10-16", "url": "https://access.redhat.com/errata/RHSA-2024:8157" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:8162 vom 2024-10-16", "url": "https://access.redhat.com/errata/RHSA-2024:8162" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:8158 vom 2024-10-16", "url": "https://access.redhat.com/errata/RHSA-2024:8158" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7069-1 vom 2024-10-16", "url": "https://ubuntu.com/security/notices/USN-7069-1" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-8162 vom 2024-10-16", "url": "https://linux.oracle.com/errata/ELSA-2024-8162.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7069-2 vom 2024-10-17", "url": "https://ubuntu.com/security/notices/USN-7069-2" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12796 vom 2024-10-21", "url": "https://linux.oracle.com/errata/ELSA-2024-12796.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:8318 vom 2024-10-23", "url": "https://access.redhat.com/errata/RHSA-2024:8318" }, { "category": "external", "summary": "Rocky Linux Security Advisory RLSA-2024:8162 vom 2024-10-25", "url": "https://errata.build.resf.org/RLSA-2024:8162" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:8617 vom 2024-10-30", "url": "https://access.redhat.com/errata/RHSA-2024:8617" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7088-1 vom 2024-10-31", "url": "https://ubuntu.com/security/notices/USN-7088-1" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-8617 vom 2024-10-31", "url": "https://linux.oracle.com/errata/ELSA-2024-8617.html" }, { "category": "external", "summary": "IBM Security Bulletin", "url": "https://www.ibm.com/support/pages/node/7174634" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7089-1 vom 2024-11-01", "url": "https://ubuntu.com/security/notices/USN-7089-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7090-1 vom 2024-11-01", "url": "https://ubuntu.com/security/notices/USN-7090-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7089-2 vom 2024-11-04", "url": "https://ubuntu.com/security/notices/USN-7089-2" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7088-2 vom 2024-11-04", "url": "https://ubuntu.com/security/notices/USN-7088-2" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:8856 vom 2024-11-05", "url": "https://access.redhat.com/errata/RHSA-2024:8856" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:8870 vom 2024-11-05", "url": "https://access.redhat.com/errata/RHSA-2024:8870" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-8856 vom 2024-11-06", "url": "https://linux.oracle.com/errata/ELSA-2024-8856.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7088-3 vom 2024-11-06", "url": "https://ubuntu.com/security/notices/USN-7088-3" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7089-3 vom 2024-11-07", "url": "https://ubuntu.com/security/notices/USN-7089-3" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7095-1 vom 2024-11-07", "url": "https://ubuntu.com/security/notices/USN-7095-1" }, { "category": "external", "summary": "Rocky Linux Security Advisory RLSA-2024:8870 vom 2024-11-08", "url": "https://errata.build.resf.org/RLSA-2024:8870" }, { "category": "external", "summary": "Rocky Linux Security Advisory RLSA-2024:8617 vom 2024-11-08", "url": "https://errata.build.resf.org/RLSA-2024:8617" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7100-1 vom 2024-11-11", "url": "https://ubuntu.com/security/notices/USN-7100-1" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:9315 vom 2024-11-12", "url": "https://access.redhat.com/errata/RHSA-2024:9315" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:9497 vom 2024-11-13", "url": "https://access.redhat.com/errata/RHSA-2024:9497" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7100-2 vom 2024-11-12", "url": "https://ubuntu.com/security/notices/USN-7100-2" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:9498 vom 2024-11-13", "url": "https://access.redhat.com/errata/RHSA-2024:9498" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12813 vom 2024-11-13", "url": "https://linux.oracle.com/errata/ELSA-2024-12813.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7089-4 vom 2024-11-13", "url": "https://ubuntu.com/security/notices/USN-7089-4" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12815 vom 2024-11-13", "url": "https://linux.oracle.com/errata/ELSA-2024-12815.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:9605 vom 2024-11-14", "url": "https://access.redhat.com/errata/RHSA-2024:9605" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7089-5 vom 2024-11-14", "url": "https://ubuntu.com/security/notices/USN-7089-5" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7110-1 vom 2024-11-14", "url": "https://ubuntu.com/security/notices/USN-7110-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7088-5 vom 2024-11-14", "url": "https://ubuntu.com/security/notices/USN-7088-5" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7089-6 vom 2024-11-15", "url": "https://ubuntu.com/security/notices/USN-7089-6" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7089-7 vom 2024-11-20", "url": "https://ubuntu.com/security/notices/USN-7089-7" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-9605 vom 2024-11-19", "url": "https://linux.oracle.com/errata/ELSA-2024-9605.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7121-1 vom 2024-11-20", "url": "https://ubuntu.com/security/notices/USN-7121-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7119-1 vom 2024-11-20", "url": "https://ubuntu.com/security/notices/USN-7119-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7123-1 vom 2024-11-20", "url": "https://ubuntu.com/security/notices/USN-7123-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7121-2 vom 2024-11-20", "url": "https://ubuntu.com/security/notices/USN-7121-2" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12830 vom 2024-11-21", "url": "https://linux.oracle.com/errata/ELSA-2024-12830.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5818 vom 2024-11-24", "url": "https://lists.debian.org/debian-security-announce/2024/msg00233.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7121-3 vom 2024-11-25", "url": "https://ubuntu.com/security/notices/USN-7121-3" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:4131-1 vom 2024-12-02", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/019887.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:10773 vom 2024-12-04", "url": "https://access.redhat.com/errata/RHSA-2024:10773" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:10772 vom 2024-12-04", "url": "https://access.redhat.com/errata/RHSA-2024:10772" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:10771 vom 2024-12-04", "url": "https://access.redhat.com/errata/RHSA-2024:10771" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12868 vom 2024-12-09", "url": "https://linux.oracle.com/errata/ELSA-2024-12868.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7144-1 vom 2024-12-09", "url": "https://ubuntu.com/security/notices/USN-7144-1" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:10939 vom 2024-12-11", "url": "https://access.redhat.com/errata/RHSA-2024:10939" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7148-1 vom 2024-12-10", "url": "https://ubuntu.com/security/notices/USN-7148-1" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-10939 vom 2024-12-12", "url": "https://linux.oracle.com/errata/ELSA-2024-10939.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7154-1 vom 2024-12-12", "url": "https://ubuntu.com/security/notices/USN-7154-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7155-1 vom 2024-12-12", "url": "https://ubuntu.com/security/notices/USN-7155-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7156-1 vom 2024-12-12", "url": "https://ubuntu.com/security/notices/USN-7156-1" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:4315-1 vom 2024-12-13", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LQPWDP54GSTHYCV4CTCOE67D2ANVPPUW/" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12884 vom 2024-12-17", "url": "https://linux.oracle.com/errata/ELSA-2024-12884.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:4345-1 vom 2024-12-17", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020018.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:4364-1 vom 2024-12-17", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020019.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WFOJHFFEHK42VPQ6XLZWB77H5OEJ3FF4/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020028.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12887 vom 2024-12-18", "url": "https://linux.oracle.com/errata/ELSA-2024-12887.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WFOJHFFEHK42VPQ6XLZWB77H5OEJ3FF4/" }, { "category": "external", "summary": "Debian Security Advisory DLA-4008 vom 2025-01-03", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7184-1 vom 2025-01-06", "url": "https://ubuntu.com/security/notices/USN-7184-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7154-2 vom 2025-01-06", "url": "https://ubuntu.com/security/notices/USN-7154-2" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7183-1 vom 2025-01-06", "url": "https://ubuntu.com/security/notices/USN-7183-1" }, { "category": "external", "summary": "IBM Security Bulletin 7180361 vom 2025-01-07", "url": "https://www.ibm.com/support/pages/node/7180361" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7194-1 vom 2025-01-09", "url": "https://ubuntu.com/security/notices/USN-7194-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7185-2 vom 2025-01-09", "url": "https://ubuntu.com/security/notices/USN-7185-2" }, { "category": "external", "summary": "Ubuntu Security Notice USN-7196-1 vom 2025-01-09", "url": "https://ubuntu.com/security/notices/USN-7196-1" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-9315 vom 2025-01-13", "url": "https://oss.oracle.com/pipermail/el-errata/2025-January/017000.html" } ], "source_lang": "en-US", "title": "Linux Kernel: Mehrere Schwachstellen erm\u00f6glichen Denial of Service", "tracking": { "current_release_date": "2025-01-13T23:00:00.000+00:00", "generator": { "date": "2025-01-14T13:44:15.680+00:00", "engine": { "name": "BSI-WID", "version": "1.3.10" } }, "id": "WID-SEC-W-2024-1875", "initial_release_date": "2024-08-18T22:00:00.000+00:00", "revision_history": [ { "date": "2024-08-18T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-09-10T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-09-11T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-09-12T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von SUSE und Ubuntu aufgenommen" }, { "date": "2024-09-16T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-09-23T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat und SUSE aufgenommen" }, { "date": "2024-09-24T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-09-25T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-09-29T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-09-30T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von SUSE, Rocky Enterprise Software Foundation und Oracle Linux aufgenommen" }, { "date": "2024-10-03T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2024-10-07T22:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2024-10-08T22:00:00.000+00:00", "number": "13", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-10-09T22:00:00.000+00:00", "number": "14", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-10-10T22:00:00.000+00:00", "number": "15", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-10-14T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen" }, { "date": "2024-10-15T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Red Hat und Ubuntu aufgenommen" }, { "date": "2024-10-16T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-10-17T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-10-21T22:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-10-23T22:00:00.000+00:00", "number": "21", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-10-27T23:00:00.000+00:00", "number": "22", "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen" }, { "date": "2024-10-29T23:00:00.000+00:00", "number": "23", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-10-31T23:00:00.000+00:00", "number": "24", "summary": "Neue Updates von Ubuntu und Oracle Linux aufgenommen" }, { "date": "2024-11-03T23:00:00.000+00:00", "number": "25", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-11-04T23:00:00.000+00:00", "number": "26", "summary": "Neue Updates von Ubuntu und Red Hat aufgenommen" }, { "date": "2024-11-05T23:00:00.000+00:00", "number": "27", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-11-06T23:00:00.000+00:00", "number": "28", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-11-10T23:00:00.000+00:00", "number": "29", "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen" }, { "date": "2024-11-11T23:00:00.000+00:00", "number": "30", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-11-12T23:00:00.000+00:00", "number": "31", "summary": "Neue Updates von Red Hat, Ubuntu und Oracle Linux aufgenommen" }, { "date": "2024-11-13T23:00:00.000+00:00", "number": "32", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-11-14T23:00:00.000+00:00", "number": "33", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-11-19T23:00:00.000+00:00", "number": "34", "summary": "Neue Updates von Ubuntu und Oracle Linux aufgenommen" }, { "date": "2024-11-20T23:00:00.000+00:00", "number": "35", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-11-21T23:00:00.000+00:00", "number": "36", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-11-24T23:00:00.000+00:00", "number": "37", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2024-11-25T23:00:00.000+00:00", "number": "38", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-12-02T23:00:00.000+00:00", "number": "39", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-12-03T23:00:00.000+00:00", "number": "40", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-12-09T23:00:00.000+00:00", "number": "41", "summary": "Neue Updates von Oracle Linux und Ubuntu aufgenommen" }, { "date": "2024-12-10T23:00:00.000+00:00", "number": "42", "summary": "Neue Updates von Red Hat und Ubuntu aufgenommen" }, { "date": "2024-12-11T23:00:00.000+00:00", "number": "43", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-12-12T23:00:00.000+00:00", "number": "44", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-12-15T23:00:00.000+00:00", "number": "45", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-12-16T23:00:00.000+00:00", "number": "46", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-12-17T23:00:00.000+00:00", "number": "47", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-12-18T23:00:00.000+00:00", "number": "48", "summary": "Neue Updates von SUSE und Oracle Linux aufgenommen" }, { "date": "2025-01-02T23:00:00.000+00:00", "number": "49", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2025-01-06T23:00:00.000+00:00", "number": "50", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2025-01-09T23:00:00.000+00:00", "number": "51", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2025-01-13T23:00:00.000+00:00", "number": "52", "summary": "Neue Updates von Oracle Linux aufgenommen" } ], "status": "final", "version": "52" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c7.5.0 UP10 IF01", "product": { "name": "IBM QRadar SIEM \u003c7.5.0 UP10 IF01", "product_id": "T038741" } }, { "category": "product_version", "name": "7.5.0 UP10 IF01", "product": { "name": "IBM QRadar SIEM 7.5.0 UP10 IF01", "product_id": "T038741-fixed", "product_identification_helper": { "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up10_if01" } } } ], "category": "product_name", "name": "QRadar SIEM" }, { "branches": [ { "category": "product_version_range", "name": "\u003c10.1.6.4", "product": { "name": "IBM Spectrum Protect Plus \u003c10.1.6.4", "product_id": "T040030" } }, { "category": "product_version", "name": "10.1.6.4", "product": { "name": "IBM Spectrum Protect Plus 10.1.6.4", "product_id": "T040030-fixed", "product_identification_helper": { "cpe": "cpe:/a:ibm:spectrum_protect_plus:10.1.6.4" } } } ], "category": "product_name", "name": "Spectrum Protect Plus" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c6.11-rc4", "product": { "name": "Open Source Linux Kernel \u003c6.11-rc4", "product_id": "T036946" } }, { "category": "product_version", "name": "6.11-rc4", "product": { "name": "Open Source Linux Kernel 6.11-rc4", "product_id": "T036946-fixed", "product_identification_helper": { "cpe": "cpe:/o:linux:linux_kernel:6.11-rc4" } } } ], "category": "product_name", "name": "Linux Kernel" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "RESF Rocky Linux", "product": { "name": "RESF Rocky Linux", "product_id": "T032255", "product_identification_helper": { "cpe": "cpe:/o:resf:rocky_linux:-" } } } ], "category": "vendor", "name": "RESF" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-52889", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2023-52889" }, { "cve": "CVE-2024-42260", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42260" }, { "cve": "CVE-2024-42261", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42261" }, { "cve": "CVE-2024-42262", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42262" }, { "cve": "CVE-2024-42263", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42263" }, { "cve": "CVE-2024-42264", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42264" }, { "cve": "CVE-2024-42265", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42265" }, { "cve": "CVE-2024-42266", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42266" }, { "cve": "CVE-2024-42267", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42267" }, { "cve": "CVE-2024-42268", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42268" }, { "cve": "CVE-2024-42269", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42269" }, { "cve": "CVE-2024-42270", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42270" }, { "cve": "CVE-2024-42271", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42271" }, { "cve": "CVE-2024-42272", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42272" }, { "cve": "CVE-2024-42273", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42273" }, { "cve": "CVE-2024-42274", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42274" }, { "cve": "CVE-2024-42275", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42275" }, { "cve": "CVE-2024-42276", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42276" }, { "cve": "CVE-2024-42277", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42277" }, { "cve": "CVE-2024-42278", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42278" }, { "cve": "CVE-2024-42279", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42279" }, { "cve": "CVE-2024-42280", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42280" }, { "cve": "CVE-2024-42281", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42281" }, { "cve": "CVE-2024-42282", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42282" }, { "cve": "CVE-2024-42283", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42283" }, { "cve": "CVE-2024-42284", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42284" }, { "cve": "CVE-2024-42285", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42285" }, { "cve": "CVE-2024-42286", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42286" }, { "cve": "CVE-2024-42287", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42287" }, { "cve": "CVE-2024-42288", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42288" }, { "cve": "CVE-2024-42289", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42289" }, { "cve": "CVE-2024-42290", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42290" }, { "cve": "CVE-2024-42291", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42291" }, { "cve": "CVE-2024-42292", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42292" }, { "cve": "CVE-2024-42293", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42293" }, { "cve": "CVE-2024-42294", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42294" }, { "cve": "CVE-2024-42295", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42295" }, { "cve": "CVE-2024-42296", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42296" }, { "cve": "CVE-2024-42297", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42297" }, { "cve": "CVE-2024-42298", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42298" }, { "cve": "CVE-2024-42299", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42299" }, { "cve": "CVE-2024-42300", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42300" }, { "cve": "CVE-2024-42301", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42301" }, { "cve": "CVE-2024-42302", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42302" }, { "cve": "CVE-2024-42303", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42303" }, { "cve": "CVE-2024-42304", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42304" }, { "cve": "CVE-2024-42305", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42305" }, { "cve": "CVE-2024-42306", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42306" }, { "cve": "CVE-2024-42307", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42307" }, { "cve": "CVE-2024-42308", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42308" }, { "cve": "CVE-2024-42309", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42309" }, { "cve": "CVE-2024-42310", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42310" }, { "cve": "CVE-2024-42311", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42311" }, { "cve": "CVE-2024-42312", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42312" }, { "cve": "CVE-2024-42313", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42313" }, { "cve": "CVE-2024-42314", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42314" }, { "cve": "CVE-2024-42315", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42315" }, { "cve": "CVE-2024-42316", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42316" }, { "cve": "CVE-2024-42317", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42317" }, { "cve": "CVE-2024-42318", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42318" }, { "cve": "CVE-2024-42319", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42319" }, { "cve": "CVE-2024-42320", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42320" }, { "cve": "CVE-2024-42321", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42321" }, { "cve": "CVE-2024-42322", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-42322" }, { "cve": "CVE-2024-43815", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43815" }, { "cve": "CVE-2024-43816", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43816" }, { "cve": "CVE-2024-43817", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43817" }, { "cve": "CVE-2024-43818", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43818" }, { "cve": "CVE-2024-43819", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43819" }, { "cve": "CVE-2024-43820", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43820" }, { "cve": "CVE-2024-43821", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43821" }, { "cve": "CVE-2024-43822", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43822" }, { "cve": "CVE-2024-43823", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43823" }, { "cve": "CVE-2024-43824", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43824" }, { "cve": "CVE-2024-43825", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43825" }, { "cve": "CVE-2024-43826", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43826" }, { "cve": "CVE-2024-43827", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43827" }, { "cve": "CVE-2024-43828", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43828" }, { "cve": "CVE-2024-43829", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43829" }, { "cve": "CVE-2024-43830", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43830" }, { "cve": "CVE-2024-43831", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43831" }, { "cve": "CVE-2024-43832", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43832" }, { "cve": "CVE-2024-43833", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43833" }, { "cve": "CVE-2024-43834", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43834" }, { "cve": "CVE-2024-43835", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43835" }, { "cve": "CVE-2024-43836", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43836" }, { "cve": "CVE-2024-43837", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43837" }, { "cve": "CVE-2024-43838", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43838" }, { "cve": "CVE-2024-43839", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43839" }, { "cve": "CVE-2024-43840", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43840" }, { "cve": "CVE-2024-43841", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43841" }, { "cve": "CVE-2024-43842", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43842" }, { "cve": "CVE-2024-43843", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43843" }, { "cve": "CVE-2024-43844", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43844" }, { "cve": "CVE-2024-43845", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43845" }, { "cve": "CVE-2024-43846", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43846" }, { "cve": "CVE-2024-43847", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43847" }, { "cve": "CVE-2024-43848", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43848" }, { "cve": "CVE-2024-43849", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43849" }, { "cve": "CVE-2024-43850", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43850" }, { "cve": "CVE-2024-43851", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43851" }, { "cve": "CVE-2024-43852", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43852" }, { "cve": "CVE-2024-43853", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43853" }, { "cve": "CVE-2024-43854", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43854" }, { "cve": "CVE-2024-43855", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43855" }, { "cve": "CVE-2024-43856", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43856" }, { "cve": "CVE-2024-43857", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43857" }, { "cve": "CVE-2024-43858", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43858" }, { "cve": "CVE-2024-43859", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43859" }, { "cve": "CVE-2024-43860", "notes": [ { "category": "description", "text": "In Linux Kernel existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler wie use-after-free-Fehler, NULL-Pointer, Buffer Overflows oder Deadlocks zur\u00fcckzuf\u00fchren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder unbekannte Auswirkungen zu erzielen." } ], "product_status": { "known_affected": [ "T036946", "T040030", "2951", "T002207", "67646", "T000126", "T004914", "T032255", "T038741" ] }, "release_date": "2024-08-18T22:00:00.000+00:00", "title": "CVE-2024-43860" } ] }
cve-2024-43835
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix napi_skb_cache_put warning
After the commit bdacf3e34945 ("net: Use nested-BH locking for
napi_alloc_cache.") was merged, the following warning began to appear:
WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0
__warn+0x12f/0x340
napi_skb_cache_put+0x82/0x4b0
napi_skb_cache_put+0x82/0x4b0
report_bug+0x165/0x370
handle_bug+0x3d/0x80
exc_invalid_op+0x1a/0x50
asm_exc_invalid_op+0x1a/0x20
__free_old_xmit+0x1c8/0x510
napi_skb_cache_put+0x82/0x4b0
__free_old_xmit+0x1c8/0x510
__free_old_xmit+0x1c8/0x510
__pfx___free_old_xmit+0x10/0x10
The issue arises because virtio is assuming it's running in NAPI context
even when it's not, such as in the netpoll case.
To resolve this, modify virtnet_poll_tx() to only set NAPI when budget
is available. Same for virtnet_poll_cleantx(), which always assumed that
it was in a NAPI context.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: df133f3f96257ee29696c0ed8bd198ec801dc810 Version: df133f3f96257ee29696c0ed8bd198ec801dc810 Version: df133f3f96257ee29696c0ed8bd198ec801dc810 Version: df133f3f96257ee29696c0ed8bd198ec801dc810 Version: df133f3f96257ee29696c0ed8bd198ec801dc810 Version: df133f3f96257ee29696c0ed8bd198ec801dc810 Version: df133f3f96257ee29696c0ed8bd198ec801dc810 Version: df133f3f96257ee29696c0ed8bd198ec801dc810 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43835", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:14.954725Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:23.316Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/virtio_net.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "19ac6f29bf64304ef04630c8ab56ecd2059d7aa1", "status": "affected", "version": "df133f3f96257ee29696c0ed8bd198ec801dc810", "versionType": "git" }, { "lessThan": "d3af435e8ace119e58d8e21d3d2d6a4e7c4a4baa", "status": "affected", "version": "df133f3f96257ee29696c0ed8bd198ec801dc810", "versionType": "git" }, { "lessThan": "842a97b5e44f0c8a9fc356fe976e0e13ddcf7783", "status": "affected", "version": "df133f3f96257ee29696c0ed8bd198ec801dc810", "versionType": "git" }, { "lessThan": "cc7340f18e45886121c131227985d64ef666012f", "status": "affected", "version": "df133f3f96257ee29696c0ed8bd198ec801dc810", "versionType": "git" }, { "lessThan": "6b5325f2457521bbece29499970c0117a648c620", "status": "affected", "version": "df133f3f96257ee29696c0ed8bd198ec801dc810", "versionType": "git" }, { "lessThan": "f5e9a22d19bb98a7e86034db85eb295e94187caa", "status": "affected", "version": "df133f3f96257ee29696c0ed8bd198ec801dc810", "versionType": "git" }, { "lessThan": "468a729b78895893d0e580ceea49bed8ada2a2bd", "status": "affected", "version": "df133f3f96257ee29696c0ed8bd198ec801dc810", "versionType": "git" }, { "lessThan": "f8321fa75102246d7415a6af441872f6637c93ab", "status": "affected", "version": "df133f3f96257ee29696c0ed8bd198ec801dc810", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/virtio_net.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.0" }, { "lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.322", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.284", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.226", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.167", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.109", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.50", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix napi_skb_cache_put warning\n\nAfter the commit bdacf3e34945 (\"net: Use nested-BH locking for\nnapi_alloc_cache.\") was merged, the following warning began to appear:\n\n\t WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0\n\n\t __warn+0x12f/0x340\n\t napi_skb_cache_put+0x82/0x4b0\n\t napi_skb_cache_put+0x82/0x4b0\n\t report_bug+0x165/0x370\n\t handle_bug+0x3d/0x80\n\t exc_invalid_op+0x1a/0x50\n\t asm_exc_invalid_op+0x1a/0x20\n\t __free_old_xmit+0x1c8/0x510\n\t napi_skb_cache_put+0x82/0x4b0\n\t __free_old_xmit+0x1c8/0x510\n\t __free_old_xmit+0x1c8/0x510\n\t __pfx___free_old_xmit+0x10/0x10\n\nThe issue arises because virtio is assuming it\u0027s running in NAPI context\neven when it\u0027s not, such as in the netpoll case.\n\nTo resolve this, modify virtnet_poll_tx() to only set NAPI when budget\nis available. Same for virtnet_poll_cleantx(), which always assumed that\nit was in a NAPI context." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:48.894Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/19ac6f29bf64304ef04630c8ab56ecd2059d7aa1" }, { "url": "https://git.kernel.org/stable/c/d3af435e8ace119e58d8e21d3d2d6a4e7c4a4baa" }, { "url": "https://git.kernel.org/stable/c/842a97b5e44f0c8a9fc356fe976e0e13ddcf7783" }, { "url": "https://git.kernel.org/stable/c/cc7340f18e45886121c131227985d64ef666012f" }, { "url": "https://git.kernel.org/stable/c/6b5325f2457521bbece29499970c0117a648c620" }, { "url": "https://git.kernel.org/stable/c/f5e9a22d19bb98a7e86034db85eb295e94187caa" }, { "url": "https://git.kernel.org/stable/c/468a729b78895893d0e580ceea49bed8ada2a2bd" }, { "url": "https://git.kernel.org/stable/c/f8321fa75102246d7415a6af441872f6637c93ab" } ], "title": "virtio_net: Fix napi_skb_cache_put warning", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43835", "datePublished": "2024-08-17T09:21:52.425Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:48.894Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42295
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: handle inconsistent state in nilfs_btnode_create_block()
Syzbot reported that a buffer state inconsistency was detected in
nilfs_btnode_create_block(), triggering a kernel bug.
It is not appropriate to treat this inconsistency as a bug; it can occur
if the argument block address (the buffer index of the newly created
block) is a virtual block number and has been reallocated due to
corruption of the bitmap used to manage its allocation state.
So, modify nilfs_btnode_create_block() and its callers to treat it as a
possible filesystem error, rather than triggering a kernel bug.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: a60be987d45dd510aeb54389526f9957cfab106c Version: a60be987d45dd510aeb54389526f9957cfab106c Version: a60be987d45dd510aeb54389526f9957cfab106c Version: a60be987d45dd510aeb54389526f9957cfab106c Version: a60be987d45dd510aeb54389526f9957cfab106c Version: a60be987d45dd510aeb54389526f9957cfab106c Version: a60be987d45dd510aeb54389526f9957cfab106c Version: a60be987d45dd510aeb54389526f9957cfab106c |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42295", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:50.851556Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:29.125Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/nilfs2/btnode.c", "fs/nilfs2/btree.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "19cce46238ffe3546e44b9c74057103ff8b24c62", "status": "affected", "version": "a60be987d45dd510aeb54389526f9957cfab106c", "versionType": "git" }, { "lessThan": "02b87e6334a38c65eef49848d3f1ac422f0b2a44", "status": "affected", "version": "a60be987d45dd510aeb54389526f9957cfab106c", "versionType": "git" }, { "lessThan": "5f0a6800b8aec1b453c7fe4c44fcaac5ffe9d52e", "status": "affected", "version": "a60be987d45dd510aeb54389526f9957cfab106c", "versionType": "git" }, { "lessThan": "e34191cce3ee63dfa5fb241904aaf2a042d5b6d8", "status": "affected", "version": "a60be987d45dd510aeb54389526f9957cfab106c", "versionType": "git" }, { "lessThan": "012be828a118bf496e666ef1fc47fc0e7358ada2", "status": "affected", "version": "a60be987d45dd510aeb54389526f9957cfab106c", "versionType": "git" }, { "lessThan": "be56dfc9be0604291267c07b0e27a69a6bda4899", "status": "affected", "version": "a60be987d45dd510aeb54389526f9957cfab106c", "versionType": "git" }, { "lessThan": "366c3f688dd0288cbe38af1d3a886b5c62372e4a", "status": "affected", "version": "a60be987d45dd510aeb54389526f9957cfab106c", "versionType": "git" }, { "lessThan": "4811f7af6090e8f5a398fbdd766f903ef6c0d787", "status": "affected", "version": "a60be987d45dd510aeb54389526f9957cfab106c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/nilfs2/btnode.c", "fs/nilfs2/btree.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.30" }, { "lessThan": "2.6.30", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: handle inconsistent state in nilfs_btnode_create_block()\n\nSyzbot reported that a buffer state inconsistency was detected in\nnilfs_btnode_create_block(), triggering a kernel bug.\n\nIt is not appropriate to treat this inconsistency as a bug; it can occur\nif the argument block address (the buffer index of the newly created\nblock) is a virtual block number and has been reallocated due to\ncorruption of the bitmap used to manage its allocation state.\n\nSo, modify nilfs_btnode_create_block() and its callers to treat it as a\npossible filesystem error, rather than triggering a kernel bug." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:50.272Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/19cce46238ffe3546e44b9c74057103ff8b24c62" }, { "url": "https://git.kernel.org/stable/c/02b87e6334a38c65eef49848d3f1ac422f0b2a44" }, { "url": "https://git.kernel.org/stable/c/5f0a6800b8aec1b453c7fe4c44fcaac5ffe9d52e" }, { "url": "https://git.kernel.org/stable/c/e34191cce3ee63dfa5fb241904aaf2a042d5b6d8" }, { "url": "https://git.kernel.org/stable/c/012be828a118bf496e666ef1fc47fc0e7358ada2" }, { "url": "https://git.kernel.org/stable/c/be56dfc9be0604291267c07b0e27a69a6bda4899" }, { "url": "https://git.kernel.org/stable/c/366c3f688dd0288cbe38af1d3a886b5c62372e4a" }, { "url": "https://git.kernel.org/stable/c/4811f7af6090e8f5a398fbdd766f903ef6c0d787" } ], "title": "nilfs2: handle inconsistent state in nilfs_btnode_create_block()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42295", "datePublished": "2024-08-17T09:09:03.618Z", "dateReserved": "2024-07-30T07:40:12.269Z", "dateUpdated": "2024-12-19T09:15:50.272Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42277
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en()
dom->sdev is equal to NULL, which leads to null dereference.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 92c089a931fd3939cd32318cf4f54e69e8f51a19 Version: 8745f3592ee4a7b49ede16ddd3f12a41ecaa23c9 Version: 9afea57384d4ae7b2034593eac7fa76c7122762a Version: 9afea57384d4ae7b2034593eac7fa76c7122762a Version: 9afea57384d4ae7b2034593eac7fa76c7122762a |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42277", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:49.209899Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:31.475Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/iommu/sprd-iommu.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "8c79ceb4ecf823e6ec10fee6febb0fca3de79922", "status": "affected", "version": "92c089a931fd3939cd32318cf4f54e69e8f51a19", "versionType": "git" }, { "lessThan": "dfe90030a0cfa26dca4cb6510de28920e5ad22fb", "status": "affected", "version": "8745f3592ee4a7b49ede16ddd3f12a41ecaa23c9", "versionType": "git" }, { "lessThan": "b62841e49a2b7938f6fdeaaf93fb57e4eb880bdb", "status": "affected", "version": "9afea57384d4ae7b2034593eac7fa76c7122762a", "versionType": "git" }, { "lessThan": "d5fe884ce28c5005f8582c35333c195a168f841c", "status": "affected", "version": "9afea57384d4ae7b2034593eac7fa76c7122762a", "versionType": "git" }, { "lessThan": "630482ee0653decf9e2482ac6181897eb6cde5b8", "status": "affected", "version": "9afea57384d4ae7b2034593eac7fa76c7122762a", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/iommu/sprd-iommu.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.4" }, { "lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: sprd: Avoid NULL deref in sprd_iommu_hw_en\n\nIn sprd_iommu_cleanup() before calling function sprd_iommu_hw_en()\ndom-\u003esdev is equal to NULL, which leads to null dereference.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:29.166Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/8c79ceb4ecf823e6ec10fee6febb0fca3de79922" }, { "url": "https://git.kernel.org/stable/c/dfe90030a0cfa26dca4cb6510de28920e5ad22fb" }, { "url": "https://git.kernel.org/stable/c/b62841e49a2b7938f6fdeaaf93fb57e4eb880bdb" }, { "url": "https://git.kernel.org/stable/c/d5fe884ce28c5005f8582c35333c195a168f841c" }, { "url": "https://git.kernel.org/stable/c/630482ee0653decf9e2482ac6181897eb6cde5b8" } ], "title": "iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42277", "datePublished": "2024-08-17T09:08:45.486Z", "dateReserved": "2024-07-30T07:40:12.261Z", "dateUpdated": "2024-12-19T09:15:29.166Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43854
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: initialize integrity buffer to zero before writing it to media
Metadata added by bio_integrity_prep is using plain kmalloc, which leads
to random kernel memory being written media. For PI metadata this is
limited to the app tag that isn't used by kernel generated metadata,
but for non-PI metadata the entire buffer leaks kernel memory.
Fix this by adding the __GFP_ZERO flag to allocations for writes.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b Version: 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b Version: 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b Version: 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b Version: 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b Version: 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b Version: 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b Version: 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43854", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:14.517245Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:20.780Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "block/bio-integrity.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "9f4af4cf08f9a0329ade3d938f55d2220c40d0a6", "status": "affected", "version": "7ba1ba12eeef0aa7113beb16410ef8b7c748e18b", "versionType": "git" }, { "lessThan": "129f95948a96105c1fad8e612c9097763e88ac5f", "status": "affected", "version": "7ba1ba12eeef0aa7113beb16410ef8b7c748e18b", "versionType": "git" }, { "lessThan": "3fd11fe4f20756b4c0847f755a64cd96f8c6a005", "status": "affected", "version": "7ba1ba12eeef0aa7113beb16410ef8b7c748e18b", "versionType": "git" }, { "lessThan": "cf6b45ea7a8df0f61bded1dc4a8561ac6ad143d2", "status": "affected", "version": "7ba1ba12eeef0aa7113beb16410ef8b7c748e18b", "versionType": "git" }, { "lessThan": "d418313bd8f55c079a7da12651951b489a638ac1", "status": "affected", "version": "7ba1ba12eeef0aa7113beb16410ef8b7c748e18b", "versionType": "git" }, { "lessThan": "23a19655fb56f241e592041156dfb1c6d04da644", "status": "affected", "version": "7ba1ba12eeef0aa7113beb16410ef8b7c748e18b", "versionType": "git" }, { "lessThan": "ebc0e91ba76dc6544fff9f5b66408b1982806a00", "status": "affected", "version": "7ba1ba12eeef0aa7113beb16410ef8b7c748e18b", "versionType": "git" }, { "lessThan": "899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f", "status": "affected", "version": "7ba1ba12eeef0aa7113beb16410ef8b7c748e18b", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "block/bio-integrity.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.27" }, { "lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.322", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.284", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.226", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: initialize integrity buffer to zero before writing it to media\n\nMetadata added by bio_integrity_prep is using plain kmalloc, which leads\nto random kernel memory being written media. For PI metadata this is\nlimited to the app tag that isn\u0027t used by kernel generated metadata,\nbut for non-PI metadata the entire buffer leaks kernel memory.\n\nFix this by adding the __GFP_ZERO flag to allocations for writes." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:12.189Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/9f4af4cf08f9a0329ade3d938f55d2220c40d0a6" }, { "url": "https://git.kernel.org/stable/c/129f95948a96105c1fad8e612c9097763e88ac5f" }, { "url": "https://git.kernel.org/stable/c/3fd11fe4f20756b4c0847f755a64cd96f8c6a005" }, { "url": "https://git.kernel.org/stable/c/cf6b45ea7a8df0f61bded1dc4a8561ac6ad143d2" }, { "url": "https://git.kernel.org/stable/c/d418313bd8f55c079a7da12651951b489a638ac1" }, { "url": "https://git.kernel.org/stable/c/23a19655fb56f241e592041156dfb1c6d04da644" }, { "url": "https://git.kernel.org/stable/c/ebc0e91ba76dc6544fff9f5b66408b1982806a00" }, { "url": "https://git.kernel.org/stable/c/899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f" } ], "title": "block: initialize integrity buffer to zero before writing it to media", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43854", "datePublished": "2024-08-17T09:22:11.297Z", "dateReserved": "2024-08-17T09:11:59.278Z", "dateUpdated": "2024-12-19T09:17:12.189Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42265
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
both callers have verified that fd is not greater than ->max_fds;
however, misprediction might end up with
tofree = fdt->fd[fd];
being speculatively executed. That's wrong for the same reasons
why it's wrong in close_fd()/file_close_fd_locked(); the same
solution applies - array_index_nospec(fd, fdt->max_fds) could differ
from fd only in case of speculative execution on mispredicted path.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42265", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:30.860612Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:05.845Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/file.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ed42e8ff509d2a61c6642d1825032072dab79f26", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "41a6c31df77bd8e050136b0a200b537da9e1084a", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "08775b3d6ed117cf4518754ec7300ee42b6a5368", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "3f480493550b6a23d3a65d095d6569d4a7f56a0f", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "5db999fff545b924b24c9afd368ef5c17279b176", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "da72e783afd27d9f487836b2e6738146c0edd149", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "1171ceccabfd596ca370c5d2cbb47d110c3f2fe1", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "8aa37bde1a7b645816cda8b80df4753ecf172bf1", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/file.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprotect the fetch of -\u003efd[fd] in do_dup2() from mispredictions\n\nboth callers have verified that fd is not greater than -\u003emax_fds;\nhowever, misprediction might end up with\n tofree = fdt-\u003efd[fd];\nbeing speculatively executed. That\u0027s wrong for the same reasons\nwhy it\u0027s wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt-\u003emax_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:09.647Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ed42e8ff509d2a61c6642d1825032072dab79f26" }, { "url": "https://git.kernel.org/stable/c/41a6c31df77bd8e050136b0a200b537da9e1084a" }, { "url": "https://git.kernel.org/stable/c/08775b3d6ed117cf4518754ec7300ee42b6a5368" }, { "url": "https://git.kernel.org/stable/c/3f480493550b6a23d3a65d095d6569d4a7f56a0f" }, { "url": "https://git.kernel.org/stable/c/5db999fff545b924b24c9afd368ef5c17279b176" }, { "url": "https://git.kernel.org/stable/c/da72e783afd27d9f487836b2e6738146c0edd149" }, { "url": "https://git.kernel.org/stable/c/1171ceccabfd596ca370c5d2cbb47d110c3f2fe1" }, { "url": "https://git.kernel.org/stable/c/8aa37bde1a7b645816cda8b80df4753ecf172bf1" } ], "title": "protect the fetch of -\u003efd[fd] in do_dup2() from mispredictions", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42265", "datePublished": "2024-08-17T08:54:21.636Z", "dateReserved": "2024-07-30T07:40:12.259Z", "dateUpdated": "2024-12-19T09:15:09.647Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43849
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: pdr: protect locator_addr with the main mutex
If the service locator server is restarted fast enough, the PDR can
rewrite locator_addr fields concurrently. Protect them by placing
modification of those fields under the main pdr->lock.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: fbe639b44a82755d639df1c5d147c93f02ac5a0f Version: fbe639b44a82755d639df1c5d147c93f02ac5a0f Version: fbe639b44a82755d639df1c5d147c93f02ac5a0f Version: fbe639b44a82755d639df1c5d147c93f02ac5a0f Version: fbe639b44a82755d639df1c5d147c93f02ac5a0f Version: fbe639b44a82755d639df1c5d147c93f02ac5a0f |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43849", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:30.525809Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:21.452Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/soc/qcom/pdr_interface.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "eab05737ee22216250fe20d27f5a596da5ea6eb7", "status": "affected", "version": "fbe639b44a82755d639df1c5d147c93f02ac5a0f", "versionType": "git" }, { "lessThan": "d0870c4847e77a49c2f91bb2a8e0fa3c1f8dea5c", "status": "affected", "version": "fbe639b44a82755d639df1c5d147c93f02ac5a0f", "versionType": "git" }, { "lessThan": "475a77fb3f0e1d527f56c60b79f5879661df5b80", "status": "affected", "version": "fbe639b44a82755d639df1c5d147c93f02ac5a0f", "versionType": "git" }, { "lessThan": "3e815626d73e05152a8142f6e44aecc4133e6e08", "status": "affected", "version": "fbe639b44a82755d639df1c5d147c93f02ac5a0f", "versionType": "git" }, { "lessThan": "8543269567e2fb3d976a8255c5e348aed14f98bc", "status": "affected", "version": "fbe639b44a82755d639df1c5d147c93f02ac5a0f", "versionType": "git" }, { "lessThan": "107924c14e3ddd85119ca43c26a4ee1056fa9b84", "status": "affected", "version": "fbe639b44a82755d639df1c5d147c93f02ac5a0f", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/soc/qcom/pdr_interface.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.7" }, { "lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: pdr: protect locator_addr with the main mutex\n\nIf the service locator server is restarted fast enough, the PDR can\nrewrite locator_addr fields concurrently. Protect them by placing\nmodification of those fields under the main pdr-\u003elock." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:06.440Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/eab05737ee22216250fe20d27f5a596da5ea6eb7" }, { "url": "https://git.kernel.org/stable/c/d0870c4847e77a49c2f91bb2a8e0fa3c1f8dea5c" }, { "url": "https://git.kernel.org/stable/c/475a77fb3f0e1d527f56c60b79f5879661df5b80" }, { "url": "https://git.kernel.org/stable/c/3e815626d73e05152a8142f6e44aecc4133e6e08" }, { "url": "https://git.kernel.org/stable/c/8543269567e2fb3d976a8255c5e348aed14f98bc" }, { "url": "https://git.kernel.org/stable/c/107924c14e3ddd85119ca43c26a4ee1056fa9b84" } ], "title": "soc: qcom: pdr: protect locator_addr with the main mutex", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43849", "datePublished": "2024-08-17T09:22:02.728Z", "dateReserved": "2024-08-17T09:11:59.276Z", "dateUpdated": "2024-12-19T09:17:06.440Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43848
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix TTLM teardown work
The worker calculates the wrong sdata pointer, so if it ever
runs, it'll crash. Fix that.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43848", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:33.635400Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:21.571Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/mac80211/mlme.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "9750899410c8478ef043c42029f4f6144c096eac", "status": "affected", "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "versionType": "git" }, { "lessThan": "2fe0a605d083b884490ee4de02be071b5b4291b1", "status": "affected", "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/mac80211/mlme.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix TTLM teardown work\n\nThe worker calculates the wrong sdata pointer, so if it ever\nruns, it\u0027ll crash. Fix that." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:05.276Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac" }, { "url": "https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1" } ], "title": "wifi: mac80211: fix TTLM teardown work", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43848", "datePublished": "2024-08-17T09:22:02.044Z", "dateReserved": "2024-08-17T09:11:59.276Z", "dateUpdated": "2024-12-19T09:17:05.276Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43825
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: Fix the sorting functionality in iio_gts_build_avail_time_table
The sorting in iio_gts_build_avail_time_table is not working as intended.
It could result in an out-of-bounds access when the time is zero.
Here are more details:
1. When the gts->itime_table[i].time_us is zero, e.g., the time
sequence is `3, 0, 1`, the inner for-loop will not terminate and do
out-of-bound writes. This is because once `times[j] > new`, the value
`new` will be added in the current position and the `times[j]` will be
moved to `j+1` position, which makes the if-condition always hold.
Meanwhile, idx will be added one, making the loop keep running without
termination and out-of-bound write.
2. If none of the gts->itime_table[i].time_us is zero, the elements
will just be copied without being sorted as described in the comment
"Sort times from all tables to one and remove duplicates".
For more details, please refer to
https://lore.kernel.org/all/6dd0d822-046c-4dd2-9532-79d7ab96ec05@gmail.com.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43825", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:48.020961Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:24.429Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/iio/industrialio-gts-helper.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "31ff8464ef540785344994986a010031410f9ff3", "status": "affected", "version": "38416c28e16890b52fdd5eb73479299ec3f062f3", "versionType": "git" }, { "lessThan": "b5046de32fd1532c3f67065197fc1da82f0b5193", "status": "affected", "version": "38416c28e16890b52fdd5eb73479299ec3f062f3", "versionType": "git" }, { "lessThan": "5acc3f971a01be48d5ff4252d8f9cdb87998cdfb", "status": "affected", "version": "38416c28e16890b52fdd5eb73479299ec3f062f3", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/iio/industrialio-gts-helper.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.4" }, { "lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: Fix the sorting functionality in iio_gts_build_avail_time_table\n\nThe sorting in iio_gts_build_avail_time_table is not working as intended.\nIt could result in an out-of-bounds access when the time is zero.\n\nHere are more details:\n\n1. When the gts-\u003eitime_table[i].time_us is zero, e.g., the time\nsequence is `3, 0, 1`, the inner for-loop will not terminate and do\nout-of-bound writes. This is because once `times[j] \u003e new`, the value\n`new` will be added in the current position and the `times[j]` will be\nmoved to `j+1` position, which makes the if-condition always hold.\nMeanwhile, idx will be added one, making the loop keep running without\ntermination and out-of-bound write.\n2. If none of the gts-\u003eitime_table[i].time_us is zero, the elements\nwill just be copied without being sorted as described in the comment\n\"Sort times from all tables to one and remove duplicates\".\n\nFor more details, please refer to\nhttps://lore.kernel.org/all/6dd0d822-046c-4dd2-9532-79d7ab96ec05@gmail.com." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:36.540Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/31ff8464ef540785344994986a010031410f9ff3" }, { "url": "https://git.kernel.org/stable/c/b5046de32fd1532c3f67065197fc1da82f0b5193" }, { "url": "https://git.kernel.org/stable/c/5acc3f971a01be48d5ff4252d8f9cdb87998cdfb" } ], "title": "iio: Fix the sorting functionality in iio_gts_build_avail_time_table", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43825", "datePublished": "2024-08-17T09:21:45.215Z", "dateReserved": "2024-08-17T09:11:59.272Z", "dateUpdated": "2024-12-19T09:16:36.540Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42316
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/mglru: fix div-by-zero in vmpressure_calc_level()
evict_folios() uses a second pass to reclaim folios that have gone through
page writeback and become clean before it finishes the first pass, since
folio_rotate_reclaimable() cannot handle those folios due to the
isolation.
The second pass tries to avoid potential double counting by deducting
scan_control->nr_scanned. However, this can result in underflow of
nr_scanned, under a condition where shrink_folio_list() does not increment
nr_scanned, i.e., when folio_trylock() fails.
The underflow can cause the divisor, i.e., scale=scanned+reclaimed in
vmpressure_calc_level(), to become zero, resulting in the following crash:
[exception RIP: vmpressure_work_fn+101]
process_one_work at ffffffffa3313f2b
Since scan_control->nr_scanned has no established semantics, the potential
double counting has minimal risks. Therefore, fix the problem by not
deducting scan_control->nr_scanned in evict_folios().
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42316", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:42.817559Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:26.476Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "mm/vmscan.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "8de7bf77f21068a5f602bb1e59adbc5ab533509d", "status": "affected", "version": "359a5e1416caaf9ce28396a65ed3e386cc5de663", "versionType": "git" }, { "lessThan": "d6510f234c7d117790397f9bb150816b0a954a04", "status": "affected", "version": "359a5e1416caaf9ce28396a65ed3e386cc5de663", "versionType": "git" }, { "lessThan": "a39e38be632f0e1c908d70d1c9cd071c03faf895", "status": "affected", "version": "359a5e1416caaf9ce28396a65ed3e386cc5de663", "versionType": "git" }, { "lessThan": "8b671fe1a879923ecfb72dda6caf01460dd885ef", "status": "affected", "version": "359a5e1416caaf9ce28396a65ed3e386cc5de663", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "mm/vmscan.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.1" }, { "lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mglru: fix div-by-zero in vmpressure_calc_level()\n\nevict_folios() uses a second pass to reclaim folios that have gone through\npage writeback and become clean before it finishes the first pass, since\nfolio_rotate_reclaimable() cannot handle those folios due to the\nisolation.\n\nThe second pass tries to avoid potential double counting by deducting\nscan_control-\u003enr_scanned. However, this can result in underflow of\nnr_scanned, under a condition where shrink_folio_list() does not increment\nnr_scanned, i.e., when folio_trylock() fails.\n\nThe underflow can cause the divisor, i.e., scale=scanned+reclaimed in\nvmpressure_calc_level(), to become zero, resulting in the following crash:\n\n [exception RIP: vmpressure_work_fn+101]\n process_one_work at ffffffffa3313f2b\n\nSince scan_control-\u003enr_scanned has no established semantics, the potential\ndouble counting has minimal risks. Therefore, fix the problem by not\ndeducting scan_control-\u003enr_scanned in evict_folios()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:15.409Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/8de7bf77f21068a5f602bb1e59adbc5ab533509d" }, { "url": "https://git.kernel.org/stable/c/d6510f234c7d117790397f9bb150816b0a954a04" }, { "url": "https://git.kernel.org/stable/c/a39e38be632f0e1c908d70d1c9cd071c03faf895" }, { "url": "https://git.kernel.org/stable/c/8b671fe1a879923ecfb72dda6caf01460dd885ef" } ], "title": "mm/mglru: fix div-by-zero in vmpressure_calc_level()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42316", "datePublished": "2024-08-17T09:09:24.694Z", "dateReserved": "2024-07-30T07:40:12.278Z", "dateUpdated": "2024-12-19T09:16:15.409Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43830
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
leds: trigger: Unregister sysfs attributes before calling deactivate()
Triggers which have trigger specific sysfs attributes typically store
related data in trigger-data allocated by the activate() callback and
freed by the deactivate() callback.
Calling device_remove_groups() after calling deactivate() leaves a window
where the sysfs attributes show/store functions could be called after
deactivation and then operate on the just freed trigger-data.
Move the device_remove_groups() call to before deactivate() to close
this race window.
This also makes the deactivation path properly do things in reverse order
of the activation path which calls the activate() callback before calling
device_add_groups().
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: a7e7a3156300a7e1982b03cc9cb8fb0c86434c49 Version: a7e7a3156300a7e1982b03cc9cb8fb0c86434c49 Version: a7e7a3156300a7e1982b03cc9cb8fb0c86434c49 Version: a7e7a3156300a7e1982b03cc9cb8fb0c86434c49 Version: a7e7a3156300a7e1982b03cc9cb8fb0c86434c49 Version: a7e7a3156300a7e1982b03cc9cb8fb0c86434c49 Version: a7e7a3156300a7e1982b03cc9cb8fb0c86434c49 Version: a7e7a3156300a7e1982b03cc9cb8fb0c86434c49 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43830", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:31.513833Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:23.792Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/leds/led-triggers.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c3b7a650c8717aa89df318364609c86cbc040156", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git" }, { "lessThan": "d1415125b701ef13370e2761f691ec632a5eb93a", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git" }, { "lessThan": "09c1583f0e10c918855d6e7540a79461a353e5d6", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git" }, { "lessThan": "3fb6a9d67cfd812a547ac73ec02e1077c26c640d", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git" }, { "lessThan": "734ba6437e80dfc780e9ee9d95f912392d12b5ea", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git" }, { "lessThan": "cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git" }, { "lessThan": "0788a6f3523d3686a9eed5ea1e6fcce6841277b2", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git" }, { "lessThan": "c0dc9adf9474ecb7106e60e5472577375aedaed3", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/leds/led-triggers.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.19" }, { "lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: trigger: Unregister sysfs attributes before calling deactivate()\n\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\n\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\n\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\n\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:42.420Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c3b7a650c8717aa89df318364609c86cbc040156" }, { "url": "https://git.kernel.org/stable/c/d1415125b701ef13370e2761f691ec632a5eb93a" }, { "url": "https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6" }, { "url": "https://git.kernel.org/stable/c/3fb6a9d67cfd812a547ac73ec02e1077c26c640d" }, { "url": "https://git.kernel.org/stable/c/734ba6437e80dfc780e9ee9d95f912392d12b5ea" }, { "url": "https://git.kernel.org/stable/c/cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374" }, { "url": "https://git.kernel.org/stable/c/0788a6f3523d3686a9eed5ea1e6fcce6841277b2" }, { "url": "https://git.kernel.org/stable/c/c0dc9adf9474ecb7106e60e5472577375aedaed3" } ], "title": "leds: trigger: Unregister sysfs attributes before calling deactivate()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43830", "datePublished": "2024-08-17T09:21:48.946Z", "dateReserved": "2024-08-17T09:11:59.273Z", "dateUpdated": "2024-12-19T09:16:42.420Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42310
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate()
is assigned to mode, which will lead to a NULL pointer dereference on
failure of drm_mode_duplicate(). Add a check to avoid npd.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe Version: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe Version: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe Version: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe Version: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe Version: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe Version: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe Version: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42310", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:02.672405Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:27.324Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/gma500/cdv_intel_lvds.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "f392c36cebf4c1d6997a4cc2c0f205254acef42a", "status": "affected", "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe", "versionType": "git" }, { "lessThan": "a658ae2173ab74667c009e2550455e6de5b33ddc", "status": "affected", "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe", "versionType": "git" }, { "lessThan": "b6ac46a00188cde50ffba233e6efb366354a1de5", "status": "affected", "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe", "versionType": "git" }, { "lessThan": "08f45102c81ad8bc9f85f7a25e9f64e128edb87d", "status": "affected", "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe", "versionType": "git" }, { "lessThan": "e74eb5e8089427c8c49e0dd5067e5f39ce3a4d56", "status": "affected", "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe", "versionType": "git" }, { "lessThan": "2d209b2f862f6b8bff549ede541590a8d119da23", "status": "affected", "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe", "versionType": "git" }, { "lessThan": "977ee4fe895e1729cd36cc26916bbb10084713d6", "status": "affected", "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe", "versionType": "git" }, { "lessThan": "cb520c3f366c77e8d69e4e2e2781a8ce48d98e79", "status": "affected", "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/gma500/cdv_intel_lvds.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.3" }, { "lessThan": "3.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes\n\nIn cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a NULL pointer dereference on\nfailure of drm_mode_duplicate(). Add a check to avoid npd." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:08.069Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/f392c36cebf4c1d6997a4cc2c0f205254acef42a" }, { "url": "https://git.kernel.org/stable/c/a658ae2173ab74667c009e2550455e6de5b33ddc" }, { "url": "https://git.kernel.org/stable/c/b6ac46a00188cde50ffba233e6efb366354a1de5" }, { "url": "https://git.kernel.org/stable/c/08f45102c81ad8bc9f85f7a25e9f64e128edb87d" }, { "url": "https://git.kernel.org/stable/c/e74eb5e8089427c8c49e0dd5067e5f39ce3a4d56" }, { "url": "https://git.kernel.org/stable/c/2d209b2f862f6b8bff549ede541590a8d119da23" }, { "url": "https://git.kernel.org/stable/c/977ee4fe895e1729cd36cc26916bbb10084713d6" }, { "url": "https://git.kernel.org/stable/c/cb520c3f366c77e8d69e4e2e2781a8ce48d98e79" } ], "title": "drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42310", "datePublished": "2024-08-17T09:09:14.820Z", "dateReserved": "2024-07-30T07:40:12.276Z", "dateUpdated": "2024-12-19T09:16:08.069Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42312
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sysctl: always initialize i_uid/i_gid
Always initialize i_uid/i_gid inside the sysfs core so set_ownership()
can safely skip setting them.
Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of
i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when
set_ownership() was not implemented. It also missed adjusting
net_ctl_set_ownership() to use the same default values in case the
computation of a better value failed.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf Version: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf Version: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf Version: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf Version: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf Version: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42312", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:55.484877Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:26.909Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/proc/proc_sysctl.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b2591c89a6e2858796111138c38fcb6851aa1955", "status": "affected", "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf", "versionType": "git" }, { "lessThan": "34a86adea1f2b3c3f9d864c8cce09dca644601ab", "status": "affected", "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf", "versionType": "git" }, { "lessThan": "1deae34db9f4f8e0e03f891be2e2e15c15c8ac05", "status": "affected", "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf", "versionType": "git" }, { "lessThan": "ffde3af4b29bf97d62d82e1d45275587e10a991a", "status": "affected", "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf", "versionType": "git" }, { "lessThan": "c7e2f43d182f5dde473389dbb39f16c9f0d64536", "status": "affected", "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf", "versionType": "git" }, { "lessThan": "98ca62ba9e2be5863c7d069f84f7166b45a5b2f4", "status": "affected", "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/proc/proc_sysctl.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.3" }, { "lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: always initialize i_uid/i_gid\n\nAlways initialize i_uid/i_gid inside the sysfs core so set_ownership()\ncan safely skip setting them.\n\nCommit 5ec27ec735ba (\"fs/proc/proc_sysctl.c: fix the default values of\ni_uid/i_gid on /proc/sys inodes.\") added defaults for i_uid/i_gid when\nset_ownership() was not implemented. It also missed adjusting\nnet_ctl_set_ownership() to use the same default values in case the\ncomputation of a better value failed." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:10.514Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b2591c89a6e2858796111138c38fcb6851aa1955" }, { "url": "https://git.kernel.org/stable/c/34a86adea1f2b3c3f9d864c8cce09dca644601ab" }, { "url": "https://git.kernel.org/stable/c/1deae34db9f4f8e0e03f891be2e2e15c15c8ac05" }, { "url": "https://git.kernel.org/stable/c/ffde3af4b29bf97d62d82e1d45275587e10a991a" }, { "url": "https://git.kernel.org/stable/c/c7e2f43d182f5dde473389dbb39f16c9f0d64536" }, { "url": "https://git.kernel.org/stable/c/98ca62ba9e2be5863c7d069f84f7166b45a5b2f4" } ], "title": "sysctl: always initialize i_uid/i_gid", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42312", "datePublished": "2024-08-17T09:09:16.646Z", "dateReserved": "2024-07-30T07:40:12.277Z", "dateUpdated": "2024-12-19T09:16:10.514Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42280
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mISDN: Fix a use after free in hfcmulti_tx()
Don't dereference *sp after calling dev_kfree_skb(*sp).
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: af69fb3a8ffa37e986db00ed93099dc44babeef4 Version: af69fb3a8ffa37e986db00ed93099dc44babeef4 Version: af69fb3a8ffa37e986db00ed93099dc44babeef4 Version: af69fb3a8ffa37e986db00ed93099dc44babeef4 Version: af69fb3a8ffa37e986db00ed93099dc44babeef4 Version: af69fb3a8ffa37e986db00ed93099dc44babeef4 Version: af69fb3a8ffa37e986db00ed93099dc44babeef4 Version: af69fb3a8ffa37e986db00ed93099dc44babeef4 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42280", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:39.682152Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:31.049Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/isdn/hardware/mISDN/hfcmulti.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "70db2c84631f50e02e6b32b543700699dd395803", "status": "affected", "version": "af69fb3a8ffa37e986db00ed93099dc44babeef4", "versionType": "git" }, { "lessThan": "d3e4d4a98c5629ccdcb762a0ff6c82ba9738a0c3", "status": "affected", "version": "af69fb3a8ffa37e986db00ed93099dc44babeef4", "versionType": "git" }, { "lessThan": "9460ac3dd1ae033bc2b021a458fb535a0c36ddb2", "status": "affected", "version": "af69fb3a8ffa37e986db00ed93099dc44babeef4", "versionType": "git" }, { "lessThan": "8f4030277dfb9dbe04fd78566b19931097c9d629", "status": "affected", "version": "af69fb3a8ffa37e986db00ed93099dc44babeef4", "versionType": "git" }, { "lessThan": "4d8b642985ae24f4b3656438eb8489834a17bb80", "status": "affected", "version": "af69fb3a8ffa37e986db00ed93099dc44babeef4", "versionType": "git" }, { "lessThan": "ddc79556641ee070d36be0de4a1f0a16a71f1fc7", "status": "affected", "version": "af69fb3a8ffa37e986db00ed93099dc44babeef4", "versionType": "git" }, { "lessThan": "7e4a539bca7d8d20f2c5d93c18cce8ef77cd78e0", "status": "affected", "version": "af69fb3a8ffa37e986db00ed93099dc44babeef4", "versionType": "git" }, { "lessThan": "61ab751451f5ebd0b98e02276a44e23a10110402", "status": "affected", "version": "af69fb3a8ffa37e986db00ed93099dc44babeef4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/isdn/hardware/mISDN/hfcmulti.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.27" }, { "lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: Fix a use after free in hfcmulti_tx()\n\nDon\u0027t dereference *sp after calling dev_kfree_skb(*sp)." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:32.625Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/70db2c84631f50e02e6b32b543700699dd395803" }, { "url": "https://git.kernel.org/stable/c/d3e4d4a98c5629ccdcb762a0ff6c82ba9738a0c3" }, { "url": "https://git.kernel.org/stable/c/9460ac3dd1ae033bc2b021a458fb535a0c36ddb2" }, { "url": "https://git.kernel.org/stable/c/8f4030277dfb9dbe04fd78566b19931097c9d629" }, { "url": "https://git.kernel.org/stable/c/4d8b642985ae24f4b3656438eb8489834a17bb80" }, { "url": "https://git.kernel.org/stable/c/ddc79556641ee070d36be0de4a1f0a16a71f1fc7" }, { "url": "https://git.kernel.org/stable/c/7e4a539bca7d8d20f2c5d93c18cce8ef77cd78e0" }, { "url": "https://git.kernel.org/stable/c/61ab751451f5ebd0b98e02276a44e23a10110402" } ], "title": "mISDN: Fix a use after free in hfcmulti_tx()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42280", "datePublished": "2024-08-17T09:08:47.699Z", "dateReserved": "2024-07-30T07:40:12.261Z", "dateUpdated": "2024-12-19T09:15:32.625Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42320
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: fix error checks in dasd_copy_pair_store()
dasd_add_busid() can return an error via ERR_PTR() if an allocation
fails. However, two callsites in dasd_copy_pair_store() do not check
the result, potentially resulting in a NULL pointer dereference. Fix
this by checking the result with IS_ERR() and returning the error up
the stack.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42320", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:28.985238Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:25.946Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/s390/block/dasd_devmap.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "cc8b7284d5076722e0b8062373b68d8e47c3bace", "status": "affected", "version": "a91ff09d39f9b6545254839ac91f1ff7bd21d39e", "versionType": "git" }, { "lessThan": "e511167e65d332d07b3c7a3d5a741ee9c19a8c27", "status": "affected", "version": "a91ff09d39f9b6545254839ac91f1ff7bd21d39e", "versionType": "git" }, { "lessThan": "68d4c3722290ad300c295fb3435e835d200d5cb2", "status": "affected", "version": "a91ff09d39f9b6545254839ac91f1ff7bd21d39e", "versionType": "git" }, { "lessThan": "8e64d2356cbc800b4cd0e3e614797f76bcf0cdb8", "status": "affected", "version": "a91ff09d39f9b6545254839ac91f1ff7bd21d39e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/s390/block/dasd_devmap.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.1" }, { "lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: fix error checks in dasd_copy_pair_store()\n\ndasd_add_busid() can return an error via ERR_PTR() if an allocation\nfails. However, two callsites in dasd_copy_pair_store() do not check\nthe result, potentially resulting in a NULL pointer dereference. Fix\nthis by checking the result with IS_ERR() and returning the error up\nthe stack." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:20.223Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/cc8b7284d5076722e0b8062373b68d8e47c3bace" }, { "url": "https://git.kernel.org/stable/c/e511167e65d332d07b3c7a3d5a741ee9c19a8c27" }, { "url": "https://git.kernel.org/stable/c/68d4c3722290ad300c295fb3435e835d200d5cb2" }, { "url": "https://git.kernel.org/stable/c/8e64d2356cbc800b4cd0e3e614797f76bcf0cdb8" } ], "title": "s390/dasd: fix error checks in dasd_copy_pair_store()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42320", "datePublished": "2024-08-17T09:09:32.695Z", "dateReserved": "2024-07-30T07:40:12.279Z", "dateUpdated": "2024-12-19T09:16:20.223Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42322
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: properly dereference pe in ip_vs_add_service
Use pe directly to resolve sparse warning:
net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42322", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:22.660389Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:25.691Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/netfilter/ipvs/ip_vs_ctl.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b2c664df3bb46aabac6a5fd78aaa5bd614cfad97", "status": "affected", "version": "39b9722315364121c6e2524515a6e95d52287549", "versionType": "git" }, { "lessThan": "3dd428039e06e1967ce294e2cd6342825aaaad77", "status": "affected", "version": "39b9722315364121c6e2524515a6e95d52287549", "versionType": "git" }, { "lessThan": "c420cd5d5bc6797f3a8824e7d74f38f0c286fca5", "status": "affected", "version": "39b9722315364121c6e2524515a6e95d52287549", "versionType": "git" }, { "lessThan": "cbd070a4ae62f119058973f6d2c984e325bce6e7", "status": "affected", "version": "39b9722315364121c6e2524515a6e95d52287549", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/netfilter/ipvs/ip_vs_ctl.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.7" }, { "lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.119", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: properly dereference pe in ip_vs_add_service\n\nUse pe directly to resolve sparse warning:\n\n net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:22.714Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b2c664df3bb46aabac6a5fd78aaa5bd614cfad97" }, { "url": "https://git.kernel.org/stable/c/3dd428039e06e1967ce294e2cd6342825aaaad77" }, { "url": "https://git.kernel.org/stable/c/c420cd5d5bc6797f3a8824e7d74f38f0c286fca5" }, { "url": "https://git.kernel.org/stable/c/cbd070a4ae62f119058973f6d2c984e325bce6e7" } ], "title": "ipvs: properly dereference pe in ip_vs_add_service", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42322", "datePublished": "2024-08-17T09:09:34.295Z", "dateReserved": "2024-07-30T07:40:12.279Z", "dateUpdated": "2024-12-19T09:16:22.714Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43819
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
kvm: s390: Reject memory region operations for ucontrol VMs
This change rejects the KVM_SET_USER_MEMORY_REGION and
KVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM.
This is necessary since ucontrol VMs have kvm->arch.gmap set to 0 and
would thus result in a null pointer dereference further in.
Memory management needs to be performed in userspace and using the
ioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP.
Also improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION
and KVM_SET_USER_MEMORY_REGION2.
[frankja@linux.ibm.com: commit message spelling fix, subject prefix fix]
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43819", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:06.730085Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:25.193Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "Documentation/virt/kvm/api.rst", "arch/s390/kvm/kvm-s390.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "49c9945c054df4c22008e2bf87ca74d3e2507aa6", "status": "affected", "version": "27e0393f15fc8bc855c6a888387ff5ffd2181089", "versionType": "git" }, { "lessThan": "7816e58967d0e6cadce05c8540b47ed027dc2499", "status": "affected", "version": "27e0393f15fc8bc855c6a888387ff5ffd2181089", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "Documentation/virt/kvm/api.rst", "arch/s390/kvm/kvm-s390.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.4" }, { "lessThan": "3.4", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkvm: s390: Reject memory region operations for ucontrol VMs\n\nThis change rejects the KVM_SET_USER_MEMORY_REGION and\nKVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM.\nThis is necessary since ucontrol VMs have kvm-\u003earch.gmap set to 0 and\nwould thus result in a null pointer dereference further in.\nMemory management needs to be performed in userspace and using the\nioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP.\n\nAlso improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION\nand KVM_SET_USER_MEMORY_REGION2.\n\n[frankja@linux.ibm.com: commit message spelling fix, subject prefix fix]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:28.899Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/49c9945c054df4c22008e2bf87ca74d3e2507aa6" }, { "url": "https://git.kernel.org/stable/c/7816e58967d0e6cadce05c8540b47ed027dc2499" } ], "title": "kvm: s390: Reject memory region operations for ucontrol VMs", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43819", "datePublished": "2024-08-17T09:21:40.994Z", "dateReserved": "2024-08-17T09:11:59.271Z", "dateUpdated": "2024-12-19T09:16:28.899Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42271
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: fix use after free in iucv_sock_close()
iucv_sever_path() is called from process context and from bh context.
iucv->path is used as indicator whether somebody else is taking care of
severing the path (or it is already removed / never existed).
This needs to be done with atomic compare and swap, otherwise there is a
small window where iucv_sock_close() will try to work with a path that has
already been severed and freed by iucv_callback_connrej() called by
iucv_tasklet_fn().
Example:
[452744.123844] Call Trace:
[452744.123845] ([<0000001e87f03880>] 0x1e87f03880)
[452744.123966] [<00000000d593001e>] iucv_path_sever+0x96/0x138
[452744.124330] [<000003ff801ddbca>] iucv_sever_path+0xc2/0xd0 [af_iucv]
[452744.124336] [<000003ff801e01b6>] iucv_sock_close+0xa6/0x310 [af_iucv]
[452744.124341] [<000003ff801e08cc>] iucv_sock_release+0x3c/0xd0 [af_iucv]
[452744.124345] [<00000000d574794e>] __sock_release+0x5e/0xe8
[452744.124815] [<00000000d5747a0c>] sock_close+0x34/0x48
[452744.124820] [<00000000d5421642>] __fput+0xba/0x268
[452744.124826] [<00000000d51b382c>] task_work_run+0xbc/0xf0
[452744.124832] [<00000000d5145710>] do_notify_resume+0x88/0x90
[452744.124841] [<00000000d5978096>] system_call+0xe2/0x2c8
[452744.125319] Last Breaking-Event-Address:
[452744.125321] [<00000000d5930018>] iucv_path_sever+0x90/0x138
[452744.125324]
[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt
Note that bh_lock_sock() is not serializing the tasklet context against
process context, because the check for sock_owned_by_user() and
corresponding handling is missing.
Ideas for a future clean-up patch:
A) Correct usage of bh_lock_sock() in tasklet context, as described in
Re-enqueue, if needed. This may require adding return values to the
tasklet functions and thus changes to all users of iucv.
B) Change iucv tasklet into worker and use only lock_sock() in af_iucv.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 7d316b9453523498246e9e19a659c423d4c5081e Version: 7d316b9453523498246e9e19a659c423d4c5081e Version: 7d316b9453523498246e9e19a659c423d4c5081e Version: 7d316b9453523498246e9e19a659c423d4c5081e Version: 7d316b9453523498246e9e19a659c423d4c5081e Version: 7d316b9453523498246e9e19a659c423d4c5081e Version: 7d316b9453523498246e9e19a659c423d4c5081e Version: 7d316b9453523498246e9e19a659c423d4c5081e |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42271", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:11.442193Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:32.331Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/iucv/af_iucv.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "84f40b46787ecb67c7ad08a5bb1376141fa10c01", "status": "affected", "version": "7d316b9453523498246e9e19a659c423d4c5081e", "versionType": "git" }, { "lessThan": "37652fbef9809411cea55ea5fa1a170e299efcd0", "status": "affected", "version": "7d316b9453523498246e9e19a659c423d4c5081e", "versionType": "git" }, { "lessThan": "c65f72eec60a34ace031426e04e9aff8e5f04895", "status": "affected", "version": "7d316b9453523498246e9e19a659c423d4c5081e", "versionType": "git" }, { "lessThan": "ac758e1f663fe9bc64f6b47212a2aa18697524f5", "status": "affected", "version": "7d316b9453523498246e9e19a659c423d4c5081e", "versionType": "git" }, { "lessThan": "8b424c9e44111c5a76f41c6b741f8d4c4179d876", "status": "affected", "version": "7d316b9453523498246e9e19a659c423d4c5081e", "versionType": "git" }, { "lessThan": "01437282fd3904810603f3dc98d2cac6b8b6fc84", "status": "affected", "version": "7d316b9453523498246e9e19a659c423d4c5081e", "versionType": "git" }, { "lessThan": "69620522c48ce8215e5eb55ffbab8cafee8f407d", "status": "affected", "version": "7d316b9453523498246e9e19a659c423d4c5081e", "versionType": "git" }, { "lessThan": "f558120cd709682b739207b48cf7479fd9568431", "status": "affected", "version": "7d316b9453523498246e9e19a659c423d4c5081e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/iucv/af_iucv.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.4" }, { "lessThan": "3.4", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use after free in iucv_sock_close()\n\niucv_sever_path() is called from process context and from bh context.\niucv-\u003epath is used as indicator whether somebody else is taking care of\nsevering the path (or it is already removed / never existed).\nThis needs to be done with atomic compare and swap, otherwise there is a\nsmall window where iucv_sock_close() will try to work with a path that has\nalready been severed and freed by iucv_callback_connrej() called by\niucv_tasklet_fn().\n\nExample:\n[452744.123844] Call Trace:\n[452744.123845] ([\u003c0000001e87f03880\u003e] 0x1e87f03880)\n[452744.123966] [\u003c00000000d593001e\u003e] iucv_path_sever+0x96/0x138\n[452744.124330] [\u003c000003ff801ddbca\u003e] iucv_sever_path+0xc2/0xd0 [af_iucv]\n[452744.124336] [\u003c000003ff801e01b6\u003e] iucv_sock_close+0xa6/0x310 [af_iucv]\n[452744.124341] [\u003c000003ff801e08cc\u003e] iucv_sock_release+0x3c/0xd0 [af_iucv]\n[452744.124345] [\u003c00000000d574794e\u003e] __sock_release+0x5e/0xe8\n[452744.124815] [\u003c00000000d5747a0c\u003e] sock_close+0x34/0x48\n[452744.124820] [\u003c00000000d5421642\u003e] __fput+0xba/0x268\n[452744.124826] [\u003c00000000d51b382c\u003e] task_work_run+0xbc/0xf0\n[452744.124832] [\u003c00000000d5145710\u003e] do_notify_resume+0x88/0x90\n[452744.124841] [\u003c00000000d5978096\u003e] system_call+0xe2/0x2c8\n[452744.125319] Last Breaking-Event-Address:\n[452744.125321] [\u003c00000000d5930018\u003e] iucv_path_sever+0x90/0x138\n[452744.125324]\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\n\nNote that bh_lock_sock() is not serializing the tasklet context against\nprocess context, because the check for sock_owned_by_user() and\ncorresponding handling is missing.\n\nIdeas for a future clean-up patch:\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\nRe-enqueue, if needed. This may require adding return values to the\ntasklet functions and thus changes to all users of iucv.\n\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:16.991Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/84f40b46787ecb67c7ad08a5bb1376141fa10c01" }, { "url": "https://git.kernel.org/stable/c/37652fbef9809411cea55ea5fa1a170e299efcd0" }, { "url": "https://git.kernel.org/stable/c/c65f72eec60a34ace031426e04e9aff8e5f04895" }, { "url": "https://git.kernel.org/stable/c/ac758e1f663fe9bc64f6b47212a2aa18697524f5" }, { "url": "https://git.kernel.org/stable/c/8b424c9e44111c5a76f41c6b741f8d4c4179d876" }, { "url": "https://git.kernel.org/stable/c/01437282fd3904810603f3dc98d2cac6b8b6fc84" }, { "url": "https://git.kernel.org/stable/c/69620522c48ce8215e5eb55ffbab8cafee8f407d" }, { "url": "https://git.kernel.org/stable/c/f558120cd709682b739207b48cf7479fd9568431" } ], "title": "net/iucv: fix use after free in iucv_sock_close()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42271", "datePublished": "2024-08-17T08:54:26.048Z", "dateReserved": "2024-07-30T07:40:12.260Z", "dateUpdated": "2024-12-19T09:15:16.991Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43832
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/uv: Don't call folio_wait_writeback() without a folio reference
folio_wait_writeback() requires that no spinlocks are held and that
a folio reference is held, as documented. After we dropped the PTL, the
folio could get freed concurrently. So grab a temporary reference.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43832", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:24.816195Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:07.778Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/s390/kernel/uv.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1a1eb2f3fc453dcd52726d13e863938561489cb7", "status": "affected", "version": "214d9bbcd3a67230b932f6cea83c078ab34d9e70", "versionType": "git" }, { "lessThan": "8736604ef53359a718c246087cd21dcec232d2fb", "status": "affected", "version": "214d9bbcd3a67230b932f6cea83c078ab34d9e70", "versionType": "git" }, { "lessThan": "b21aba72aadd94bdac275deab021fc84d6c72b16", "status": "affected", "version": "214d9bbcd3a67230b932f6cea83c078ab34d9e70", "versionType": "git" }, { "lessThan": "3f29f6537f54d74e64bac0a390fb2e26da25800d", "status": "affected", "version": "214d9bbcd3a67230b932f6cea83c078ab34d9e70", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/s390/kernel/uv.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.7" }, { "lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/uv: Don\u0027t call folio_wait_writeback() without a folio reference\n\nfolio_wait_writeback() requires that no spinlocks are held and that\na folio reference is held, as documented. After we dropped the PTL, the\nfolio could get freed concurrently. So grab a temporary reference." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:44.788Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1a1eb2f3fc453dcd52726d13e863938561489cb7" }, { "url": "https://git.kernel.org/stable/c/8736604ef53359a718c246087cd21dcec232d2fb" }, { "url": "https://git.kernel.org/stable/c/b21aba72aadd94bdac275deab021fc84d6c72b16" }, { "url": "https://git.kernel.org/stable/c/3f29f6537f54d74e64bac0a390fb2e26da25800d" } ], "title": "s390/uv: Don\u0027t call folio_wait_writeback() without a folio reference", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43832", "datePublished": "2024-08-17T09:21:50.230Z", "dateReserved": "2024-08-17T09:11:59.273Z", "dateUpdated": "2024-12-19T09:16:44.788Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42303
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
devm_regmap_init_mmio() can fail, add a check and bail out in case of
error.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42303", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:25.577009Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:28.206Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/media/platform/nxp/imx-pxp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "358bc85269d6a359fea597ef9fbb429cd3626e08", "status": "affected", "version": "4e5bd3fdbeb3100d1f120999130afb2a7d41d82a", "versionType": "git" }, { "lessThan": "5ab6ac4e9e165b0fe8a326308218337007224f05", "status": "affected", "version": "4e5bd3fdbeb3100d1f120999130afb2a7d41d82a", "versionType": "git" }, { "lessThan": "57e9ce68ae98551da9c161aaab12b41fe8601856", "status": "affected", "version": "4e5bd3fdbeb3100d1f120999130afb2a7d41d82a", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/media/platform/nxp/imx-pxp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imx-pxp: Fix ERR_PTR dereference in pxp_probe()\n\ndevm_regmap_init_mmio() can fail, add a check and bail out in case of\nerror." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:00.418Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/358bc85269d6a359fea597ef9fbb429cd3626e08" }, { "url": "https://git.kernel.org/stable/c/5ab6ac4e9e165b0fe8a326308218337007224f05" }, { "url": "https://git.kernel.org/stable/c/57e9ce68ae98551da9c161aaab12b41fe8601856" } ], "title": "media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42303", "datePublished": "2024-08-17T09:09:09.884Z", "dateReserved": "2024-07-30T07:40:12.272Z", "dateUpdated": "2024-12-19T09:16:00.418Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42268
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix missing lock on sync reset reload
On sync reset reload work, when remote host updates devlink on reload
actions performed on that host, it misses taking devlink lock before
calling devlink_remote_reload_actions_performed() which results in
triggering lock assert like the following:
WARNING: CPU: 4 PID: 1164 at net/devlink/core.c:261 devl_assert_locked+0x3e/0x50
…
CPU: 4 PID: 1164 Comm: kworker/u96:6 Tainted: G S W 6.10.0-rc2+ #116
Hardware name: Supermicro SYS-2028TP-DECTR/X10DRT-PT, BIOS 2.0 12/18/2015
Workqueue: mlx5_fw_reset_events mlx5_sync_reset_reload_work [mlx5_core]
RIP: 0010:devl_assert_locked+0x3e/0x50
…
Call Trace:
<TASK>
? __warn+0xa4/0x210
? devl_assert_locked+0x3e/0x50
? report_bug+0x160/0x280
? handle_bug+0x3f/0x80
? exc_invalid_op+0x17/0x40
? asm_exc_invalid_op+0x1a/0x20
? devl_assert_locked+0x3e/0x50
devlink_notify+0x88/0x2b0
? mlx5_attach_device+0x20c/0x230 [mlx5_core]
? __pfx_devlink_notify+0x10/0x10
? process_one_work+0x4b6/0xbb0
process_one_work+0x4b6/0xbb0
[…]
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42268", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:21.113332Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:32.805Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "5d07d1d40aabfd61bab21115639bd4f641db6002", "status": "affected", "version": "84a433a40d0ebf3bbf36b8bfa58c6f45dc782344", "versionType": "git" }, { "lessThan": "98884e89c90d077f6fe6ba18e6cf6f914642f04e", "status": "affected", "version": "84a433a40d0ebf3bbf36b8bfa58c6f45dc782344", "versionType": "git" }, { "lessThan": "091268f3c27a5b6d7858a3bb2a0dbcc9cd26ddb5", "status": "affected", "version": "84a433a40d0ebf3bbf36b8bfa58c6f45dc782344", "versionType": "git" }, { "lessThan": "572f9caa9e7295f8c8822e4122c7ae8f1c412ff9", "status": "affected", "version": "84a433a40d0ebf3bbf36b8bfa58c6f45dc782344", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix missing lock on sync reset reload\n\nOn sync reset reload work, when remote host updates devlink on reload\nactions performed on that host, it misses taking devlink lock before\ncalling devlink_remote_reload_actions_performed() which results in\ntriggering lock assert like the following:\n\nWARNING: CPU: 4 PID: 1164 at net/devlink/core.c:261 devl_assert_locked+0x3e/0x50\n\u2026\n CPU: 4 PID: 1164 Comm: kworker/u96:6 Tainted: G S W 6.10.0-rc2+ #116\n Hardware name: Supermicro SYS-2028TP-DECTR/X10DRT-PT, BIOS 2.0 12/18/2015\n Workqueue: mlx5_fw_reset_events mlx5_sync_reset_reload_work [mlx5_core]\n RIP: 0010:devl_assert_locked+0x3e/0x50\n\u2026\n Call Trace:\n \u003cTASK\u003e\n ? __warn+0xa4/0x210\n ? devl_assert_locked+0x3e/0x50\n ? report_bug+0x160/0x280\n ? handle_bug+0x3f/0x80\n ? exc_invalid_op+0x17/0x40\n ? asm_exc_invalid_op+0x1a/0x20\n ? devl_assert_locked+0x3e/0x50\n devlink_notify+0x88/0x2b0\n ? mlx5_attach_device+0x20c/0x230 [mlx5_core]\n ? __pfx_devlink_notify+0x10/0x10\n ? process_one_work+0x4b6/0xbb0\n process_one_work+0x4b6/0xbb0\n[\u2026]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:13.301Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/5d07d1d40aabfd61bab21115639bd4f641db6002" }, { "url": "https://git.kernel.org/stable/c/98884e89c90d077f6fe6ba18e6cf6f914642f04e" }, { "url": "https://git.kernel.org/stable/c/091268f3c27a5b6d7858a3bb2a0dbcc9cd26ddb5" }, { "url": "https://git.kernel.org/stable/c/572f9caa9e7295f8c8822e4122c7ae8f1c412ff9" } ], "title": "net/mlx5: Fix missing lock on sync reset reload", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42268", "datePublished": "2024-08-17T08:54:23.624Z", "dateReserved": "2024-07-30T07:40:12.259Z", "dateUpdated": "2024-12-19T09:15:13.301Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42306
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
udf: Avoid using corrupted block bitmap buffer
When the filesystem block bitmap is corrupted, we detect the corruption
while loading the bitmap and fail the allocation with error. However the
next allocation from the same bitmap will notice the bitmap buffer is
already loaded and tries to allocate from the bitmap with mixed results
(depending on the exact nature of the bitmap corruption). Fix the
problem by using BH_verified bit to indicate whether the bitmap is valid
or not.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 7648ea9896b31aff38830d81188f5b7a1773e4a8 Version: 4ac54312f623c6d2ca30c36c1ef530c11f5aff64 Version: 099bf90d7fc4622da9fd4727f6d318a0f12d10be Version: 6ac8f2c8362afd2baa8e7b9c946597589e587d22 Version: 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d Version: 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d Version: 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42306", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:15.929324Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:27.843Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/udf/balloc.c", "fs/udf/super.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "cae9e59cc41683408b70b9ab569f8654866ba914", "status": "affected", "version": "7648ea9896b31aff38830d81188f5b7a1773e4a8", "versionType": "git" }, { "lessThan": "2199e157a465aaf98294d3932797ecd7fce942d5", "status": "affected", "version": "4ac54312f623c6d2ca30c36c1ef530c11f5aff64", "versionType": "git" }, { "lessThan": "6a43e3c210df6c5f00570f4be49a897677dbcb64", "status": "affected", "version": "099bf90d7fc4622da9fd4727f6d318a0f12d10be", "versionType": "git" }, { "lessThan": "271cab2ca00652bc984e269cf1208699a1e09cdd", "status": "affected", "version": "6ac8f2c8362afd2baa8e7b9c946597589e587d22", "versionType": "git" }, { "lessThan": "57053b3bcf3403b80db6f65aba284d7dfe7326af", "status": "affected", "version": "1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d", "versionType": "git" }, { "lessThan": "8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65", "status": "affected", "version": "1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d", "versionType": "git" }, { "lessThan": "a90d4471146de21745980cba51ce88e7926bcc4f", "status": "affected", "version": "1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/udf/balloc.c", "fs/udf/super.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Avoid using corrupted block bitmap buffer\n\nWhen the filesystem block bitmap is corrupted, we detect the corruption\nwhile loading the bitmap and fail the allocation with error. However the\nnext allocation from the same bitmap will notice the bitmap buffer is\nalready loaded and tries to allocate from the bitmap with mixed results\n(depending on the exact nature of the bitmap corruption). Fix the\nproblem by using BH_verified bit to indicate whether the bitmap is valid\nor not." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:04.377Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/cae9e59cc41683408b70b9ab569f8654866ba914" }, { "url": "https://git.kernel.org/stable/c/2199e157a465aaf98294d3932797ecd7fce942d5" }, { "url": "https://git.kernel.org/stable/c/6a43e3c210df6c5f00570f4be49a897677dbcb64" }, { "url": "https://git.kernel.org/stable/c/271cab2ca00652bc984e269cf1208699a1e09cdd" }, { "url": "https://git.kernel.org/stable/c/57053b3bcf3403b80db6f65aba284d7dfe7326af" }, { "url": "https://git.kernel.org/stable/c/8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65" }, { "url": "https://git.kernel.org/stable/c/a90d4471146de21745980cba51ce88e7926bcc4f" } ], "title": "udf: Avoid using corrupted block bitmap buffer", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42306", "datePublished": "2024-08-17T09:09:11.938Z", "dateReserved": "2024-07-30T07:40:12.273Z", "dateUpdated": "2024-12-19T09:16:04.377Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42304
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: make sure the first directory block is not a hole
The syzbot constructs a directory that has no dirblock but is non-inline,
i.e. the first directory block is a hole. And no errors are reported when
creating files in this directory in the following flow.
ext4_mknod
...
ext4_add_entry
// Read block 0
ext4_read_dirblock(dir, block, DIRENT)
bh = ext4_bread(NULL, inode, block, 0)
if (!bh && (type == INDEX || type == DIRENT_HTREE))
// The first directory block is a hole
// But type == DIRENT, so no error is reported.
After that, we get a directory block without '.' and '..' but with a valid
dentry. This may cause some code that relies on dot or dotdot (such as
make_indexed_dir()) to crash.
Therefore when ext4_read_dirblock() finds that the first directory block
is a hole report that the filesystem is corrupted and return an error to
avoid loading corrupted data from disk causing something bad.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 3a17ca864baffc0c6f6e8aad525aa4365775a193 Version: 4e19d6b65fb4fc42e352ce9883649e049da14743 Version: 4e19d6b65fb4fc42e352ce9883649e049da14743 Version: 4e19d6b65fb4fc42e352ce9883649e049da14743 Version: 4e19d6b65fb4fc42e352ce9883649e049da14743 Version: 4e19d6b65fb4fc42e352ce9883649e049da14743 Version: 4e19d6b65fb4fc42e352ce9883649e049da14743 Version: 4e19d6b65fb4fc42e352ce9883649e049da14743 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42304", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:22.365835Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:28.095Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/ext4/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "d81d7e347d1f1f48a5634607d39eb90c161c8afe", "status": "affected", "version": "3a17ca864baffc0c6f6e8aad525aa4365775a193", "versionType": "git" }, { "lessThan": "e02f9941e8c011aa3eafa799def6a134ce06bcfa", "status": "affected", "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "versionType": "git" }, { "lessThan": "de2a011a13a46468a6e8259db58b1b62071fe136", "status": "affected", "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "versionType": "git" }, { "lessThan": "9771e3d8365ae1dd5e8846a204cb9af14e3e656a", "status": "affected", "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "versionType": "git" }, { "lessThan": "b609753cbbd38f8c0affd4956c0af178348523ac", "status": "affected", "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "versionType": "git" }, { "lessThan": "c3893d9de8ee153baac56d127d844103488133b5", "status": "affected", "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "versionType": "git" }, { "lessThan": "299bc6ffa57e04e74c6cce866d6c0741fb4897a1", "status": "affected", "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "versionType": "git" }, { "lessThan": "f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6", "status": "affected", "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/ext4/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.3" }, { "lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: make sure the first directory block is not a hole\n\nThe syzbot constructs a directory that has no dirblock but is non-inline,\ni.e. the first directory block is a hole. And no errors are reported when\ncreating files in this directory in the following flow.\n\n ext4_mknod\n ...\n ext4_add_entry\n // Read block 0\n ext4_read_dirblock(dir, block, DIRENT)\n bh = ext4_bread(NULL, inode, block, 0)\n if (!bh \u0026\u0026 (type == INDEX || type == DIRENT_HTREE))\n // The first directory block is a hole\n // But type == DIRENT, so no error is reported.\n\nAfter that, we get a directory block without \u0027.\u0027 and \u0027..\u0027 but with a valid\ndentry. This may cause some code that relies on dot or dotdot (such as\nmake_indexed_dir()) to crash.\n\nTherefore when ext4_read_dirblock() finds that the first directory block\nis a hole report that the filesystem is corrupted and return an error to\navoid loading corrupted data from disk causing something bad." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:01.855Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe" }, { "url": "https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa" }, { "url": "https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136" }, { "url": "https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a" }, { "url": "https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac" }, { "url": "https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5" }, { "url": "https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1" }, { "url": "https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6" } ], "title": "ext4: make sure the first directory block is not a hole", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42304", "datePublished": "2024-08-17T09:09:10.545Z", "dateReserved": "2024-07-30T07:40:12.272Z", "dateUpdated": "2024-12-19T09:16:01.855Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42297
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to don't dirty inode for readonly filesystem
syzbot reports f2fs bug as below:
kernel BUG at fs/f2fs/inode.c:933!
RIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933
Call Trace:
evict+0x2a4/0x620 fs/inode.c:664
dispose_list fs/inode.c:697 [inline]
evict_inodes+0x5f8/0x690 fs/inode.c:747
generic_shutdown_super+0x9d/0x2c0 fs/super.c:675
kill_block_super+0x44/0x90 fs/super.c:1667
kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894
deactivate_locked_super+0xc1/0x130 fs/super.c:484
cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256
task_work_run+0x24a/0x300 kernel/task_work.c:180
ptrace_notify+0x2cd/0x380 kernel/signal.c:2399
ptrace_report_syscall include/linux/ptrace.h:411 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline]
syscall_exit_work kernel/entry/common.c:251 [inline]
syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296
do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88
entry_SYSCALL_64_after_hwframe+0x63/0x6b
The root cause is:
- do_sys_open
- f2fs_lookup
- __f2fs_find_entry
- f2fs_i_depth_write
- f2fs_mark_inode_dirty_sync
- f2fs_dirty_inode
- set_inode_flag(inode, FI_DIRTY_INODE)
- umount
- kill_f2fs_super
- kill_block_super
- generic_shutdown_super
- sync_filesystem
: sb is readonly, skip sync_filesystem()
- evict_inodes
- iput
- f2fs_evict_inode
- f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE))
: trigger kernel panic
When we try to repair i_current_depth in readonly filesystem, let's
skip dirty inode to avoid panic in later f2fs_evict_inode().
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42297", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:44.574818Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:28.885Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/f2fs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "2d2916516577f2239b3377d9e8d12da5e6ccdfcf", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "54162974aea37a8cae00742470a78c7f6bd6f915", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "54bc4e88447e385c4d4ffa85d93e0dce628fcfa6", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "ec56571b4b146a1cfbedab49d5fcaf19fe8bf4f1", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "9ce8135accf103f7333af472709125878704fdd4", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "e62ff092a42f4a1bae3b310cf46673b4f3aac3b5", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "2434344559f6743efb3ac15d11af9a0db9543bd3", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "192b8fb8d1c8ca3c87366ebbef599fa80bb626b8", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/f2fs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to don\u0027t dirty inode for readonly filesystem\n\nsyzbot reports f2fs bug as below:\n\nkernel BUG at fs/f2fs/inode.c:933!\nRIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933\nCall Trace:\n evict+0x2a4/0x620 fs/inode.c:664\n dispose_list fs/inode.c:697 [inline]\n evict_inodes+0x5f8/0x690 fs/inode.c:747\n generic_shutdown_super+0x9d/0x2c0 fs/super.c:675\n kill_block_super+0x44/0x90 fs/super.c:1667\n kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894\n deactivate_locked_super+0xc1/0x130 fs/super.c:484\n cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256\n task_work_run+0x24a/0x300 kernel/task_work.c:180\n ptrace_notify+0x2cd/0x380 kernel/signal.c:2399\n ptrace_report_syscall include/linux/ptrace.h:411 [inline]\n ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline]\n syscall_exit_work kernel/entry/common.c:251 [inline]\n syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]\n syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296\n do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nThe root cause is:\n- do_sys_open\n - f2fs_lookup\n - __f2fs_find_entry\n - f2fs_i_depth_write\n - f2fs_mark_inode_dirty_sync\n - f2fs_dirty_inode\n - set_inode_flag(inode, FI_DIRTY_INODE)\n\n- umount\n - kill_f2fs_super\n - kill_block_super\n - generic_shutdown_super\n - sync_filesystem\n : sb is readonly, skip sync_filesystem()\n - evict_inodes\n - iput\n - f2fs_evict_inode\n - f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE))\n : trigger kernel panic\n\nWhen we try to repair i_current_depth in readonly filesystem, let\u0027s\nskip dirty inode to avoid panic in later f2fs_evict_inode()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:52.651Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/2d2916516577f2239b3377d9e8d12da5e6ccdfcf" }, { "url": "https://git.kernel.org/stable/c/54162974aea37a8cae00742470a78c7f6bd6f915" }, { "url": "https://git.kernel.org/stable/c/54bc4e88447e385c4d4ffa85d93e0dce628fcfa6" }, { "url": "https://git.kernel.org/stable/c/ec56571b4b146a1cfbedab49d5fcaf19fe8bf4f1" }, { "url": "https://git.kernel.org/stable/c/9ce8135accf103f7333af472709125878704fdd4" }, { "url": "https://git.kernel.org/stable/c/e62ff092a42f4a1bae3b310cf46673b4f3aac3b5" }, { "url": "https://git.kernel.org/stable/c/2434344559f6743efb3ac15d11af9a0db9543bd3" }, { "url": "https://git.kernel.org/stable/c/192b8fb8d1c8ca3c87366ebbef599fa80bb626b8" } ], "title": "f2fs: fix to don\u0027t dirty inode for readonly filesystem", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42297", "datePublished": "2024-08-17T09:09:05.076Z", "dateReserved": "2024-07-30T07:40:12.269Z", "dateUpdated": "2024-12-19T09:15:52.651Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43838
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix overflow check in adjust_jmp_off()
adjust_jmp_off() incorrectly used the insn->imm field for all overflow check,
which is incorrect as that should only be done or the BPF_JMP32 | BPF_JA case,
not the general jump instruction case. Fix it by using insn->off for overflow
check in the general case.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43838", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:05.624506Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:22.922Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "kernel/bpf/verifier.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "345652866a8869825a2a582ee5a28d75141f184a", "status": "affected", "version": "5337ac4c9b807bc46baa0713121a0afa8beacd70", "versionType": "git" }, { "lessThan": "4a04b4f0de59dd5c621e78f15803ee0b0544eeb8", "status": "affected", "version": "5337ac4c9b807bc46baa0713121a0afa8beacd70", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "kernel/bpf/verifier.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix overflow check in adjust_jmp_off()\n\nadjust_jmp_off() incorrectly used the insn-\u003eimm field for all overflow check,\nwhich is incorrect as that should only be done or the BPF_JMP32 | BPF_JA case,\nnot the general jump instruction case. Fix it by using insn-\u003eoff for overflow\ncheck in the general case." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:52.374Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/345652866a8869825a2a582ee5a28d75141f184a" }, { "url": "https://git.kernel.org/stable/c/4a04b4f0de59dd5c621e78f15803ee0b0544eeb8" } ], "title": "bpf: fix overflow check in adjust_jmp_off()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43838", "datePublished": "2024-08-17T09:21:54.435Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:52.374Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43853
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: Prevent UAF in proc_cpuset_show()
An UAF can happen when /proc/cpuset is read as reported in [1].
This can be reproduced by the following methods:
1.add an mdelay(1000) before acquiring the cgroup_lock In the
cgroup_path_ns function.
2.$cat /proc/<pid>/cpuset repeatly.
3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/
$umount /sys/fs/cgroup/cpuset/ repeatly.
The race that cause this bug can be shown as below:
(umount) | (cat /proc/<pid>/cpuset)
css_release | proc_cpuset_show
css_release_work_fn | css = task_get_css(tsk, cpuset_cgrp_id);
css_free_rwork_fn | cgroup_path_ns(css->cgroup, ...);
cgroup_destroy_root | mutex_lock(&cgroup_mutex);
rebind_subsystems |
cgroup_free_root |
| // cgrp was freed, UAF
| cgroup_path_ns_locked(cgrp,..);
When the cpuset is initialized, the root node top_cpuset.css.cgrp
will point to &cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will
allocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated
&cgroup_root.cgrp. When the umount operation is executed,
top_cpuset.css.cgrp will be rebound to &cgrp_dfl_root.cgrp.
The problem is that when rebinding to cgrp_dfl_root, there are cases
where the cgroup_root allocated by setting up the root for cgroup v1
is cached. This could lead to a Use-After-Free (UAF) if it is
subsequently freed. The descendant cgroups of cgroup v1 can only be
freed after the css is released. However, the css of the root will never
be released, yet the cgroup_root should be freed when it is unmounted.
This means that obtaining a reference to the css of the root does
not guarantee that css.cgrp->root will not be freed.
Fix this problem by using rcu_read_lock in proc_cpuset_show().
As cgroup_root is kfree_rcu after commit d23b5c577715
("cgroup: Make operations on the cgroup root_list RCU safe"),
css->cgroup won't be freed during the critical section.
To call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to
replace task_get_css with task_css.
[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: a79a908fd2b080977b45bf103184b81c9d11ad07 Version: a79a908fd2b080977b45bf103184b81c9d11ad07 Version: a79a908fd2b080977b45bf103184b81c9d11ad07 Version: a79a908fd2b080977b45bf103184b81c9d11ad07 Version: a79a908fd2b080977b45bf103184b81c9d11ad07 Version: a79a908fd2b080977b45bf103184b81c9d11ad07 Version: a79a908fd2b080977b45bf103184b81c9d11ad07 Version: a79a908fd2b080977b45bf103184b81c9d11ad07 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43853", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:17.671649Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:20.917Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "kernel/cgroup/cpuset.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "27d6dbdc6485d68075a0ebf8544d6425c1ed84bb", "status": "affected", "version": "a79a908fd2b080977b45bf103184b81c9d11ad07", "versionType": "git" }, { "lessThan": "10aeaa47e4aa2432f29b3e5376df96d7dac5537a", "status": "affected", "version": "a79a908fd2b080977b45bf103184b81c9d11ad07", "versionType": "git" }, { "lessThan": "688325078a8b5badd6e07ae22b27cd04e9947aec", "status": "affected", "version": "a79a908fd2b080977b45bf103184b81c9d11ad07", "versionType": "git" }, { "lessThan": "4e8d6ac8fc9f843e940ab7389db8136634e07989", "status": "affected", "version": "a79a908fd2b080977b45bf103184b81c9d11ad07", "versionType": "git" }, { "lessThan": "29a8d4e02fd4840028c38ceb1536cc8f82a257d4", "status": "affected", "version": "a79a908fd2b080977b45bf103184b81c9d11ad07", "versionType": "git" }, { "lessThan": "96226fbed566f3f686f53a489a29846f2d538080", "status": "affected", "version": "a79a908fd2b080977b45bf103184b81c9d11ad07", "versionType": "git" }, { "lessThan": "29ac1d238b3bf126af36037df80d7ecc4822341e", "status": "affected", "version": "a79a908fd2b080977b45bf103184b81c9d11ad07", "versionType": "git" }, { "lessThan": "1be59c97c83ccd67a519d8a49486b3a8a73ca28a", "status": "affected", "version": "a79a908fd2b080977b45bf103184b81c9d11ad07", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "kernel/cgroup/cpuset.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.6" }, { "lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.321", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Prevent UAF in proc_cpuset_show()\n\nAn UAF can happen when /proc/cpuset is read as reported in [1].\n\nThis can be reproduced by the following methods:\n1.add an mdelay(1000) before acquiring the cgroup_lock In the\n cgroup_path_ns function.\n2.$cat /proc/\u003cpid\u003e/cpuset repeatly.\n3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/\n$umount /sys/fs/cgroup/cpuset/ repeatly.\n\nThe race that cause this bug can be shown as below:\n\n(umount)\t\t|\t(cat /proc/\u003cpid\u003e/cpuset)\ncss_release\t\t|\tproc_cpuset_show\ncss_release_work_fn\t|\tcss = task_get_css(tsk, cpuset_cgrp_id);\ncss_free_rwork_fn\t|\tcgroup_path_ns(css-\u003ecgroup, ...);\ncgroup_destroy_root\t|\tmutex_lock(\u0026cgroup_mutex);\nrebind_subsystems\t|\ncgroup_free_root \t|\n\t\t\t|\t// cgrp was freed, UAF\n\t\t\t|\tcgroup_path_ns_locked(cgrp,..);\n\nWhen the cpuset is initialized, the root node top_cpuset.css.cgrp\nwill point to \u0026cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will\nallocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated\n\u0026cgroup_root.cgrp. When the umount operation is executed,\ntop_cpuset.css.cgrp will be rebound to \u0026cgrp_dfl_root.cgrp.\n\nThe problem is that when rebinding to cgrp_dfl_root, there are cases\nwhere the cgroup_root allocated by setting up the root for cgroup v1\nis cached. This could lead to a Use-After-Free (UAF) if it is\nsubsequently freed. The descendant cgroups of cgroup v1 can only be\nfreed after the css is released. However, the css of the root will never\nbe released, yet the cgroup_root should be freed when it is unmounted.\nThis means that obtaining a reference to the css of the root does\nnot guarantee that css.cgrp-\u003eroot will not be freed.\n\nFix this problem by using rcu_read_lock in proc_cpuset_show().\nAs cgroup_root is kfree_rcu after commit d23b5c577715\n(\"cgroup: Make operations on the cgroup root_list RCU safe\"),\ncss-\u003ecgroup won\u0027t be freed during the critical section.\nTo call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to\nreplace task_get_css with task_css.\n\n[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:11.037Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/27d6dbdc6485d68075a0ebf8544d6425c1ed84bb" }, { "url": "https://git.kernel.org/stable/c/10aeaa47e4aa2432f29b3e5376df96d7dac5537a" }, { "url": "https://git.kernel.org/stable/c/688325078a8b5badd6e07ae22b27cd04e9947aec" }, { "url": "https://git.kernel.org/stable/c/4e8d6ac8fc9f843e940ab7389db8136634e07989" }, { "url": "https://git.kernel.org/stable/c/29a8d4e02fd4840028c38ceb1536cc8f82a257d4" }, { "url": "https://git.kernel.org/stable/c/96226fbed566f3f686f53a489a29846f2d538080" }, { "url": "https://git.kernel.org/stable/c/29ac1d238b3bf126af36037df80d7ecc4822341e" }, { "url": "https://git.kernel.org/stable/c/1be59c97c83ccd67a519d8a49486b3a8a73ca28a" } ], "title": "cgroup/cpuset: Prevent UAF in proc_cpuset_show()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43853", "datePublished": "2024-08-17T09:22:10.534Z", "dateReserved": "2024-08-17T09:11:59.277Z", "dateUpdated": "2024-12-19T09:17:11.037Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42292
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
kobject_uevent: Fix OOB access within zap_modalias_env()
zap_modalias_env() wrongly calculates size of memory block to move, so
will cause OOB memory access issue if variable MODALIAS is not the last
one within its @env parameter, fixed by correcting size to memmove.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 9b3fa47d4a76b1d606a396455f9bbeee083ef008 Version: 9b3fa47d4a76b1d606a396455f9bbeee083ef008 Version: 9b3fa47d4a76b1d606a396455f9bbeee083ef008 Version: 9b3fa47d4a76b1d606a396455f9bbeee083ef008 Version: 9b3fa47d4a76b1d606a396455f9bbeee083ef008 Version: 9b3fa47d4a76b1d606a396455f9bbeee083ef008 Version: 9b3fa47d4a76b1d606a396455f9bbeee083ef008 Version: 9b3fa47d4a76b1d606a396455f9bbeee083ef008 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42292", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:00.545656Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:29.474Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "lib/kobject_uevent.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "81a15d28f32af01493ae8c5457e0d55314a4167d", "status": "affected", "version": "9b3fa47d4a76b1d606a396455f9bbeee083ef008", "versionType": "git" }, { "lessThan": "b59a5e86a3934f1b6a5bd1368902dbc79bdecc90", "status": "affected", "version": "9b3fa47d4a76b1d606a396455f9bbeee083ef008", "versionType": "git" }, { "lessThan": "648d5490460d38436640da0812bf7f6351c150d2", "status": "affected", "version": "9b3fa47d4a76b1d606a396455f9bbeee083ef008", "versionType": "git" }, { "lessThan": "c5ee8adc8d98a49703320d13878ba2b923b142f5", "status": "affected", "version": "9b3fa47d4a76b1d606a396455f9bbeee083ef008", "versionType": "git" }, { "lessThan": "68d63ace80b76395e7935687ecdb86421adc2168", "status": "affected", "version": "9b3fa47d4a76b1d606a396455f9bbeee083ef008", "versionType": "git" }, { "lessThan": "57fe01d3d04276875c7e3a6dc763517fc05b8762", "status": "affected", "version": "9b3fa47d4a76b1d606a396455f9bbeee083ef008", "versionType": "git" }, { "lessThan": "d4663536754defff75ff1eca0aaebc41da165a8d", "status": "affected", "version": "9b3fa47d4a76b1d606a396455f9bbeee083ef008", "versionType": "git" }, { "lessThan": "dd6e9894b451e7c85cceb8e9dc5432679a70e7dc", "status": "affected", "version": "9b3fa47d4a76b1d606a396455f9bbeee083ef008", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "lib/kobject_uevent.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.15" }, { "lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkobject_uevent: Fix OOB access within zap_modalias_env()\n\nzap_modalias_env() wrongly calculates size of memory block to move, so\nwill cause OOB memory access issue if variable MODALIAS is not the last\none within its @env parameter, fixed by correcting size to memmove." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:46.703Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/81a15d28f32af01493ae8c5457e0d55314a4167d" }, { "url": "https://git.kernel.org/stable/c/b59a5e86a3934f1b6a5bd1368902dbc79bdecc90" }, { "url": "https://git.kernel.org/stable/c/648d5490460d38436640da0812bf7f6351c150d2" }, { "url": "https://git.kernel.org/stable/c/c5ee8adc8d98a49703320d13878ba2b923b142f5" }, { "url": "https://git.kernel.org/stable/c/68d63ace80b76395e7935687ecdb86421adc2168" }, { "url": "https://git.kernel.org/stable/c/57fe01d3d04276875c7e3a6dc763517fc05b8762" }, { "url": "https://git.kernel.org/stable/c/d4663536754defff75ff1eca0aaebc41da165a8d" }, { "url": "https://git.kernel.org/stable/c/dd6e9894b451e7c85cceb8e9dc5432679a70e7dc" } ], "title": "kobject_uevent: Fix OOB access within zap_modalias_env()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42292", "datePublished": "2024-08-17T09:09:01.586Z", "dateReserved": "2024-07-30T07:40:12.268Z", "dateUpdated": "2024-12-19T09:15:46.703Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43851
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: xilinx: rename cpu_number1 to dummy_cpu_number
The per cpu variable cpu_number1 is passed to xlnx_event_handler as
argument "dev_id", but it is not used in this function. So drop the
initialization of this variable and rename it to dummy_cpu_number.
This patch is to fix the following call trace when the kernel option
CONFIG_DEBUG_ATOMIC_SLEEP is enabled:
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0
preempt_count: 1, expected: 0
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0 #53
Hardware name: Xilinx Versal vmk180 Eval board rev1.1 (QSPI) (DT)
Call trace:
dump_backtrace+0xd0/0xe0
show_stack+0x18/0x40
dump_stack_lvl+0x7c/0xa0
dump_stack+0x18/0x34
__might_resched+0x10c/0x140
__might_sleep+0x4c/0xa0
__kmem_cache_alloc_node+0xf4/0x168
kmalloc_trace+0x28/0x38
__request_percpu_irq+0x74/0x138
xlnx_event_manager_probe+0xf8/0x298
platform_probe+0x68/0xd8
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43851", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:24.012606Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:21.165Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/soc/xilinx/xlnx_event_manager.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "a5e507fadab76393cbc12344ebd65a417a09aa46", "status": "affected", "version": "01946c3c83b2279fec685abc83f0d7b0468851db", "versionType": "git" }, { "lessThan": "a96e60a6ea6818fd37b1853283a512c49af38cf5", "status": "affected", "version": "4722924e7a6225ebf7b09bd7ac5fafc6e73bd4f8", "versionType": "git" }, { "lessThan": "f762acdaff9e54688be16e6c832c73a61533c1df", "status": "affected", "version": "daed80ed07580e5adc0e6d8bc79933a35154135a", "versionType": "git" }, { "lessThan": "4a95449dd975e2ea6629a034f3e74b46c9634916", "status": "affected", "version": "daed80ed07580e5adc0e6d8bc79933a35154135a", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/soc/xilinx/xlnx_event_manager.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: xilinx: rename cpu_number1 to dummy_cpu_number\n\nThe per cpu variable cpu_number1 is passed to xlnx_event_handler as\nargument \"dev_id\", but it is not used in this function. So drop the\ninitialization of this variable and rename it to dummy_cpu_number.\nThis patch is to fix the following call trace when the kernel option\nCONFIG_DEBUG_ATOMIC_SLEEP is enabled:\n\nBUG: sleeping function called from invalid context at include/linux/sched/mm.h:274\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0\n preempt_count: 1, expected: 0\n CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0 #53\n Hardware name: Xilinx Versal vmk180 Eval board rev1.1 (QSPI) (DT)\n Call trace:\n dump_backtrace+0xd0/0xe0\n show_stack+0x18/0x40\n dump_stack_lvl+0x7c/0xa0\n dump_stack+0x18/0x34\n __might_resched+0x10c/0x140\n __might_sleep+0x4c/0xa0\n __kmem_cache_alloc_node+0xf4/0x168\n kmalloc_trace+0x28/0x38\n __request_percpu_irq+0x74/0x138\n xlnx_event_manager_probe+0xf8/0x298\n platform_probe+0x68/0xd8" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:08.752Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/a5e507fadab76393cbc12344ebd65a417a09aa46" }, { "url": "https://git.kernel.org/stable/c/a96e60a6ea6818fd37b1853283a512c49af38cf5" }, { "url": "https://git.kernel.org/stable/c/f762acdaff9e54688be16e6c832c73a61533c1df" }, { "url": "https://git.kernel.org/stable/c/4a95449dd975e2ea6629a034f3e74b46c9634916" } ], "title": "soc: xilinx: rename cpu_number1 to dummy_cpu_number", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43851", "datePublished": "2024-08-17T09:22:09.159Z", "dateReserved": "2024-08-17T09:11:59.276Z", "dateUpdated": "2024-12-19T09:17:08.752Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42283
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: nexthop: Initialize all fields in dumped nexthops
struct nexthop_grp contains two reserved fields that are not initialized by
nla_put_nh_group(), and carry garbage. This can be observed e.g. with
strace (edited for clarity):
# ip nexthop add id 1 dev lo
# ip nexthop add id 101 group 1
# strace -e recvmsg ip nexthop get id 101
...
recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},
[{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52
The fields are reserved and therefore not currently used. But as they are, they
leak kernel memory, and the fact they are not just zero complicates repurposing
of the fields for new ends. Initialize the full structure.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 430a049190de3c9e219f43084de9f1122da04570 Version: 430a049190de3c9e219f43084de9f1122da04570 Version: 430a049190de3c9e219f43084de9f1122da04570 Version: 430a049190de3c9e219f43084de9f1122da04570 Version: 430a049190de3c9e219f43084de9f1122da04570 Version: 430a049190de3c9e219f43084de9f1122da04570 Version: 430a049190de3c9e219f43084de9f1122da04570 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42283", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:29.775671Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:05.278Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/ipv4/nexthop.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "fd06cb4a5fc7bda3dea31712618a62af72a1c6cb", "status": "affected", "version": "430a049190de3c9e219f43084de9f1122da04570", "versionType": "git" }, { "lessThan": "5cc4d71dda2dd4f1520f40e634a527022e48ccd8", "status": "affected", "version": "430a049190de3c9e219f43084de9f1122da04570", "versionType": "git" }, { "lessThan": "9e8f558a3afe99ce51a642ce0d3637ddc2b5d5d0", "status": "affected", "version": "430a049190de3c9e219f43084de9f1122da04570", "versionType": "git" }, { "lessThan": "1377de719652d868f5317ba8398b7e74c5f0430b", "status": "affected", "version": "430a049190de3c9e219f43084de9f1122da04570", "versionType": "git" }, { "lessThan": "7704460acd7f5d35eb07c52500987dc9b95313fb", "status": "affected", "version": "430a049190de3c9e219f43084de9f1122da04570", "versionType": "git" }, { "lessThan": "a13d3864b76ac87085ec530b2ff8e37482a63a96", "status": "affected", "version": "430a049190de3c9e219f43084de9f1122da04570", "versionType": "git" }, { "lessThan": "6d745cd0e9720282cd291d36b9db528aea18add2", "status": "affected", "version": "430a049190de3c9e219f43084de9f1122da04570", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/ipv4/nexthop.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.3" }, { "lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: Initialize all fields in dumped nexthops\n\nstruct nexthop_grp contains two reserved fields that are not initialized by\nnla_put_nh_group(), and carry garbage. This can be observed e.g. with\nstrace (edited for clarity):\n\n # ip nexthop add id 1 dev lo\n # ip nexthop add id 101 group 1\n # strace -e recvmsg ip nexthop get id 101\n ...\n recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},\n [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52\n\nThe fields are reserved and therefore not currently used. But as they are, they\nleak kernel memory, and the fact they are not just zero complicates repurposing\nof the fields for new ends. Initialize the full structure." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:36.064Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/fd06cb4a5fc7bda3dea31712618a62af72a1c6cb" }, { "url": "https://git.kernel.org/stable/c/5cc4d71dda2dd4f1520f40e634a527022e48ccd8" }, { "url": "https://git.kernel.org/stable/c/9e8f558a3afe99ce51a642ce0d3637ddc2b5d5d0" }, { "url": "https://git.kernel.org/stable/c/1377de719652d868f5317ba8398b7e74c5f0430b" }, { "url": "https://git.kernel.org/stable/c/7704460acd7f5d35eb07c52500987dc9b95313fb" }, { "url": "https://git.kernel.org/stable/c/a13d3864b76ac87085ec530b2ff8e37482a63a96" }, { "url": "https://git.kernel.org/stable/c/6d745cd0e9720282cd291d36b9db528aea18add2" } ], "title": "net: nexthop: Initialize all fields in dumped nexthops", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42283", "datePublished": "2024-08-17T09:08:49.866Z", "dateReserved": "2024-07-30T07:40:12.262Z", "dateUpdated": "2024-12-19T09:15:36.064Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42291
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: Add a per-VF limit on number of FDIR filters
While the iavf driver adds a s/w limit (128) on the number of FDIR
filters that the VF can request, a malicious VF driver can request more
than that and exhaust the resources for other VFs.
Add a similar limit in ice.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1f7ea1cd6a3748427512ccc9582e18cd9efea966 Version: 1f7ea1cd6a3748427512ccc9582e18cd9efea966 Version: 1f7ea1cd6a3748427512ccc9582e18cd9efea966 Version: 1f7ea1cd6a3748427512ccc9582e18cd9efea966 Version: 1f7ea1cd6a3748427512ccc9582e18cd9efea966 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42291", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:03.788403Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:29.655Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c", "drivers/net/ethernet/intel/ice/ice_fdir.h", "drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c", "drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e81b674ead8e2172b2a69e7b45e079239ace4dbc", "status": "affected", "version": "1f7ea1cd6a3748427512ccc9582e18cd9efea966", "versionType": "git" }, { "lessThan": "8e02cd98a6e24389d476e28436d41e620ed8e559", "status": "affected", "version": "1f7ea1cd6a3748427512ccc9582e18cd9efea966", "versionType": "git" }, { "lessThan": "d62389073a5b937413e2d1bc1da06ccff5103c0c", "status": "affected", "version": "1f7ea1cd6a3748427512ccc9582e18cd9efea966", "versionType": "git" }, { "lessThan": "292081c4e7f575a79017d5cbe1a0ec042783976f", "status": "affected", "version": "1f7ea1cd6a3748427512ccc9582e18cd9efea966", "versionType": "git" }, { "lessThan": "6ebbe97a488179f5dc85f2f1e0c89b486e99ee97", "status": "affected", "version": "1f7ea1cd6a3748427512ccc9582e18cd9efea966", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c", "drivers/net/ethernet/intel/ice/ice_fdir.h", "drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c", "drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.13" }, { "lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.172", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Add a per-VF limit on number of FDIR filters\n\nWhile the iavf driver adds a s/w limit (128) on the number of FDIR\nfilters that the VF can request, a malicious VF driver can request more\nthan that and exhaust the resources for other VFs.\n\nAdd a similar limit in ice." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:45.506Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e81b674ead8e2172b2a69e7b45e079239ace4dbc" }, { "url": "https://git.kernel.org/stable/c/8e02cd98a6e24389d476e28436d41e620ed8e559" }, { "url": "https://git.kernel.org/stable/c/d62389073a5b937413e2d1bc1da06ccff5103c0c" }, { "url": "https://git.kernel.org/stable/c/292081c4e7f575a79017d5cbe1a0ec042783976f" }, { "url": "https://git.kernel.org/stable/c/6ebbe97a488179f5dc85f2f1e0c89b486e99ee97" } ], "title": "ice: Add a per-VF limit on number of FDIR filters", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42291", "datePublished": "2024-08-17T09:09:00.944Z", "dateReserved": "2024-07-30T07:40:12.268Z", "dateUpdated": "2024-12-19T09:15:45.506Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43826
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfs: pass explicit offset/count to trace events
nfs_folio_length is unsafe to use without having the folio locked and a
check for a NULL ->f_mapping that protects against truncations and can
lead to kernel crashes. E.g. when running xfstests generic/065 with
all nfs trace points enabled.
Follow the model of the XFS trace points and pass in an explіcit offset
and length. This has the additional benefit that these values can
be more accurate as some of the users touch partial folio ranges.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43826", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:44.823847Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:24.297Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/nfs/file.c", "fs/nfs/nfstrace.h", "fs/nfs/read.c", "fs/nfs/write.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "387e6e9d110250946df4d4ebef9c2def5c7a4722", "status": "affected", "version": "eb5654b3b89d5e836312cea9f3fdb49457852e89", "versionType": "git" }, { "lessThan": "fada32ed6dbc748f447c8d050a961b75d946055a", "status": "affected", "version": "eb5654b3b89d5e836312cea9f3fdb49457852e89", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/nfs/file.c", "fs/nfs/nfstrace.h", "fs/nfs/read.c", "fs/nfs/write.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: pass explicit offset/count to trace events\n\nnfs_folio_length is unsafe to use without having the folio locked and a\ncheck for a NULL -\u003ef_mapping that protects against truncations and can\nlead to kernel crashes. E.g. when running xfstests generic/065 with\nall nfs trace points enabled.\n\nFollow the model of the XFS trace points and pass in an expl\u0456cit offset\nand length. This has the additional benefit that these values can\nbe more accurate as some of the users touch partial folio ranges." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:37.705Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/387e6e9d110250946df4d4ebef9c2def5c7a4722" }, { "url": "https://git.kernel.org/stable/c/fada32ed6dbc748f447c8d050a961b75d946055a" } ], "title": "nfs: pass explicit offset/count to trace events", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43826", "datePublished": "2024-08-17T09:21:45.988Z", "dateReserved": "2024-08-17T09:11:59.272Z", "dateUpdated": "2024-12-19T09:16:37.705Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42321
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
The following splat is easy to reproduce upstream as well as in -stable
kernels. Florian Westphal provided the following commit:
d1dab4f71d37 ("net: add and use __skb_get_hash_symmetric_net")
but this complementary fix has been also suggested by Willem de Bruijn
and it can be easily backported to -stable kernel which consists in
using DEBUG_NET_WARN_ON_ONCE instead to silence the following splat
given __skb_get_hash() is used by the nftables tracing infrastructure to
to identify packets in traces.
[69133.561393] ------------[ cut here ]------------
[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/
[...]
[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379
[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0
[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff
ff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff <0f> 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8
[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246
[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19
[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418
[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000
[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400
[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28
[69133.562020] FS: 00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000
[69133.562027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0
[69133.562040] Call Trace:
[69133.562044] <IRQ>
[69133.562049] ? __warn+0x9f/0x1a0
[ 1211.841384] ? __skb_flow_dissect+0x107e/0x2860
[...]
[ 1211.841496] ? bpf_flow_dissect+0x160/0x160
[ 1211.841753] __skb_get_hash+0x97/0x280
[ 1211.841765] ? __skb_get_hash_symmetric+0x230/0x230
[ 1211.841776] ? mod_find+0xbf/0xe0
[ 1211.841786] ? get_stack_info_noinstr+0x12/0xe0
[ 1211.841798] ? bpf_ksym_find+0x56/0xe0
[ 1211.841807] ? __rcu_read_unlock+0x2a/0x70
[ 1211.841819] nft_trace_init+0x1b9/0x1c0 [nf_tables]
[ 1211.841895] ? nft_trace_notify+0x830/0x830 [nf_tables]
[ 1211.841964] ? get_stack_info+0x2b/0x80
[ 1211.841975] ? nft_do_chain_arp+0x80/0x80 [nf_tables]
[ 1211.842044] nft_do_chain+0x79c/0x850 [nf_tables]
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42321", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:25.850374Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:25.817Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/core/flow_dissector.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "eb03d9826aa646577342a952d658d4598381c035", "status": "affected", "version": "9b52e3f267a6835efd50ed9002d530666d16a411", "versionType": "git" }, { "lessThan": "4afbac11f2f629d1e62817c4e210bdfaa7521107", "status": "affected", "version": "9b52e3f267a6835efd50ed9002d530666d16a411", "versionType": "git" }, { "lessThan": "c5d21aabf1b31a79f228508af33aee83456bc1b0", "status": "affected", "version": "9b52e3f267a6835efd50ed9002d530666d16a411", "versionType": "git" }, { "lessThan": "120f1c857a73e52132e473dee89b340440cb692b", "status": "affected", "version": "9b52e3f267a6835efd50ed9002d530666d16a411", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/core/flow_dissector.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.2" }, { "lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: flow_dissector: use DEBUG_NET_WARN_ON_ONCE\n\nThe following splat is easy to reproduce upstream as well as in -stable\nkernels. Florian Westphal provided the following commit:\n\n d1dab4f71d37 (\"net: add and use __skb_get_hash_symmetric_net\")\n\nbut this complementary fix has been also suggested by Willem de Bruijn\nand it can be easily backported to -stable kernel which consists in\nusing DEBUG_NET_WARN_ON_ONCE instead to silence the following splat\ngiven __skb_get_hash() is used by the nftables tracing infrastructure to\nto identify packets in traces.\n\n[69133.561393] ------------[ cut here ]------------\n[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/\n[...]\n[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379\n[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0\n[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff\nff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff \u003c0f\u003e 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8\n[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246\n[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19\n[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418\n[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000\n[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400\n[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28\n[69133.562020] FS: 00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\n[69133.562027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0\n[69133.562040] Call Trace:\n[69133.562044] \u003cIRQ\u003e\n[69133.562049] ? __warn+0x9f/0x1a0\n[ 1211.841384] ? __skb_flow_dissect+0x107e/0x2860\n[...]\n[ 1211.841496] ? bpf_flow_dissect+0x160/0x160\n[ 1211.841753] __skb_get_hash+0x97/0x280\n[ 1211.841765] ? __skb_get_hash_symmetric+0x230/0x230\n[ 1211.841776] ? mod_find+0xbf/0xe0\n[ 1211.841786] ? get_stack_info_noinstr+0x12/0xe0\n[ 1211.841798] ? bpf_ksym_find+0x56/0xe0\n[ 1211.841807] ? __rcu_read_unlock+0x2a/0x70\n[ 1211.841819] nft_trace_init+0x1b9/0x1c0 [nf_tables]\n[ 1211.841895] ? nft_trace_notify+0x830/0x830 [nf_tables]\n[ 1211.841964] ? get_stack_info+0x2b/0x80\n[ 1211.841975] ? nft_do_chain_arp+0x80/0x80 [nf_tables]\n[ 1211.842044] nft_do_chain+0x79c/0x850 [nf_tables]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:21.376Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/eb03d9826aa646577342a952d658d4598381c035" }, { "url": "https://git.kernel.org/stable/c/4afbac11f2f629d1e62817c4e210bdfaa7521107" }, { "url": "https://git.kernel.org/stable/c/c5d21aabf1b31a79f228508af33aee83456bc1b0" }, { "url": "https://git.kernel.org/stable/c/120f1c857a73e52132e473dee89b340440cb692b" } ], "title": "net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42321", "datePublished": "2024-08-17T09:09:33.505Z", "dateReserved": "2024-07-30T07:40:12.279Z", "dateUpdated": "2024-12-19T09:16:21.376Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43847
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix invalid memory access while processing fragmented packets
The monitor ring and the reo reinject ring share the same ring mask index.
When the driver receives an interrupt for the reo reinject ring, the
monitor ring is also processed, leading to invalid memory access. Since
monitor support is not yet enabled in ath12k, the ring mask for the monitor
ring should be removed.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43847", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:36.782917Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:21.718Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/wireless/ath/ath12k/hw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "8126f82dab7bd8b2e04799342b19fff0a1fd8575", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git" }, { "lessThan": "36fc66a7d9ca3e5c6eac25362cac63f83df8bed6", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git" }, { "lessThan": "073f9f249eecd64ab9d59c91c4a23cfdcc02afe4", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/wireless/ath/ath12k/hw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix invalid memory access while processing fragmented packets\n\nThe monitor ring and the reo reinject ring share the same ring mask index.\nWhen the driver receives an interrupt for the reo reinject ring, the\nmonitor ring is also processed, leading to invalid memory access. Since\nmonitor support is not yet enabled in ath12k, the ring mask for the monitor\nring should be removed.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:04.116Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/8126f82dab7bd8b2e04799342b19fff0a1fd8575" }, { "url": "https://git.kernel.org/stable/c/36fc66a7d9ca3e5c6eac25362cac63f83df8bed6" }, { "url": "https://git.kernel.org/stable/c/073f9f249eecd64ab9d59c91c4a23cfdcc02afe4" } ], "title": "wifi: ath12k: fix invalid memory access while processing fragmented packets", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43847", "datePublished": "2024-08-17T09:22:01.238Z", "dateReserved": "2024-08-17T09:11:59.275Z", "dateUpdated": "2024-12-19T09:17:04.116Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42308
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ "containers": { "cna": { "providerMetadata": { "dateUpdated": "2024-10-09T13:57:37.908Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "rejectedReasons": [ { "lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority." } ] } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42308", "datePublished": "2024-08-17T09:09:13.467Z", "dateRejected": "2024-10-09T13:57:37.908Z", "dateReserved": "2024-07-30T07:40:12.275Z", "dateUpdated": "2024-10-09T13:57:37.908Z", "state": "REJECTED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42307
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path
Dan Carpenter reported a Smack static checker warning:
fs/smb/client/cifsfs.c:1981 init_cifs()
error: we previously assumed 'serverclose_wq' could be null (see line 1895)
The patch which introduced the serverclose workqueue used the wrong
oredering in error paths in init_cifs() for freeing it on errors.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42307", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:12.002656Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:27.701Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/smb/client/cifsfs.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6018971710fdc7739f8655c1540832b4bb903671", "status": "affected", "version": "8c99dfb49bdc17edffc7ff3d46b400c8c291686c", "versionType": "git" }, { "lessThan": "160235efb4f9b55212dedff5de0094c606c4b303", "status": "affected", "version": "6f17163b9339fac92023a1d9bef22128db3b9a4b", "versionType": "git" }, { "lessThan": "3739d711246d8fbc95ff73dbdace9741cdce4777", "status": "affected", "version": "173217bd73365867378b5e75a86f0049e1069ee8", "versionType": "git" }, { "lessThan": "193cc89ea0ca1da311877d2b4bb5e9f03bcc82a2", "status": "affected", "version": "173217bd73365867378b5e75a86f0049e1069ee8", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/smb/client/cifsfs.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.9" }, { "lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix potential null pointer use in destroy_workqueue in init_cifs error path\n\nDan Carpenter reported a Smack static checker warning:\n fs/smb/client/cifsfs.c:1981 init_cifs()\n error: we previously assumed \u0027serverclose_wq\u0027 could be null (see line 1895)\n\nThe patch which introduced the serverclose workqueue used the wrong\noredering in error paths in init_cifs() for freeing it on errors." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:05.598Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/6018971710fdc7739f8655c1540832b4bb903671" }, { "url": "https://git.kernel.org/stable/c/160235efb4f9b55212dedff5de0094c606c4b303" }, { "url": "https://git.kernel.org/stable/c/3739d711246d8fbc95ff73dbdace9741cdce4777" }, { "url": "https://git.kernel.org/stable/c/193cc89ea0ca1da311877d2b4bb5e9f03bcc82a2" } ], "title": "cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42307", "datePublished": "2024-08-17T09:09:12.613Z", "dateReserved": "2024-07-30T07:40:12.273Z", "dateUpdated": "2024-12-19T09:16:05.598Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42282
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling
Move the freeing of the dummy net_device from mtk_free_dev() to
mtk_remove().
Previously, if alloc_netdev_dummy() failed in mtk_probe(),
eth->dummy_dev would be NULL. The error path would then call
mtk_free_dev(), which in turn called free_netdev() assuming dummy_dev
was allocated (but it was not), potentially causing a NULL pointer
dereference.
By moving free_netdev() to mtk_remove(), we ensure it's only called when
mtk_probe() has succeeded and dummy_dev is fully allocated. This
addresses a potential NULL pointer dereference detected by Smatch[1].
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42282", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:33.179796Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:30.775Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mediatek/mtk_eth_soc.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "af6bd5c9901b13a26eaf4d57d97a813297791596", "status": "affected", "version": "b209bd6d0bffb8991aba568e2d9a892c86a1a43c", "versionType": "git" }, { "lessThan": "16f3a28cf5f876a7f3550d8f4c870a7b41bcfaef", "status": "affected", "version": "b209bd6d0bffb8991aba568e2d9a892c86a1a43c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mediatek/mtk_eth_soc.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mediatek: Fix potential NULL pointer dereference in dummy net_device handling\n\nMove the freeing of the dummy net_device from mtk_free_dev() to\nmtk_remove().\n\nPreviously, if alloc_netdev_dummy() failed in mtk_probe(),\neth-\u003edummy_dev would be NULL. The error path would then call\nmtk_free_dev(), which in turn called free_netdev() assuming dummy_dev\nwas allocated (but it was not), potentially causing a NULL pointer\ndereference.\n\nBy moving free_netdev() to mtk_remove(), we ensure it\u0027s only called when\nmtk_probe() has succeeded and dummy_dev is fully allocated. This\naddresses a potential NULL pointer dereference detected by Smatch[1]." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:34.934Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/af6bd5c9901b13a26eaf4d57d97a813297791596" }, { "url": "https://git.kernel.org/stable/c/16f3a28cf5f876a7f3550d8f4c870a7b41bcfaef" } ], "title": "net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42282", "datePublished": "2024-08-17T09:08:49.145Z", "dateReserved": "2024-07-30T07:40:12.262Z", "dateUpdated": "2024-12-19T09:15:34.934Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42311
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
Syzbot reports uninitialized value access issue as below:
loop0: detected capacity change from 0 to 64
=====================================================
BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30
hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30
d_revalidate fs/namei.c:862 [inline]
lookup_fast+0x89e/0x8e0 fs/namei.c:1649
walk_component fs/namei.c:2001 [inline]
link_path_walk+0x817/0x1480 fs/namei.c:2332
path_lookupat+0xd9/0x6f0 fs/namei.c:2485
filename_lookup+0x22e/0x740 fs/namei.c:2515
user_path_at_empty+0x8b/0x390 fs/namei.c:2924
user_path_at include/linux/namei.h:57 [inline]
do_mount fs/namespace.c:3689 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x66b/0x810 fs/namespace.c:3875
__x64_sys_mount+0xe4/0x140 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline]
BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366
hfs_ext_read_extent fs/hfs/extent.c:196 [inline]
hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366
block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271
hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39
filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426
do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553
do_read_cache_page mm/filemap.c:3595 [inline]
read_cache_page+0xfb/0x2f0 mm/filemap.c:3604
read_mapping_page include/linux/pagemap.h:755 [inline]
hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78
hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204
hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406
mount_bdev+0x628/0x920 fs/super.c:1359
hfs_mount+0xcd/0xe0 fs/hfs/super.c:456
legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610
vfs_get_tree+0xdc/0x5d0 fs/super.c:1489
do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145
path_mount+0xf98/0x26a0 fs/namespace.c:3475
do_mount fs/namespace.c:3488 [inline]
__do_sys_mount fs/namespace.c:3697 [inline]
__se_sys_mount+0x919/0x9e0 fs/namespace.c:3674
__ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
__alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2190 [inline]
allocate_slab mm/slub.c:2354 [inline]
new_slab+0x2d7/0x1400 mm/slub.c:2407
___slab_alloc+0x16b5/0x3970 mm/slub.c:3540
__slab_alloc mm/slub.c:3625 [inline]
__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879
alloc_inode_sb include/linux/fs.h:3018 [inline]
hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165
alloc_inode+0x83/0x440 fs/inode.c:260
new_inode_pseudo fs/inode.c:1005 [inline]
new_inode+0x38/0x4f0 fs/inode.c:1031
hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186
hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228
vfs_mkdir+0x49a/0x700 fs/namei.c:4126
do_mkdirat+0x529/0x810 fs/namei.c:4149
__do_sys_mkdirat fs/namei.c:4164 [inline]
__se_sys_mkdirat fs/namei.c:4162 [inline]
__x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
It missed to initialize .tz_secondswest, .cached_start and .cached_blocks
fields in struct hfs_inode_info after hfs_alloc_inode(), fix it.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42311", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:58.669472Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:27.119Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/hfs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "f7316b2b2f11cf0c6de917beee8d3de728be24db", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "4a52861cd76e79f1a593beb23d096523eb9732c2", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "10f7163bfb5f8b4e0c9c05a939f20b8540e33c65", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "d55aae5c1730d6b70d5d8eaff00113cd34772ea3", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "58d83fc160505a7009c39dec64effaac5129b971", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "9c4e40b9b731220f9464975e49da75496e3865c4", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "d3493d6f0dfb1ab5225b62faa77732983f2187a1", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "26a2ed107929a855155429b11e1293b83e6b2a8b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/hfs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()\n\nSyzbot reports uninitialized value access issue as below:\n\nloop0: detected capacity change from 0 to 64\n=====================================================\nBUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30\n hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30\n d_revalidate fs/namei.c:862 [inline]\n lookup_fast+0x89e/0x8e0 fs/namei.c:1649\n walk_component fs/namei.c:2001 [inline]\n link_path_walk+0x817/0x1480 fs/namei.c:2332\n path_lookupat+0xd9/0x6f0 fs/namei.c:2485\n filename_lookup+0x22e/0x740 fs/namei.c:2515\n user_path_at_empty+0x8b/0x390 fs/namei.c:2924\n user_path_at include/linux/namei.h:57 [inline]\n do_mount fs/namespace.c:3689 [inline]\n __do_sys_mount fs/namespace.c:3898 [inline]\n __se_sys_mount+0x66b/0x810 fs/namespace.c:3875\n __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nBUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline]\nBUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366\n hfs_ext_read_extent fs/hfs/extent.c:196 [inline]\n hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366\n block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271\n hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39\n filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426\n do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553\n do_read_cache_page mm/filemap.c:3595 [inline]\n read_cache_page+0xfb/0x2f0 mm/filemap.c:3604\n read_mapping_page include/linux/pagemap.h:755 [inline]\n hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78\n hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204\n hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406\n mount_bdev+0x628/0x920 fs/super.c:1359\n hfs_mount+0xcd/0xe0 fs/hfs/super.c:456\n legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610\n vfs_get_tree+0xdc/0x5d0 fs/super.c:1489\n do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145\n path_mount+0xf98/0x26a0 fs/namespace.c:3475\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674\n __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674\n do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\nUninit was created at:\n __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590\n __alloc_pages_node include/linux/gfp.h:238 [inline]\n alloc_pages_node include/linux/gfp.h:261 [inline]\n alloc_slab_page mm/slub.c:2190 [inline]\n allocate_slab mm/slub.c:2354 [inline]\n new_slab+0x2d7/0x1400 mm/slub.c:2407\n ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540\n __slab_alloc mm/slub.c:3625 [inline]\n __slab_alloc_node mm/slub.c:3678 [inline]\n slab_alloc_node mm/slub.c:3850 [inline]\n kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879\n alloc_inode_sb include/linux/fs.h:3018 [inline]\n hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165\n alloc_inode+0x83/0x440 fs/inode.c:260\n new_inode_pseudo fs/inode.c:1005 [inline]\n new_inode+0x38/0x4f0 fs/inode.c:1031\n hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186\n hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228\n vfs_mkdir+0x49a/0x700 fs/namei.c:4126\n do_mkdirat+0x529/0x810 fs/namei.c:4149\n __do_sys_mkdirat fs/namei.c:4164 [inline]\n __se_sys_mkdirat fs/namei.c:4162 [inline]\n __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nIt missed to initialize .tz_secondswest, .cached_start and .cached_blocks\nfields in struct hfs_inode_info after hfs_alloc_inode(), fix it." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:09.323Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/f7316b2b2f11cf0c6de917beee8d3de728be24db" }, { "url": "https://git.kernel.org/stable/c/4a52861cd76e79f1a593beb23d096523eb9732c2" }, { "url": "https://git.kernel.org/stable/c/10f7163bfb5f8b4e0c9c05a939f20b8540e33c65" }, { "url": "https://git.kernel.org/stable/c/d55aae5c1730d6b70d5d8eaff00113cd34772ea3" }, { "url": "https://git.kernel.org/stable/c/58d83fc160505a7009c39dec64effaac5129b971" }, { "url": "https://git.kernel.org/stable/c/9c4e40b9b731220f9464975e49da75496e3865c4" }, { "url": "https://git.kernel.org/stable/c/d3493d6f0dfb1ab5225b62faa77732983f2187a1" }, { "url": "https://git.kernel.org/stable/c/26a2ed107929a855155429b11e1293b83e6b2a8b" } ], "title": "hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42311", "datePublished": "2024-08-17T09:09:15.793Z", "dateReserved": "2024-07-30T07:40:12.277Z", "dateUpdated": "2024-12-19T09:16:09.323Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42287
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Complete command early within lock
A crash was observed while performing NPIV and FW reset,
BUG: kernel NULL pointer dereference, address: 000000000000001c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 1 PREEMPT_RT SMP NOPTI
RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0
RSP: 0018:ffffc90026f47b88 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000002
RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8881041130d0
RBP: ffff8881041130d0 R08: 0000000000000000 R09: 0000000000000034
R10: ffffc90026f47c48 R11: 0000000000000031 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8881565e4a20 R15: 0000000000000000
FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000001c CR3: 0000000288a50002 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
? __die_body+0x1a/0x60
? page_fault_oops+0x16f/0x4a0
? do_user_addr_fault+0x174/0x7f0
? exc_page_fault+0x69/0x1a0
? asm_exc_page_fault+0x22/0x30
? dma_direct_unmap_sg+0x51/0x1e0
? preempt_count_sub+0x96/0xe0
qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx]
qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx]
__qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx]
The command completion was done early while aborting the commands in driver
unload path but outside lock to avoid the WARN_ON condition of performing
dma_free_attr within the lock. However this caused race condition while
command completion via multiple paths causing system crash.
Hence complete the command early in unload path but within the lock to
avoid race condition.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 9189f20b4c5307c0998682bb522e481b4567a8b8 Version: 231cfa78ec5badd84a1a2b09465bfad1a926aba1 Version: d6f7377528d2abf338e504126e44439541be8f7d Version: cd0a1804ac5bab2545ac700c8d0fe9ae9284c567 Version: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 Version: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 Version: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42287", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:16.790105Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:30.183Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/scsi/qla2xxx/qla_os.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "af46649304b0c9cede4ccfc2be2561ce8ed6a2ea", "status": "affected", "version": "9189f20b4c5307c0998682bb522e481b4567a8b8", "versionType": "git" }, { "lessThan": "57ba7563712227647f82a92547e82c96cd350553", "status": "affected", "version": "231cfa78ec5badd84a1a2b09465bfad1a926aba1", "versionType": "git" }, { "lessThan": "9117337b04d789bd08fdd9854a40bec2815cd3f6", "status": "affected", "version": "d6f7377528d2abf338e504126e44439541be8f7d", "versionType": "git" }, { "lessThan": "814f4a53cc86f7ea8b501bfb1723f24fd29ef5ee", "status": "affected", "version": "cd0a1804ac5bab2545ac700c8d0fe9ae9284c567", "versionType": "git" }, { "lessThan": "314efe3f87949a568f512f05df20bf47b81cf232", "status": "affected", "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9", "versionType": "git" }, { "lessThan": "36fdc5319c4d0ec8b8938ec4769764098a246bfb", "status": "affected", "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9", "versionType": "git" }, { "lessThan": "4475afa2646d3fec176fc4d011d3879b26cb26e3", "status": "affected", "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/scsi/qla2xxx/qla_os.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Complete command early within lock\n\nA crash was observed while performing NPIV and FW reset,\n\n BUG: kernel NULL pointer dereference, address: 000000000000001c\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 1 PREEMPT_RT SMP NOPTI\n RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0\n RSP: 0018:ffffc90026f47b88 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000002\n RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8881041130d0\n RBP: ffff8881041130d0 R08: 0000000000000000 R09: 0000000000000034\n R10: ffffc90026f47c48 R11: 0000000000000031 R12: 0000000000000000\n R13: 0000000000000000 R14: ffff8881565e4a20 R15: 0000000000000000\n FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000000000001c CR3: 0000000288a50002 CR4: 00000000007706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n \u003cTASK\u003e\n ? __die_body+0x1a/0x60\n ? page_fault_oops+0x16f/0x4a0\n ? do_user_addr_fault+0x174/0x7f0\n ? exc_page_fault+0x69/0x1a0\n ? asm_exc_page_fault+0x22/0x30\n ? dma_direct_unmap_sg+0x51/0x1e0\n ? preempt_count_sub+0x96/0xe0\n qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx]\n qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx]\n __qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx]\n\nThe command completion was done early while aborting the commands in driver\nunload path but outside lock to avoid the WARN_ON condition of performing\ndma_free_attr within the lock. However this caused race condition while\ncommand completion via multiple paths causing system crash.\n\nHence complete the command early in unload path but within the lock to\navoid race condition." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:40.707Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/af46649304b0c9cede4ccfc2be2561ce8ed6a2ea" }, { "url": "https://git.kernel.org/stable/c/57ba7563712227647f82a92547e82c96cd350553" }, { "url": "https://git.kernel.org/stable/c/9117337b04d789bd08fdd9854a40bec2815cd3f6" }, { "url": "https://git.kernel.org/stable/c/814f4a53cc86f7ea8b501bfb1723f24fd29ef5ee" }, { "url": "https://git.kernel.org/stable/c/314efe3f87949a568f512f05df20bf47b81cf232" }, { "url": "https://git.kernel.org/stable/c/36fdc5319c4d0ec8b8938ec4769764098a246bfb" }, { "url": "https://git.kernel.org/stable/c/4475afa2646d3fec176fc4d011d3879b26cb26e3" } ], "title": "scsi: qla2xxx: Complete command early within lock", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42287", "datePublished": "2024-08-17T09:08:52.762Z", "dateReserved": "2024-07-30T07:40:12.262Z", "dateUpdated": "2024-12-19T09:15:40.707Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42298
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
devm_kasprintf() can return a NULL pointer on failure but this returned
value is not checked.
Fix this lack and check the returned value.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42298", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:41.543942Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:28.675Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "sound/soc/fsl/fsl_qmc_audio.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b4205dfcfe96182118e54343954827eda51b2135", "status": "affected", "version": "075c7125b11c72e7933401d73000d6d151196072", "versionType": "git" }, { "lessThan": "af466037fa2b263e8ea5c47285513d2487e17d90", "status": "affected", "version": "075c7125b11c72e7933401d73000d6d151196072", "versionType": "git" }, { "lessThan": "e62599902327d27687693f6e5253a5d56583db58", "status": "affected", "version": "075c7125b11c72e7933401d73000d6d151196072", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "sound/soc/fsl/fsl_qmc_audio.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.4" }, { "lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value\n\ndevm_kasprintf() can return a NULL pointer on failure but this returned\nvalue is not checked.\n\nFix this lack and check the returned value." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:53.893Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b4205dfcfe96182118e54343954827eda51b2135" }, { "url": "https://git.kernel.org/stable/c/af466037fa2b263e8ea5c47285513d2487e17d90" }, { "url": "https://git.kernel.org/stable/c/e62599902327d27687693f6e5253a5d56583db58" } ], "title": "ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42298", "datePublished": "2024-08-17T09:09:05.866Z", "dateReserved": "2024-07-30T07:40:12.270Z", "dateUpdated": "2024-12-19T09:15:53.893Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43821
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix a possible null pointer dereference
In function lpfc_xcvr_data_show, the memory allocation with kmalloc might
fail, thereby making rdp_context a null pointer. In the following context
and functions that use this pointer, there are dereferencing operations,
leading to null pointer dereference.
To fix this issue, a null pointer check should be added. If it is null,
use scnprintf to notify the user and return len.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43821", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:00.684466Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:24.948Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/scsi/lpfc/lpfc_attr.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "57600a7dd2b52c904f7c8d2cac0fd8c23868e680", "status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "versionType": "git" }, { "lessThan": "45b2a23e00d448a9e6d1f371ca3a4d4b073fe78c", "status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "versionType": "git" }, { "lessThan": "5e0bf3e8aec2cbc51123f84b29aaacbd91fc56fa", "status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/scsi/lpfc/lpfc_attr.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.2" }, { "lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix a possible null pointer dereference\n\nIn function lpfc_xcvr_data_show, the memory allocation with kmalloc might\nfail, thereby making rdp_context a null pointer. In the following context\nand functions that use this pointer, there are dereferencing operations,\nleading to null pointer dereference.\n\nTo fix this issue, a null pointer check should be added. If it is null,\nuse scnprintf to notify the user and return len." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:31.824Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/57600a7dd2b52c904f7c8d2cac0fd8c23868e680" }, { "url": "https://git.kernel.org/stable/c/45b2a23e00d448a9e6d1f371ca3a4d4b073fe78c" }, { "url": "https://git.kernel.org/stable/c/5e0bf3e8aec2cbc51123f84b29aaacbd91fc56fa" } ], "title": "scsi: lpfc: Fix a possible null pointer dereference", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43821", "datePublished": "2024-08-17T09:21:42.343Z", "dateReserved": "2024-08-17T09:11:59.271Z", "dateUpdated": "2024-12-19T09:16:31.824Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43828
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix infinite loop when replaying fast_commit
When doing fast_commit replay an infinite loop may occur due to an
uninitialized extent_status struct. ext4_ext_determine_insert_hole() does
not detect the replay and calls ext4_es_find_extent_range(), which will
return immediately without initializing the 'es' variable.
Because 'es' contains garbage, an integer overflow may happen causing an
infinite loop in this function, easily reproducible using fstest generic/039.
This commit fixes this issue by unconditionally initializing the structure
in function ext4_es_find_extent_range().
Thanks to Zhang Yi, for figuring out the real problem!
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 Version: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 Version: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 Version: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 Version: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 Version: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43828", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:37.888244Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:24.045Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/ext4/extents_status.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "5ed0496e383cb6de120e56991385dce70bbb87c1", "status": "affected", "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2", "versionType": "git" }, { "lessThan": "0619f7750f2b178a1309808832ab20d85e0ad121", "status": "affected", "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2", "versionType": "git" }, { "lessThan": "181e63cd595c688194e07332f9944b3a63193de2", "status": "affected", "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2", "versionType": "git" }, { "lessThan": "c6e67df64783e99a657ef2b8c834ba2bf54c539c", "status": "affected", "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2", "versionType": "git" }, { "lessThan": "81f819c537d29932e4b9267f02411cbc8b355178", "status": "affected", "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2", "versionType": "git" }, { "lessThan": "907c3fe532253a6ef4eb9c4d67efb71fab58c706", "status": "affected", "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/ext4/extents_status.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.10" }, { "lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix infinite loop when replaying fast_commit\n\nWhen doing fast_commit replay an infinite loop may occur due to an\nuninitialized extent_status struct. ext4_ext_determine_insert_hole() does\nnot detect the replay and calls ext4_es_find_extent_range(), which will\nreturn immediately without initializing the \u0027es\u0027 variable.\n\nBecause \u0027es\u0027 contains garbage, an integer overflow may happen causing an\ninfinite loop in this function, easily reproducible using fstest generic/039.\n\nThis commit fixes this issue by unconditionally initializing the structure\nin function ext4_es_find_extent_range().\n\nThanks to Zhang Yi, for figuring out the real problem!" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:40.022Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/5ed0496e383cb6de120e56991385dce70bbb87c1" }, { "url": "https://git.kernel.org/stable/c/0619f7750f2b178a1309808832ab20d85e0ad121" }, { "url": "https://git.kernel.org/stable/c/181e63cd595c688194e07332f9944b3a63193de2" }, { "url": "https://git.kernel.org/stable/c/c6e67df64783e99a657ef2b8c834ba2bf54c539c" }, { "url": "https://git.kernel.org/stable/c/81f819c537d29932e4b9267f02411cbc8b355178" }, { "url": "https://git.kernel.org/stable/c/907c3fe532253a6ef4eb9c4d67efb71fab58c706" } ], "title": "ext4: fix infinite loop when replaying fast_commit", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43828", "datePublished": "2024-08-17T09:21:47.429Z", "dateReserved": "2024-08-17T09:11:59.273Z", "dateUpdated": "2024-12-19T09:16:40.022Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43843
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
We get the size of the trampoline image during the dry run phase and
allocate memory based on that size. The allocated image will then be
populated with instructions during the real patch phase. But after
commit 26ef208c209a ("bpf: Use arch_bpf_trampoline_size"), the `im`
argument is inconsistent in the dry run and real patch phase. This may
cause emit_imm in RV64 to generate a different number of instructions
when generating the 'im' address, potentially causing out-of-bounds
issues. Let's emit the maximum number of instructions for the "im"
address during dry run to fix this problem.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43843", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:49.338774Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:22.288Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/riscv/net/bpf_jit_comp64.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "3e6a1b1b179abb643ec3560c02bc3082bc92285f", "status": "affected", "version": "26ef208c209a0e6eed8942a5d191b39dccfa6e38", "versionType": "git" }, { "lessThan": "9f1e16fb1fc9826001c69e0551d51fbbcd2d74e9", "status": "affected", "version": "26ef208c209a0e6eed8942a5d191b39dccfa6e38", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/riscv/net/bpf_jit_comp64.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv, bpf: Fix out-of-bounds issue when preparing trampoline image\n\nWe get the size of the trampoline image during the dry run phase and\nallocate memory based on that size. The allocated image will then be\npopulated with instructions during the real patch phase. But after\ncommit 26ef208c209a (\"bpf: Use arch_bpf_trampoline_size\"), the `im`\nargument is inconsistent in the dry run and real patch phase. This may\ncause emit_imm in RV64 to generate a different number of instructions\nwhen generating the \u0027im\u0027 address, potentially causing out-of-bounds\nissues. Let\u0027s emit the maximum number of instructions for the \"im\"\naddress during dry run to fix this problem." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:59.044Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/3e6a1b1b179abb643ec3560c02bc3082bc92285f" }, { "url": "https://git.kernel.org/stable/c/9f1e16fb1fc9826001c69e0551d51fbbcd2d74e9" } ], "title": "riscv, bpf: Fix out-of-bounds issue when preparing trampoline image", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43843", "datePublished": "2024-08-17T09:21:57.811Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:59.044Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43859
Vulnerability from cvelistv5
Published
2024-08-17 09:24
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to truncate preallocated blocks in f2fs_file_open()
chenyuwen reports a f2fs bug as below:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000011
fscrypt_set_bio_crypt_ctx+0x78/0x1e8
f2fs_grab_read_bio+0x78/0x208
f2fs_submit_page_read+0x44/0x154
f2fs_get_read_data_page+0x288/0x5f4
f2fs_get_lock_data_page+0x60/0x190
truncate_partial_data_page+0x108/0x4fc
f2fs_do_truncate_blocks+0x344/0x5f0
f2fs_truncate_blocks+0x6c/0x134
f2fs_truncate+0xd8/0x200
f2fs_iget+0x20c/0x5ac
do_garbage_collect+0x5d0/0xf6c
f2fs_gc+0x22c/0x6a4
f2fs_disable_checkpoint+0xc8/0x310
f2fs_fill_super+0x14bc/0x1764
mount_bdev+0x1b4/0x21c
f2fs_mount+0x20/0x30
legacy_get_tree+0x50/0xbc
vfs_get_tree+0x5c/0x1b0
do_new_mount+0x298/0x4cc
path_mount+0x33c/0x5fc
__arm64_sys_mount+0xcc/0x15c
invoke_syscall+0x60/0x150
el0_svc_common+0xb8/0xf8
do_el0_svc+0x28/0xa0
el0_svc+0x24/0x84
el0t_64_sync_handler+0x88/0xec
It is because inode.i_crypt_info is not initialized during below path:
- mount
- f2fs_fill_super
- f2fs_disable_checkpoint
- f2fs_gc
- f2fs_iget
- f2fs_truncate
So, let's relocate truncation of preallocated blocks to f2fs_file_open(),
after fscrypt_file_open().
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43859", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:06:58.538280Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:20.155Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/f2fs/f2fs.h", "fs/f2fs/file.c", "fs/f2fs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "5f04969136db674f133781626e0b692c5f2bf2f0", "status": "affected", "version": "d4dd19ec1ea0cf6532d65709325c42b1398614a8", "versionType": "git" }, { "lessThan": "f44a25a8bfe0c15d33244539696cd9119cf44d18", "status": "affected", "version": "d4dd19ec1ea0cf6532d65709325c42b1398614a8", "versionType": "git" }, { "lessThan": "3ba0ae885215b325605ff7ebf6de12ac2adf204d", "status": "affected", "version": "d4dd19ec1ea0cf6532d65709325c42b1398614a8", "versionType": "git" }, { "lessThan": "298b1e4182d657c3e388adcc29477904e9600ed5", "status": "affected", "version": "d4dd19ec1ea0cf6532d65709325c42b1398614a8", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/f2fs/f2fs.h", "fs/f2fs/file.c", "fs/f2fs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.17" }, { "lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.109", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate preallocated blocks in f2fs_file_open()\n\nchenyuwen reports a f2fs bug as below:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000011\n fscrypt_set_bio_crypt_ctx+0x78/0x1e8\n f2fs_grab_read_bio+0x78/0x208\n f2fs_submit_page_read+0x44/0x154\n f2fs_get_read_data_page+0x288/0x5f4\n f2fs_get_lock_data_page+0x60/0x190\n truncate_partial_data_page+0x108/0x4fc\n f2fs_do_truncate_blocks+0x344/0x5f0\n f2fs_truncate_blocks+0x6c/0x134\n f2fs_truncate+0xd8/0x200\n f2fs_iget+0x20c/0x5ac\n do_garbage_collect+0x5d0/0xf6c\n f2fs_gc+0x22c/0x6a4\n f2fs_disable_checkpoint+0xc8/0x310\n f2fs_fill_super+0x14bc/0x1764\n mount_bdev+0x1b4/0x21c\n f2fs_mount+0x20/0x30\n legacy_get_tree+0x50/0xbc\n vfs_get_tree+0x5c/0x1b0\n do_new_mount+0x298/0x4cc\n path_mount+0x33c/0x5fc\n __arm64_sys_mount+0xcc/0x15c\n invoke_syscall+0x60/0x150\n el0_svc_common+0xb8/0xf8\n do_el0_svc+0x28/0xa0\n el0_svc+0x24/0x84\n el0t_64_sync_handler+0x88/0xec\n\nIt is because inode.i_crypt_info is not initialized during below path:\n- mount\n - f2fs_fill_super\n - f2fs_disable_checkpoint\n - f2fs_gc\n - f2fs_iget\n - f2fs_truncate\n\nSo, let\u0027s relocate truncation of preallocated blocks to f2fs_file_open(),\nafter fscrypt_file_open()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:18.046Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/5f04969136db674f133781626e0b692c5f2bf2f0" }, { "url": "https://git.kernel.org/stable/c/f44a25a8bfe0c15d33244539696cd9119cf44d18" }, { "url": "https://git.kernel.org/stable/c/3ba0ae885215b325605ff7ebf6de12ac2adf204d" }, { "url": "https://git.kernel.org/stable/c/298b1e4182d657c3e388adcc29477904e9600ed5" } ], "title": "f2fs: fix to truncate preallocated blocks in f2fs_file_open()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43859", "datePublished": "2024-08-17T09:24:28.672Z", "dateReserved": "2024-08-17T09:11:59.279Z", "dateUpdated": "2024-12-19T09:17:18.046Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42273
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid
mkdir /mnt/test/comp
f2fs_io setflags compression /mnt/test/comp
dd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1
truncate --size 13 /mnt/test/comp/testfile
In the above scenario, we can get a BUG_ON.
kernel BUG at fs/f2fs/segment.c:3589!
Call Trace:
do_write_page+0x78/0x390 [f2fs]
f2fs_outplace_write_data+0x62/0xb0 [f2fs]
f2fs_do_write_data_page+0x275/0x740 [f2fs]
f2fs_write_single_data_page+0x1dc/0x8f0 [f2fs]
f2fs_write_multi_pages+0x1e5/0xae0 [f2fs]
f2fs_write_cache_pages+0xab1/0xc60 [f2fs]
f2fs_write_data_pages+0x2d8/0x330 [f2fs]
do_writepages+0xcf/0x270
__writeback_single_inode+0x44/0x350
writeback_sb_inodes+0x242/0x530
__writeback_inodes_wb+0x54/0xf0
wb_writeback+0x192/0x310
wb_workfn+0x30d/0x400
The reason is we gave CURSEG_ALL_DATA_ATGC to COMPR_ADDR where the
page was set the gcing flag by set_cluster_dirty().
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42273", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:04.954171Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:32.172Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/f2fs/segment.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "5fd057160ab240dd816ae09b625395d54c297de1", "status": "affected", "version": "7c972c89457511007dfc933814c06786905e515c", "versionType": "git" }, { "lessThan": "4239571c5db46a42f723b8fa8394039187c34439", "status": "affected", "version": "417b8a91f4e8831cadaf85c3f15c6991c1f54dde", "versionType": "git" }, { "lessThan": "0cd106612396656d6f1ca17ef192c6759bb60791", "status": "affected", "version": "4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "versionType": "git" }, { "lessThan": "8cb1f4080dd91c6e6b01dbea013a3f42341cb6a1", "status": "affected", "version": "4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/f2fs/segment.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid\n\nmkdir /mnt/test/comp\nf2fs_io setflags compression /mnt/test/comp\ndd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1\ntruncate --size 13 /mnt/test/comp/testfile\n\nIn the above scenario, we can get a BUG_ON.\n kernel BUG at fs/f2fs/segment.c:3589!\n Call Trace:\n do_write_page+0x78/0x390 [f2fs]\n f2fs_outplace_write_data+0x62/0xb0 [f2fs]\n f2fs_do_write_data_page+0x275/0x740 [f2fs]\n f2fs_write_single_data_page+0x1dc/0x8f0 [f2fs]\n f2fs_write_multi_pages+0x1e5/0xae0 [f2fs]\n f2fs_write_cache_pages+0xab1/0xc60 [f2fs]\n f2fs_write_data_pages+0x2d8/0x330 [f2fs]\n do_writepages+0xcf/0x270\n __writeback_single_inode+0x44/0x350\n writeback_sb_inodes+0x242/0x530\n __writeback_inodes_wb+0x54/0xf0\n wb_writeback+0x192/0x310\n wb_workfn+0x30d/0x400\n\nThe reason is we gave CURSEG_ALL_DATA_ATGC to COMPR_ADDR where the\npage was set the gcing flag by set_cluster_dirty()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:24.428Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/5fd057160ab240dd816ae09b625395d54c297de1" }, { "url": "https://git.kernel.org/stable/c/4239571c5db46a42f723b8fa8394039187c34439" }, { "url": "https://git.kernel.org/stable/c/0cd106612396656d6f1ca17ef192c6759bb60791" }, { "url": "https://git.kernel.org/stable/c/8cb1f4080dd91c6e6b01dbea013a3f42341cb6a1" } ], "title": "f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42273", "datePublished": "2024-08-17T08:54:27.422Z", "dateReserved": "2024-07-30T07:40:12.260Z", "dateUpdated": "2024-12-19T09:15:24.428Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42262
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Fix potential memory leak in the performance extension
If fetching of userspace memory fails during the main loop, all drm sync
objs looked up until that point will be leaked because of the missing
drm_syncobj_put.
Fix it by exporting and using a common cleanup helper.
(cherry picked from commit 484de39fa5f5b7bd0c5f2e2c5265167250ef7501)
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42262", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:40.908918Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:33.287Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_drv.h", "drivers/gpu/drm/v3d/v3d_sched.c", "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ad5fdc48f7a63b8a98493c667505fe4d3864ae21", "status": "affected", "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "versionType": "git" }, { "lessThan": "32df4abc44f24dbec239d43e2b26d5768c5d1a78", "status": "affected", "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_drv.h", "drivers/gpu/drm/v3d/v3d_sched.c", "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix potential memory leak in the performance extension\n\nIf fetching of userspace memory fails during the main loop, all drm sync\nobjs looked up until that point will be leaked because of the missing\ndrm_syncobj_put.\n\nFix it by exporting and using a common cleanup helper.\n\n(cherry picked from commit 484de39fa5f5b7bd0c5f2e2c5265167250ef7501)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:06.121Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ad5fdc48f7a63b8a98493c667505fe4d3864ae21" }, { "url": "https://git.kernel.org/stable/c/32df4abc44f24dbec239d43e2b26d5768c5d1a78" } ], "title": "drm/v3d: Fix potential memory leak in the performance extension", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42262", "datePublished": "2024-08-17T08:54:19.579Z", "dateReserved": "2024-07-30T07:40:12.259Z", "dateUpdated": "2024-12-19T09:15:06.121Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43834
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xdp: fix invalid wait context of page_pool_destroy()
If the driver uses a page pool, it creates a page pool with
page_pool_create().
The reference count of page pool is 1 as default.
A page pool will be destroyed only when a reference count reaches 0.
page_pool_destroy() is used to destroy page pool, it decreases a
reference count.
When a page pool is destroyed, ->disconnect() is called, which is
mem_allocator_disconnect().
This function internally acquires mutex_lock().
If the driver uses XDP, it registers a memory model with
xdp_rxq_info_reg_mem_model().
The xdp_rxq_info_reg_mem_model() internally increases a page pool
reference count if a memory model is a page pool.
Now the reference count is 2.
To destroy a page pool, the driver should call both page_pool_destroy()
and xdp_unreg_mem_model().
The xdp_unreg_mem_model() internally calls page_pool_destroy().
Only page_pool_destroy() decreases a reference count.
If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we
will face an invalid wait context warning.
Because xdp_unreg_mem_model() calls page_pool_destroy() with
rcu_read_lock().
The page_pool_destroy() internally acquires mutex_lock().
Splat looks like:
=============================
[ BUG: Invalid wait context ]
6.10.0-rc6+ #4 Tainted: G W
-----------------------------
ethtool/1806 is trying to lock:
ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150
other info that might help us debug this:
context-{5:5}
3 locks held by ethtool/1806:
stack backtrace:
CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed
Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021
Call Trace:
<TASK>
dump_stack_lvl+0x7e/0xc0
__lock_acquire+0x1681/0x4de0
? _printk+0x64/0xe0
? __pfx_mark_lock.part.0+0x10/0x10
? __pfx___lock_acquire+0x10/0x10
lock_acquire+0x1b3/0x580
? mem_allocator_disconnect+0x73/0x150
? __wake_up_klogd.part.0+0x16/0xc0
? __pfx_lock_acquire+0x10/0x10
? dump_stack_lvl+0x91/0xc0
__mutex_lock+0x15c/0x1690
? mem_allocator_disconnect+0x73/0x150
? __pfx_prb_read_valid+0x10/0x10
? mem_allocator_disconnect+0x73/0x150
? __pfx_llist_add_batch+0x10/0x10
? console_unlock+0x193/0x1b0
? lockdep_hardirqs_on+0xbe/0x140
? __pfx___mutex_lock+0x10/0x10
? tick_nohz_tick_stopped+0x16/0x90
? __irq_work_queue_local+0x1e5/0x330
? irq_work_queue+0x39/0x50
? __wake_up_klogd.part.0+0x79/0xc0
? mem_allocator_disconnect+0x73/0x150
mem_allocator_disconnect+0x73/0x150
? __pfx_mem_allocator_disconnect+0x10/0x10
? mark_held_locks+0xa5/0xf0
? rcu_is_watching+0x11/0xb0
page_pool_release+0x36e/0x6d0
page_pool_destroy+0xd7/0x440
xdp_unreg_mem_model+0x1a7/0x2a0
? __pfx_xdp_unreg_mem_model+0x10/0x10
? kfree+0x125/0x370
? bnxt_free_ring.isra.0+0x2eb/0x500
? bnxt_free_mem+0x5ac/0x2500
xdp_rxq_info_unreg+0x4a/0xd0
bnxt_free_mem+0x1356/0x2500
bnxt_close_nic+0xf0/0x3b0
? __pfx_bnxt_close_nic+0x10/0x10
? ethnl_parse_bit+0x2c6/0x6d0
? __pfx___nla_validate_parse+0x10/0x10
? __pfx_ethnl_parse_bit+0x10/0x10
bnxt_set_features+0x2a8/0x3e0
__netdev_update_features+0x4dc/0x1370
? ethnl_parse_bitset+0x4ff/0x750
? __pfx_ethnl_parse_bitset+0x10/0x10
? __pfx___netdev_update_features+0x10/0x10
? mark_held_locks+0xa5/0xf0
? _raw_spin_unlock_irqrestore+0x42/0x70
? __pm_runtime_resume+0x7d/0x110
ethnl_set_features+0x32d/0xa20
To fix this problem, it uses rhashtable_lookup_fast() instead of
rhashtable_lookup() with rcu_read_lock().
Using xa without rcu_read_lock() here is safe.
xa is freed by __xdp_mem_allocator_rcu_free() and this is called by
call_rcu() of mem_xa_remove().
The mem_xa_remove() is called by page_pool_destroy() if a reference
count reaches 0.
The xa is already protected by the reference count mechanism well in the
control plane.
So removing rcu_read_lock() for page_pool_destroy() is safe.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 Version: c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 Version: c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 Version: c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 Version: c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 Version: c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43834", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:18.214810Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:23.448Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/core/xdp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "be9d08ff102df3ac4f66e826ea935cf3af63a4bd", "status": "affected", "version": "c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3", "versionType": "git" }, { "lessThan": "6c390ef198aa69795427a5cb5fd7cb4bc7e6cd7a", "status": "affected", "version": "c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3", "versionType": "git" }, { "lessThan": "3fc1be360b99baeea15cdee3cf94252cd3a72d26", "status": "affected", "version": "c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3", "versionType": "git" }, { "lessThan": "bf0ce5aa5f2525ed1b921ba36de96e458e77f482", "status": "affected", "version": "c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3", "versionType": "git" }, { "lessThan": "12144069209eec7f2090ce9afa15acdcc2c2a537", "status": "affected", "version": "c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3", "versionType": "git" }, { "lessThan": "59a931c5b732ca5fc2ca727f5a72aeabaafa85ec", "status": "affected", "version": "c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/core/xdp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.5" }, { "lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: fix invalid wait context of page_pool_destroy()\n\nIf the driver uses a page pool, it creates a page pool with\npage_pool_create().\nThe reference count of page pool is 1 as default.\nA page pool will be destroyed only when a reference count reaches 0.\npage_pool_destroy() is used to destroy page pool, it decreases a\nreference count.\nWhen a page pool is destroyed, -\u003edisconnect() is called, which is\nmem_allocator_disconnect().\nThis function internally acquires mutex_lock().\n\nIf the driver uses XDP, it registers a memory model with\nxdp_rxq_info_reg_mem_model().\nThe xdp_rxq_info_reg_mem_model() internally increases a page pool\nreference count if a memory model is a page pool.\nNow the reference count is 2.\n\nTo destroy a page pool, the driver should call both page_pool_destroy()\nand xdp_unreg_mem_model().\nThe xdp_unreg_mem_model() internally calls page_pool_destroy().\nOnly page_pool_destroy() decreases a reference count.\n\nIf a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we\nwill face an invalid wait context warning.\nBecause xdp_unreg_mem_model() calls page_pool_destroy() with\nrcu_read_lock().\nThe page_pool_destroy() internally acquires mutex_lock().\n\nSplat looks like:\n=============================\n[ BUG: Invalid wait context ]\n6.10.0-rc6+ #4 Tainted: G W\n-----------------------------\nethtool/1806 is trying to lock:\nffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150\nother info that might help us debug this:\ncontext-{5:5}\n3 locks held by ethtool/1806:\nstack backtrace:\nCPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed\nHardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x7e/0xc0\n__lock_acquire+0x1681/0x4de0\n? _printk+0x64/0xe0\n? __pfx_mark_lock.part.0+0x10/0x10\n? __pfx___lock_acquire+0x10/0x10\nlock_acquire+0x1b3/0x580\n? mem_allocator_disconnect+0x73/0x150\n? __wake_up_klogd.part.0+0x16/0xc0\n? __pfx_lock_acquire+0x10/0x10\n? dump_stack_lvl+0x91/0xc0\n__mutex_lock+0x15c/0x1690\n? mem_allocator_disconnect+0x73/0x150\n? __pfx_prb_read_valid+0x10/0x10\n? mem_allocator_disconnect+0x73/0x150\n? __pfx_llist_add_batch+0x10/0x10\n? console_unlock+0x193/0x1b0\n? lockdep_hardirqs_on+0xbe/0x140\n? __pfx___mutex_lock+0x10/0x10\n? tick_nohz_tick_stopped+0x16/0x90\n? __irq_work_queue_local+0x1e5/0x330\n? irq_work_queue+0x39/0x50\n? __wake_up_klogd.part.0+0x79/0xc0\n? mem_allocator_disconnect+0x73/0x150\nmem_allocator_disconnect+0x73/0x150\n? __pfx_mem_allocator_disconnect+0x10/0x10\n? mark_held_locks+0xa5/0xf0\n? rcu_is_watching+0x11/0xb0\npage_pool_release+0x36e/0x6d0\npage_pool_destroy+0xd7/0x440\nxdp_unreg_mem_model+0x1a7/0x2a0\n? __pfx_xdp_unreg_mem_model+0x10/0x10\n? kfree+0x125/0x370\n? bnxt_free_ring.isra.0+0x2eb/0x500\n? bnxt_free_mem+0x5ac/0x2500\nxdp_rxq_info_unreg+0x4a/0xd0\nbnxt_free_mem+0x1356/0x2500\nbnxt_close_nic+0xf0/0x3b0\n? __pfx_bnxt_close_nic+0x10/0x10\n? ethnl_parse_bit+0x2c6/0x6d0\n? __pfx___nla_validate_parse+0x10/0x10\n? __pfx_ethnl_parse_bit+0x10/0x10\nbnxt_set_features+0x2a8/0x3e0\n__netdev_update_features+0x4dc/0x1370\n? ethnl_parse_bitset+0x4ff/0x750\n? __pfx_ethnl_parse_bitset+0x10/0x10\n? __pfx___netdev_update_features+0x10/0x10\n? mark_held_locks+0xa5/0xf0\n? _raw_spin_unlock_irqrestore+0x42/0x70\n? __pm_runtime_resume+0x7d/0x110\nethnl_set_features+0x32d/0xa20\n\nTo fix this problem, it uses rhashtable_lookup_fast() instead of\nrhashtable_lookup() with rcu_read_lock().\nUsing xa without rcu_read_lock() here is safe.\nxa is freed by __xdp_mem_allocator_rcu_free() and this is called by\ncall_rcu() of mem_xa_remove().\nThe mem_xa_remove() is called by page_pool_destroy() if a reference\ncount reaches 0.\nThe xa is already protected by the reference count mechanism well in the\ncontrol plane.\nSo removing rcu_read_lock() for page_pool_destroy() is safe." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:47.441Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/be9d08ff102df3ac4f66e826ea935cf3af63a4bd" }, { "url": "https://git.kernel.org/stable/c/6c390ef198aa69795427a5cb5fd7cb4bc7e6cd7a" }, { "url": "https://git.kernel.org/stable/c/3fc1be360b99baeea15cdee3cf94252cd3a72d26" }, { "url": "https://git.kernel.org/stable/c/bf0ce5aa5f2525ed1b921ba36de96e458e77f482" }, { "url": "https://git.kernel.org/stable/c/12144069209eec7f2090ce9afa15acdcc2c2a537" }, { "url": "https://git.kernel.org/stable/c/59a931c5b732ca5fc2ca727f5a72aeabaafa85ec" } ], "title": "xdp: fix invalid wait context of page_pool_destroy()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43834", "datePublished": "2024-08-17T09:21:51.583Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:47.441Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43839
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
To have enough space to write all possible sprintf() args. Currently
'name' size is 16, but the first '%s' specifier may already need at
least 16 characters, since 'bnad->netdev->name' is used there.
For '%d' specifiers, assume that they require:
* 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8
* 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX
is 16
And replace sprintf with snprintf.
Detected using the static analysis tool - Svace.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 8b230ed8ec96c933047dd0625cf95f739e4939a6 Version: 8b230ed8ec96c933047dd0625cf95f739e4939a6 Version: 8b230ed8ec96c933047dd0625cf95f739e4939a6 Version: 8b230ed8ec96c933047dd0625cf95f739e4939a6 Version: 8b230ed8ec96c933047dd0625cf95f739e4939a6 Version: 8b230ed8ec96c933047dd0625cf95f739e4939a6 Version: 8b230ed8ec96c933047dd0625cf95f739e4939a6 Version: 8b230ed8ec96c933047dd0625cf95f739e4939a6 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43839", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:02.344125Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:22.797Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/brocade/bna/bna_types.h", "drivers/net/ethernet/brocade/bna/bnad.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "f121740f69eda4da2de9a20a6687a13593e72540", "status": "affected", "version": "8b230ed8ec96c933047dd0625cf95f739e4939a6", "versionType": "git" }, { "lessThan": "c90b1cd7758fd4839909e838ae195d19f8065d76", "status": "affected", "version": "8b230ed8ec96c933047dd0625cf95f739e4939a6", "versionType": "git" }, { "lessThan": "6ce46045f9b90d952602e2c0b8886cfadf860bf1", "status": "affected", "version": "8b230ed8ec96c933047dd0625cf95f739e4939a6", "versionType": "git" }, { "lessThan": "6d20c4044ab4d0e6a99aa35853e66f0aed5589e3", "status": "affected", "version": "8b230ed8ec96c933047dd0625cf95f739e4939a6", "versionType": "git" }, { "lessThan": "ab748dd10d8742561f2980fea08ffb4f0cacfdef", "status": "affected", "version": "8b230ed8ec96c933047dd0625cf95f739e4939a6", "versionType": "git" }, { "lessThan": "b0ff0cd0847b03c0a0abe20cfa900eabcfcb9e43", "status": "affected", "version": "8b230ed8ec96c933047dd0625cf95f739e4939a6", "versionType": "git" }, { "lessThan": "e0f48f51d55fb187400e9787192eda09fa200ff5", "status": "affected", "version": "8b230ed8ec96c933047dd0625cf95f739e4939a6", "versionType": "git" }, { "lessThan": "c9741a03dc8e491e57b95fba0058ab46b7e506da", "status": "affected", "version": "8b230ed8ec96c933047dd0625cf95f739e4939a6", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/brocade/bna/bna_types.h", "drivers/net/ethernet/brocade/bna/bnad.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.37" }, { "lessThan": "2.6.37", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbna: adjust \u0027name\u0027 buf size of bna_tcb and bna_ccb structures\n\nTo have enough space to write all possible sprintf() args. Currently\n\u0027name\u0027 size is 16, but the first \u0027%s\u0027 specifier may already need at\nleast 16 characters, since \u0027bnad-\u003enetdev-\u003ename\u0027 is used there.\n\nFor \u0027%d\u0027 specifiers, assume that they require:\n * 1 char for \u0027tx_id + tx_info-\u003etcb[i]-\u003eid\u0027 sum, BNAD_MAX_TXQ_PER_TX is 8\n * 2 chars for \u0027rx_id + rx_info-\u003erx_ctrl[i].ccb-\u003eid\u0027, BNAD_MAX_RXP_PER_RX\n is 16\n\nAnd replace sprintf with snprintf.\n\nDetected using the static analysis tool - Svace." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:53.558Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/f121740f69eda4da2de9a20a6687a13593e72540" }, { "url": "https://git.kernel.org/stable/c/c90b1cd7758fd4839909e838ae195d19f8065d76" }, { "url": "https://git.kernel.org/stable/c/6ce46045f9b90d952602e2c0b8886cfadf860bf1" }, { "url": "https://git.kernel.org/stable/c/6d20c4044ab4d0e6a99aa35853e66f0aed5589e3" }, { "url": "https://git.kernel.org/stable/c/ab748dd10d8742561f2980fea08ffb4f0cacfdef" }, { "url": "https://git.kernel.org/stable/c/b0ff0cd0847b03c0a0abe20cfa900eabcfcb9e43" }, { "url": "https://git.kernel.org/stable/c/e0f48f51d55fb187400e9787192eda09fa200ff5" }, { "url": "https://git.kernel.org/stable/c/c9741a03dc8e491e57b95fba0058ab46b7e506da" } ], "title": "bna: adjust \u0027name\u0027 buf size of bna_tcb and bna_ccb structures", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43839", "datePublished": "2024-08-17T09:21:55.085Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:53.558Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43840
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls
__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them
the struct bpf_tramp_image *im pointer as an argument in R0.
The trampoline generation code uses emit_addr_mov_i64() to emit
instructions for moving the bpf_tramp_image address into R0, but
emit_addr_mov_i64() assumes the address to be in the vmalloc() space
and uses only 48 bits. Because bpf_tramp_image is allocated using
kzalloc(), its address can use more than 48-bits, in this case the
trampoline will pass an invalid address to __bpf_tramp_enter/exit()
causing a kernel crash.
Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()
as it can work with addresses that are greater than 48-bits.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43840", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:58.806748Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:04.569Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/arm64/net/bpf_jit_comp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6d218fcc707d6b2c3616b6cd24b948fd4825cfec", "status": "affected", "version": "efc9909fdce00a827a37609628223cd45bf95d0b", "versionType": "git" }, { "lessThan": "19d3c179a37730caf600a97fed3794feac2b197b", "status": "affected", "version": "efc9909fdce00a827a37609628223cd45bf95d0b", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/arm64/net/bpf_jit_comp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG\n\nWhen BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls\n__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them\nthe struct bpf_tramp_image *im pointer as an argument in R0.\n\nThe trampoline generation code uses emit_addr_mov_i64() to emit\ninstructions for moving the bpf_tramp_image address into R0, but\nemit_addr_mov_i64() assumes the address to be in the vmalloc() space\nand uses only 48 bits. Because bpf_tramp_image is allocated using\nkzalloc(), its address can use more than 48-bits, in this case the\ntrampoline will pass an invalid address to __bpf_tramp_enter/exit()\ncausing a kernel crash.\n\nFix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()\nas it can work with addresses that are greater than 48-bits." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:54.787Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/6d218fcc707d6b2c3616b6cd24b948fd4825cfec" }, { "url": "https://git.kernel.org/stable/c/19d3c179a37730caf600a97fed3794feac2b197b" } ], "title": "bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43840", "datePublished": "2024-08-17T09:21:55.841Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:54.787Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43856
Vulnerability from cvelistv5
Published
2024-08-17 09:24
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dma: fix call order in dmam_free_coherent
dmam_free_coherent() frees a DMA allocation, which makes the
freed vaddr available for reuse, then calls devres_destroy()
to remove and free the data structure used to track the DMA
allocation. Between the two calls, it is possible for a
concurrent task to make an allocation with the same vaddr
and add it to the devres list.
If this happens, there will be two entries in the devres list
with the same vaddr and devres_destroy() can free the wrong
entry, triggering the WARN_ON() in dmam_match.
Fix by destroying the devres entry before freeing the DMA
allocation.
kokonut //net/encryption
http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 9ac7849e35f705830f7b016ff272b0ff1f7ff759 Version: 9ac7849e35f705830f7b016ff272b0ff1f7ff759 Version: 9ac7849e35f705830f7b016ff272b0ff1f7ff759 Version: 9ac7849e35f705830f7b016ff272b0ff1f7ff759 Version: 9ac7849e35f705830f7b016ff272b0ff1f7ff759 Version: 9ac7849e35f705830f7b016ff272b0ff1f7ff759 Version: 9ac7849e35f705830f7b016ff272b0ff1f7ff759 Version: 9ac7849e35f705830f7b016ff272b0ff1f7ff759 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43856", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:08.178694Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:20.523Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "kernel/dma/mapping.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "fe2d246080f035e0af5793cb79067ba125e4fb63", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git" }, { "lessThan": "2f7bbdc744f2e7051d1cb47c8e082162df1923c9", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git" }, { "lessThan": "257193083e8f43907e99ea633820fc2b3bcd24c7", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git" }, { "lessThan": "87b34c8c94e29fa01d744e5147697f592998d954", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git" }, { "lessThan": "f993a4baf6b622232e4c190d34c220179e5d61eb", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git" }, { "lessThan": "1fe97f68fce1ba24bf823bfb0eb0956003473130", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git" }, { "lessThan": "22094f5f52e7bc16c5bf9613365049383650b02e", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git" }, { "lessThan": "28e8b7406d3a1f5329a03aa25a43aa28e087cb20", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "kernel/dma/mapping.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.21" }, { "lessThan": "2.6.21", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma: fix call order in dmam_free_coherent\n\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\n\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\n\nFix by destroying the devres entry before freeing the DMA\nallocation.\n\n kokonut //net/encryption\n http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:14.623Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/fe2d246080f035e0af5793cb79067ba125e4fb63" }, { "url": "https://git.kernel.org/stable/c/2f7bbdc744f2e7051d1cb47c8e082162df1923c9" }, { "url": "https://git.kernel.org/stable/c/257193083e8f43907e99ea633820fc2b3bcd24c7" }, { "url": "https://git.kernel.org/stable/c/87b34c8c94e29fa01d744e5147697f592998d954" }, { "url": "https://git.kernel.org/stable/c/f993a4baf6b622232e4c190d34c220179e5d61eb" }, { "url": "https://git.kernel.org/stable/c/1fe97f68fce1ba24bf823bfb0eb0956003473130" }, { "url": "https://git.kernel.org/stable/c/22094f5f52e7bc16c5bf9613365049383650b02e" }, { "url": "https://git.kernel.org/stable/c/28e8b7406d3a1f5329a03aa25a43aa28e087cb20" } ], "title": "dma: fix call order in dmam_free_coherent", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43856", "datePublished": "2024-08-17T09:24:26.560Z", "dateReserved": "2024-08-17T09:11:59.278Z", "dateUpdated": "2024-12-19T09:17:14.623Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42302
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
Keith reports a use-after-free when a DPC event occurs concurrently to
hot-removal of the same portion of the hierarchy:
The dpc_handler() awaits readiness of the secondary bus below the
Downstream Port where the DPC event occurred. To do so, it polls the
config space of the first child device on the secondary bus. If that
child device is concurrently removed, accesses to its struct pci_dev
cause the kernel to oops.
That's because pci_bridge_wait_for_secondary_bus() neglects to hold a
reference on the child device. Before v6.3, the function was only
called on resume from system sleep or on runtime resume. Holding a
reference wasn't necessary back then because the pciehp IRQ thread
could never run concurrently. (On resume from system sleep, IRQs are
not enabled until after the resume_noirq phase. And runtime resume is
always awaited before a PCI device is removed.)
However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also
called on a DPC event. Commit 53b54ad074de ("PCI/DPC: Await readiness
of secondary bus after reset"), which introduced that, failed to
appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a
reference on the child device because dpc_handler() and pciehp may
indeed run concurrently. The commit was backported to v5.10+ stable
kernels, so that's the oldest one affected.
Add the missing reference acquisition.
Abridged stack trace:
BUG: unable to handle page fault for address: 00000000091400c0
CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0
RIP: pci_bus_read_config_dword+0x17/0x50
pci_dev_wait()
pci_bridge_wait_for_secondary_bus()
dpc_reset_link()
pcie_do_recovery()
dpc_handler()
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: d0292124bb5787a2f1ab1316509e801ca89c10fb Version: ffe2318405e605f1b3985ce188eff69e6d1d1baa Version: 189f856e76f5463f59efb5fc18dcc1692d04c41a Version: 53b54ad074de1896f8b021615f65b27f557ce874 Version: 53b54ad074de1896f8b021615f65b27f557ce874 Version: 53b54ad074de1896f8b021615f65b27f557ce874 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42302", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:28.656566Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:28.331Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/pci/pci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c52f9e1a9eb40f13993142c331a6cfd334d4b91d", "status": "affected", "version": "d0292124bb5787a2f1ab1316509e801ca89c10fb", "versionType": "git" }, { "lessThan": "2c111413f38ca5cf87557cab89f6d82b0e3433e7", "status": "affected", "version": "ffe2318405e605f1b3985ce188eff69e6d1d1baa", "versionType": "git" }, { "lessThan": "f63df70b439bb8331358a306541893bf415bf1da", "status": "affected", "version": "189f856e76f5463f59efb5fc18dcc1692d04c41a", "versionType": "git" }, { "lessThan": "2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f", "status": "affected", "version": "53b54ad074de1896f8b021615f65b27f557ce874", "versionType": "git" }, { "lessThan": "b16f3ea1db47a6766a9f1169244cf1fc287a7c62", "status": "affected", "version": "53b54ad074de1896f8b021615f65b27f557ce874", "versionType": "git" }, { "lessThan": "11a1f4bc47362700fcbde717292158873fb847ed", "status": "affected", "version": "53b54ad074de1896f8b021615f65b27f557ce874", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/pci/pci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/DPC: Fix use-after-free on concurrent DPC and hot-removal\n\nKeith reports a use-after-free when a DPC event occurs concurrently to\nhot-removal of the same portion of the hierarchy:\n\nThe dpc_handler() awaits readiness of the secondary bus below the\nDownstream Port where the DPC event occurred. To do so, it polls the\nconfig space of the first child device on the secondary bus. If that\nchild device is concurrently removed, accesses to its struct pci_dev\ncause the kernel to oops.\n\nThat\u0027s because pci_bridge_wait_for_secondary_bus() neglects to hold a\nreference on the child device. Before v6.3, the function was only\ncalled on resume from system sleep or on runtime resume. Holding a\nreference wasn\u0027t necessary back then because the pciehp IRQ thread\ncould never run concurrently. (On resume from system sleep, IRQs are\nnot enabled until after the resume_noirq phase. And runtime resume is\nalways awaited before a PCI device is removed.)\n\nHowever starting with v6.3, pci_bridge_wait_for_secondary_bus() is also\ncalled on a DPC event. Commit 53b54ad074de (\"PCI/DPC: Await readiness\nof secondary bus after reset\"), which introduced that, failed to\nappreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a\nreference on the child device because dpc_handler() and pciehp may\nindeed run concurrently. The commit was backported to v5.10+ stable\nkernels, so that\u0027s the oldest one affected.\n\nAdd the missing reference acquisition.\n\nAbridged stack trace:\n\n BUG: unable to handle page fault for address: 00000000091400c0\n CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0\n RIP: pci_bus_read_config_dword+0x17/0x50\n pci_dev_wait()\n pci_bridge_wait_for_secondary_bus()\n dpc_reset_link()\n pcie_do_recovery()\n dpc_handler()" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:58.816Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c52f9e1a9eb40f13993142c331a6cfd334d4b91d" }, { "url": "https://git.kernel.org/stable/c/2c111413f38ca5cf87557cab89f6d82b0e3433e7" }, { "url": "https://git.kernel.org/stable/c/f63df70b439bb8331358a306541893bf415bf1da" }, { "url": "https://git.kernel.org/stable/c/2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f" }, { "url": "https://git.kernel.org/stable/c/b16f3ea1db47a6766a9f1169244cf1fc287a7c62" }, { "url": "https://git.kernel.org/stable/c/11a1f4bc47362700fcbde717292158873fb847ed" } ], "title": "PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42302", "datePublished": "2024-08-17T09:09:08.891Z", "dateReserved": "2024-07-30T07:40:12.272Z", "dateUpdated": "2024-12-19T09:15:58.816Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42285
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with
an existing struct iw_cm_id (cm_id) as follows:
conn_id->cm_id.iw = cm_id;
cm_id->context = conn_id;
cm_id->cm_handler = cma_iw_handler;
rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make
sure that cm_work_handler() does not trigger a use-after-free by only
freeing of the struct rdma_id_private after all pending work has finished.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 Version: 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 Version: 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 Version: 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 Version: 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 Version: 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 Version: 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 Version: 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42285", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:23.465400Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:30.490Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/infiniband/core/iwcm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "d91d253c87fd1efece521ff2612078a35af673c6", "status": "affected", "version": "59c68ac31e15ad09d2cb04734e3c8c544a95f8d4", "versionType": "git" }, { "lessThan": "7f25f296fc9bd0435be14e89bf657cd615a23574", "status": "affected", "version": "59c68ac31e15ad09d2cb04734e3c8c544a95f8d4", "versionType": "git" }, { "lessThan": "94ee7ff99b87435ec63211f632918dc7f44dac79", "status": "affected", "version": "59c68ac31e15ad09d2cb04734e3c8c544a95f8d4", "versionType": "git" }, { "lessThan": "557d035fe88d78dd51664f4dc0e1896c04c97cf6", "status": "affected", "version": "59c68ac31e15ad09d2cb04734e3c8c544a95f8d4", "versionType": "git" }, { "lessThan": "dc8074b8901caabb97c2d353abd6b4e7fa5a59a5", "status": "affected", "version": "59c68ac31e15ad09d2cb04734e3c8c544a95f8d4", "versionType": "git" }, { "lessThan": "ff5bbbdee08287d75d72e65b72a2b76d9637892a", "status": "affected", "version": "59c68ac31e15ad09d2cb04734e3c8c544a95f8d4", "versionType": "git" }, { "lessThan": "ee39384ee787e86e9db4efb843818ef0ea9cb8ae", "status": "affected", "version": "59c68ac31e15ad09d2cb04734e3c8c544a95f8d4", "versionType": "git" }, { "lessThan": "aee2424246f9f1dadc33faa78990c1e2eb7826e4", "status": "affected", "version": "59c68ac31e15ad09d2cb04734e3c8c544a95f8d4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/infiniband/core/iwcm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.8" }, { "lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/iwcm: Fix a use-after-free related to destroying CM IDs\n\niw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with\nan existing struct iw_cm_id (cm_id) as follows:\n\n conn_id-\u003ecm_id.iw = cm_id;\n cm_id-\u003econtext = conn_id;\n cm_id-\u003ecm_handler = cma_iw_handler;\n\nrdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make\nsure that cm_work_handler() does not trigger a use-after-free by only\nfreeing of the struct rdma_id_private after all pending work has finished." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:38.361Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/d91d253c87fd1efece521ff2612078a35af673c6" }, { "url": "https://git.kernel.org/stable/c/7f25f296fc9bd0435be14e89bf657cd615a23574" }, { "url": "https://git.kernel.org/stable/c/94ee7ff99b87435ec63211f632918dc7f44dac79" }, { "url": "https://git.kernel.org/stable/c/557d035fe88d78dd51664f4dc0e1896c04c97cf6" }, { "url": "https://git.kernel.org/stable/c/dc8074b8901caabb97c2d353abd6b4e7fa5a59a5" }, { "url": "https://git.kernel.org/stable/c/ff5bbbdee08287d75d72e65b72a2b76d9637892a" }, { "url": "https://git.kernel.org/stable/c/ee39384ee787e86e9db4efb843818ef0ea9cb8ae" }, { "url": "https://git.kernel.org/stable/c/aee2424246f9f1dadc33faa78990c1e2eb7826e4" } ], "title": "RDMA/iwcm: Fix a use-after-free related to destroying CM IDs", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42285", "datePublished": "2024-08-17T09:08:51.302Z", "dateReserved": "2024-07-30T07:40:12.262Z", "dateUpdated": "2024-12-19T09:15:38.361Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43836
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethtool: pse-pd: Fix possible null-deref
Fix a possible null dereference when a PSE supports both c33 and PoDL, but
only one of the netlink attributes is specified. The c33 or PoDL PSE
capabilities are already validated in the ethnl_set_pse_validate() call.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43836", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:11.966982Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:23.175Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/ethtool/pse-pd.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e187690b125a297499eadeec53c32c5ed6d7436a", "status": "affected", "version": "4d18e3ddf427d93a2895a1c9d61477e1f1726cad", "versionType": "git" }, { "lessThan": "4cddb0f15ea9c62f81b4889ea69a99368cc63a86", "status": "affected", "version": "4d18e3ddf427d93a2895a1c9d61477e1f1726cad", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/ethtool/pse-pd.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: pse-pd: Fix possible null-deref\n\nFix a possible null dereference when a PSE supports both c33 and PoDL, but\nonly one of the netlink attributes is specified. The c33 or PoDL PSE\ncapabilities are already validated in the ethnl_set_pse_validate() call." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:50.052Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e187690b125a297499eadeec53c32c5ed6d7436a" }, { "url": "https://git.kernel.org/stable/c/4cddb0f15ea9c62f81b4889ea69a99368cc63a86" } ], "title": "net: ethtool: pse-pd: Fix possible null-deref", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43836", "datePublished": "2024-08-17T09:21:53.082Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:50.052Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42286
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: validate nvme_local_port correctly
The driver load failed with error message,
qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef
and with a kernel crash,
BUG: unable to handle kernel NULL pointer dereference at 0000000000000070
Workqueue: events_unbound qla_register_fcport_fn [qla2xxx]
RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc]
RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000
RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000
RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030
R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4
R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8
FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0
Call Trace:
qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx]
? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx]
qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx]
qla_register_fcport_fn+0x54/0xc0 [qla2xxx]
Exit the qla_nvme_register_remote() function when qla_nvme_register_hba()
fails and correctly validate nvme_local_port.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42286", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:20.265559Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:30.367Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/scsi/qla2xxx/qla_nvme.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "549aac9655320c9b245a24271b204668c5d40430", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "e1f010844443c389bc552884ac5cfa47de34d54c", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "a3ab508a4853a9f5ae25a7816a4889f09938f63c", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "cde43031df533751b4ead37d173922feee2f550f", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "7cec2c3bfe84539c415f5e16f989228eba1d2f1e", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "f6be298cc1042f24d521197af29c7c4eb95af4d5", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "3eac973eb5cb2b874b3918f924798afc5affd46b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "eb1d4ce2609584eeb7694866f34d4b213caa3af9", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/scsi/qla2xxx/qla_nvme.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: validate nvme_local_port correctly\n\nThe driver load failed with error message,\n\nqla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef\n\nand with a kernel crash,\n\n\tBUG: unable to handle kernel NULL pointer dereference at 0000000000000070\n\tWorkqueue: events_unbound qla_register_fcport_fn [qla2xxx]\n\tRIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc]\n\tRSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282\n\tRAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000\n\tRDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000\n\tRBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030\n\tR10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4\n\tR13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8\n\tFS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000\n\tCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\tCR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0\n\tCall Trace:\n\tqla_nvme_register_remote+0xeb/0x1f0 [qla2xxx]\n\t? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx]\n\tqla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx]\n\tqla_register_fcport_fn+0x54/0xc0 [qla2xxx]\n\nExit the qla_nvme_register_remote() function when qla_nvme_register_hba()\nfails and correctly validate nvme_local_port." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:39.517Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/549aac9655320c9b245a24271b204668c5d40430" }, { "url": "https://git.kernel.org/stable/c/e1f010844443c389bc552884ac5cfa47de34d54c" }, { "url": "https://git.kernel.org/stable/c/a3ab508a4853a9f5ae25a7816a4889f09938f63c" }, { "url": "https://git.kernel.org/stable/c/cde43031df533751b4ead37d173922feee2f550f" }, { "url": "https://git.kernel.org/stable/c/7cec2c3bfe84539c415f5e16f989228eba1d2f1e" }, { "url": "https://git.kernel.org/stable/c/f6be298cc1042f24d521197af29c7c4eb95af4d5" }, { "url": "https://git.kernel.org/stable/c/3eac973eb5cb2b874b3918f924798afc5affd46b" }, { "url": "https://git.kernel.org/stable/c/eb1d4ce2609584eeb7694866f34d4b213caa3af9" } ], "title": "scsi: qla2xxx: validate nvme_local_port correctly", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42286", "datePublished": "2024-08-17T09:08:52.036Z", "dateReserved": "2024-07-30T07:40:12.262Z", "dateUpdated": "2024-12-19T09:15:39.517Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52889
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 08:27
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: Fix null pointer deref when receiving skb during sock creation
The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.
BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
<IRQ>
? __die+0x23/0x70
? page_fault_oops+0x171/0x4e0
? exc_page_fault+0x7f/0x180
? asm_exc_page_fault+0x26/0x30
? aa_label_next_confined+0xb/0x40
apparmor_secmark_check+0xec/0x330
security_sock_rcv_skb+0x35/0x50
sk_filter_trim_cap+0x47/0x250
sock_queue_rcv_skb_reason+0x20/0x60
raw_rcv+0x13c/0x210
raw_local_deliver+0x1f3/0x250
ip_protocol_deliver_rcu+0x4f/0x2f0
ip_local_deliver_finish+0x76/0xa0
__netif_receive_skb_one_core+0x89/0xa0
netif_receive_skb+0x119/0x170
? __netdev_alloc_skb+0x3d/0x140
vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
__napi_poll+0x28/0x1b0
net_rx_action+0x2a4/0x380
__do_softirq+0xd1/0x2c8
__irq_exit_rcu+0xbb/0xf0
common_interrupt+0x86/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
? __pfx_apparmor_socket_post_create+0x10/0x10
security_socket_post_create+0x4b/0x80
__sock_create+0x176/0x1f0
__sys_socket+0x89/0x100
__x64_sys_socket+0x17/0x20
do_syscall_64+0x5d/0x90
? do_syscall_64+0x6c/0x90
? do_syscall_64+0x6c/0x90
? do_syscall_64+0x6c/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f Version: ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f Version: ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f Version: ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f Version: ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f Version: ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f Version: ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52889", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:55.468269Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:31.755Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "security/apparmor/lsm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "0abe35bc48d4ec80424b1f4b3560c0e082cbd5c1", "status": "affected", "version": "ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f", "versionType": "git" }, { "lessThan": "347dcb84a4874b5fb375092c08d8cc4069b94f81", "status": "affected", "version": "ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f", "versionType": "git" }, { "lessThan": "290a6b88e8c19b6636ed1acc733d1458206f7697", "status": "affected", "version": "ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f", "versionType": "git" }, { "lessThan": "ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2", "status": "affected", "version": "ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f", "versionType": "git" }, { "lessThan": "6c920754f62cefc63fccdc38a062c7c3452e2961", "status": "affected", "version": "ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f", "versionType": "git" }, { "lessThan": "46c17ead5b7389e22e7dc9903fd0ba865d05bda2", "status": "affected", "version": "ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f", "versionType": "git" }, { "lessThan": "fce09ea314505a52f2436397608fa0a5d0934fb1", "status": "affected", "version": "ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "security/apparmor/lsm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.20" }, { "lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix null pointer deref when receiving skb during sock creation\n\nThe panic below is observed when receiving ICMP packets with secmark set\nwhile an ICMP raw socket is being created. SK_CTX(sk)-\u003elabel is updated\nin apparmor_socket_post_create(), but the packet is delivered to the\nsocket before that, causing the null pointer dereference.\nDrop the packet if label context is not set.\n\n BUG: kernel NULL pointer dereference, address: 000000000000004c\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df\n Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020\n RIP: 0010:aa_label_next_confined+0xb/0x40\n Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 \u003c8b\u003e 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2\n RSP: 0018:ffffa92940003b08 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e\n RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002\n R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400\n R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000\n FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0\n PKRU: 55555554\n Call Trace:\n \u003cIRQ\u003e\n ? __die+0x23/0x70\n ? page_fault_oops+0x171/0x4e0\n ? exc_page_fault+0x7f/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? aa_label_next_confined+0xb/0x40\n apparmor_secmark_check+0xec/0x330\n security_sock_rcv_skb+0x35/0x50\n sk_filter_trim_cap+0x47/0x250\n sock_queue_rcv_skb_reason+0x20/0x60\n raw_rcv+0x13c/0x210\n raw_local_deliver+0x1f3/0x250\n ip_protocol_deliver_rcu+0x4f/0x2f0\n ip_local_deliver_finish+0x76/0xa0\n __netif_receive_skb_one_core+0x89/0xa0\n netif_receive_skb+0x119/0x170\n ? __netdev_alloc_skb+0x3d/0x140\n vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]\n vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]\n __napi_poll+0x28/0x1b0\n net_rx_action+0x2a4/0x380\n __do_softirq+0xd1/0x2c8\n __irq_exit_rcu+0xbb/0xf0\n common_interrupt+0x86/0xa0\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_common_interrupt+0x26/0x40\n RIP: 0010:apparmor_socket_post_create+0xb/0x200\n Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 \u003c55\u003e 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48\n RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286\n RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001\n RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740\n RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\n R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003\n R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748\n ? __pfx_apparmor_socket_post_create+0x10/0x10\n security_socket_post_create+0x4b/0x80\n __sock_create+0x176/0x1f0\n __sys_socket+0x89/0x100\n __x64_sys_socket+0x17/0x20\n do_syscall_64+0x5d/0x90\n ? do_syscall_64+0x6c/0x90\n ? do_syscall_64+0x6c/0x90\n ? do_syscall_64+0x6c/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc" } ], "providerMetadata": { "dateUpdated": "2024-12-19T08:27:58.893Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/0abe35bc48d4ec80424b1f4b3560c0e082cbd5c1" }, { "url": "https://git.kernel.org/stable/c/347dcb84a4874b5fb375092c08d8cc4069b94f81" }, { "url": "https://git.kernel.org/stable/c/290a6b88e8c19b6636ed1acc733d1458206f7697" }, { "url": "https://git.kernel.org/stable/c/ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2" }, { "url": "https://git.kernel.org/stable/c/6c920754f62cefc63fccdc38a062c7c3452e2961" }, { "url": "https://git.kernel.org/stable/c/46c17ead5b7389e22e7dc9903fd0ba865d05bda2" }, { "url": "https://git.kernel.org/stable/c/fce09ea314505a52f2436397608fa0a5d0934fb1" } ], "title": "apparmor: Fix null pointer deref when receiving skb during sock creation", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52889", "datePublished": "2024-08-17T09:08:43.973Z", "dateReserved": "2024-05-21T15:35:00.782Z", "dateUpdated": "2024-12-19T08:27:58.893Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42276
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: add missing condition check for existence of mapped data
nvme_map_data() is called when request has physical segments, hence
the nvme_unmap_data() should have same condition to avoid dereference.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 4aedb705437f6f98b45f45c394e6803ca67abd33 Version: 4aedb705437f6f98b45f45c394e6803ca67abd33 Version: 4aedb705437f6f98b45f45c394e6803ca67abd33 Version: 4aedb705437f6f98b45f45c394e6803ca67abd33 Version: 4aedb705437f6f98b45f45c394e6803ca67abd33 Version: 4aedb705437f6f98b45f45c394e6803ca67abd33 Version: 4aedb705437f6f98b45f45c394e6803ca67abd33 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42276", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:52.374763Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:31.619Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/nvme/host/pci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "3f8ec1d6b0ebd8268307d52be8301973fa5a01ec", "status": "affected", "version": "4aedb705437f6f98b45f45c394e6803ca67abd33", "versionType": "git" }, { "lessThan": "be23ae63080e0bf9e246ab20207200bca6585eba", "status": "affected", "version": "4aedb705437f6f98b45f45c394e6803ca67abd33", "versionType": "git" }, { "lessThan": "7cc1f4cd90a00b6191cb8cda2d1302fdce59361c", "status": "affected", "version": "4aedb705437f6f98b45f45c394e6803ca67abd33", "versionType": "git" }, { "lessThan": "d135c3352f7c947a922da93c8e763ee6bc208b64", "status": "affected", "version": "4aedb705437f6f98b45f45c394e6803ca67abd33", "versionType": "git" }, { "lessThan": "77848b379e9f85a08048a2c8b3b4a7e8396f5f83", "status": "affected", "version": "4aedb705437f6f98b45f45c394e6803ca67abd33", "versionType": "git" }, { "lessThan": "70100fe721840bf6d8e5abd25b8bffe4d2e049b7", "status": "affected", "version": "4aedb705437f6f98b45f45c394e6803ca67abd33", "versionType": "git" }, { "lessThan": "c31fad1470389666ac7169fe43aa65bf5b7e2cfd", "status": "affected", "version": "4aedb705437f6f98b45f45c394e6803ca67abd33", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/nvme/host/pci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.2" }, { "lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should have same condition to avoid dereference." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:27.975Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec" }, { "url": "https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba" }, { "url": "https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c" }, { "url": "https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64" }, { "url": "https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83" }, { "url": "https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7" }, { "url": "https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd" } ], "title": "nvme-pci: add missing condition check for existence of mapped data", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42276", "datePublished": "2024-08-17T09:08:44.694Z", "dateReserved": "2024-07-30T07:40:12.261Z", "dateUpdated": "2024-12-19T09:15:27.975Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43824
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
Instead of getting the epc_features from pci_epc_get_features() API, use
the cached pci_epf_test::epc_features value to avoid the NULL check. Since
the NULL check is already performed in pci_epf_test_bind(), having one more
check in pci_epf_test_core_init() is redundant and it is not possible to
hit the NULL pointer dereference.
Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier"
flag"), 'epc_features' got dereferenced without the NULL check, leading to
the following false positive Smatch warning:
drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747)
Thus, remove the redundant NULL check and also use the epc_features::
{msix_capable/msi_capable} flags directly to avoid local variables.
[kwilczynski: commit log]
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43824", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:51.186456Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:24.560Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/pci/endpoint/functions/pci-epf-test.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "af4ad016abb1632ff7ee598a6037952b495e5b80", "status": "affected", "version": "5e50ee27d4a52a817ab152128c48690ec7c5cdf1", "versionType": "git" }, { "lessThan": "5a5095a8bd1bd349cce1c879e5e44407a34dda8a", "status": "affected", "version": "5e50ee27d4a52a817ab152128c48690ec7c5cdf1", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/pci/endpoint/functions/pci-epf-test.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.7" }, { "lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-test: Make use of cached \u0027epc_features\u0027 in pci_epf_test_core_init()\n\nInstead of getting the epc_features from pci_epc_get_features() API, use\nthe cached pci_epf_test::epc_features value to avoid the NULL check. Since\nthe NULL check is already performed in pci_epf_test_bind(), having one more\ncheck in pci_epf_test_core_init() is redundant and it is not possible to\nhit the NULL pointer dereference.\n\nAlso with commit a01e7214bef9 (\"PCI: endpoint: Remove \"core_init_notifier\"\nflag\"), \u0027epc_features\u0027 got dereferenced without the NULL check, leading to\nthe following false positive Smatch warning:\n\n drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed \u0027epc_features\u0027 could be null (see line 747)\n\nThus, remove the redundant NULL check and also use the epc_features::\n{msix_capable/msi_capable} flags directly to avoid local variables.\n\n[kwilczynski: commit log]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:35.372Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/af4ad016abb1632ff7ee598a6037952b495e5b80" }, { "url": "https://git.kernel.org/stable/c/5a5095a8bd1bd349cce1c879e5e44407a34dda8a" } ], "title": "PCI: endpoint: pci-epf-test: Make use of cached \u0027epc_features\u0027 in pci_epf_test_core_init()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43824", "datePublished": "2024-08-17T09:21:44.483Z", "dateReserved": "2024-08-17T09:11:59.272Z", "dateUpdated": "2024-12-19T09:16:35.372Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43827
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Add null check before access structs
In enable_phantom_plane, we should better check null pointer before
accessing various structs.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43827", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:41.679499Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:24.168Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "081ff4c0ef1884ae55f7adb8944efd22e22d8724", "status": "affected", "version": "09a4ec5da92c84952db117f0d576fdd8368c873a", "versionType": "git" }, { "lessThan": "c96140000915b610d86f941450e15ca552de154a", "status": "affected", "version": "09a4ec5da92c84952db117f0d576fdd8368c873a", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check before access structs\n\nIn enable_phantom_plane, we should better check null pointer before\naccessing various structs." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:38.839Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/081ff4c0ef1884ae55f7adb8944efd22e22d8724" }, { "url": "https://git.kernel.org/stable/c/c96140000915b610d86f941450e15ca552de154a" } ], "title": "drm/amd/display: Add null check before access structs", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43827", "datePublished": "2024-08-17T09:21:46.698Z", "dateReserved": "2024-08-17T09:11:59.273Z", "dateUpdated": "2024-12-19T09:16:38.839Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43837
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT
When loading a EXT program without specifying `attr->attach_prog_fd`,
the `prog->aux->dst_prog` will be null. At this time, calling
resolve_prog_type() anywhere will result in a null pointer dereference.
Example stack trace:
[ 8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
[ 8.108262] Mem abort info:
[ 8.108384] ESR = 0x0000000096000004
[ 8.108547] EC = 0x25: DABT (current EL), IL = 32 bits
[ 8.108722] SET = 0, FnV = 0
[ 8.108827] EA = 0, S1PTW = 0
[ 8.108939] FSC = 0x04: level 0 translation fault
[ 8.109102] Data abort info:
[ 8.109203] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[ 8.109399] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 8.109614] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000
[ 8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000
[ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[ 8.112783] Modules linked in:
[ 8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1
[ 8.113230] Hardware name: linux,dummy-virt (DT)
[ 8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 8.113429] pc : may_access_direct_pkt_data+0x24/0xa0
[ 8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8
[ 8.113798] sp : ffff80008283b9f0
[ 8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001
[ 8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000
[ 8.113897] x23: ffff0000c1134000 x22: 000000000001864f x21: ffff0000c1138000
[ 8.113912] x20: 0000000000000001 x19: ffff0000c12b8000 x18: ffffffffffffffff
[ 8.113929] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720
[ 8.113944] x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720
[ 8.113958] x11: 0720072007200720 x10: 0000000000f9fca4 x9 : ffff80008021f4e4
[ 8.113991] x8 : 0101010101010101 x7 : 746f72705f6d656d x6 : 000000001e0e0f5f
[ 8.114006] x5 : 000000000001864f x4 : ffff0000c12b8000 x3 : 000000000000001c
[ 8.114020] x2 : 0000000000000002 x1 : 0000000000000000 x0 : 0000000000000000
[ 8.114126] Call trace:
[ 8.114159] may_access_direct_pkt_data+0x24/0xa0
[ 8.114202] bpf_check+0x3bc/0x28c0
[ 8.114214] bpf_prog_load+0x658/0xa58
[ 8.114227] __sys_bpf+0xc50/0x2250
[ 8.114240] __arm64_sys_bpf+0x28/0x40
[ 8.114254] invoke_syscall.constprop.0+0x54/0xf0
[ 8.114273] do_el0_svc+0x4c/0xd8
[ 8.114289] el0_svc+0x3c/0x140
[ 8.114305] el0t_64_sync_handler+0x134/0x150
[ 8.114331] el0t_64_sync+0x168/0x170
[ 8.114477] Code: 7100707f 54000081 f9401c00 f9403800 (b9400403)
[ 8.118672] ---[ end trace 0000000000000000 ]---
One way to fix it is by forcing `attach_prog_fd` non-empty when
bpf_prog_load(). But this will lead to `libbpf_probe_bpf_prog_type`
API broken which use verifier log to probe prog type and will log
nothing if we reject invalid EXT prog before bpf_check().
Another way is by adding null check in resolve_prog_type().
The issue was introduced by commit 4a9c7bbe2ed4 ("bpf: Resolve to
prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") which wanted
to correct type resolution for BPF_PROG_TYPE_TRACING programs. Before
that, the type resolution of BPF_PROG_TYPE_EXT prog actually follows
the logic below:
prog->aux->dst_prog ? prog->aux->dst_prog->type : prog->type;
It implies that when EXT program is not yet attached to `dst_prog`,
the prog type should be EXT itself. This code worked fine in the past.
So just keep using it.
Fix this by returning `prog->type` for BPF_PROG_TYPE_EXT if `dst_prog`
is not present in resolve_prog_type().
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43837", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:08.802166Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:23.037Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "include/linux/bpf_verifier.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "fcac5feb06f31ee4c88bca9bf98d8bc3ca7d2615", "status": "affected", "version": "4a9c7bbe2ed4d2b240674b1fb606c41d3940c412", "versionType": "git" }, { "lessThan": "9d40fd516aeae6779e3c84c6b96700ca76285847", "status": "affected", "version": "4a9c7bbe2ed4d2b240674b1fb606c41d3940c412", "versionType": "git" }, { "lessThan": "b29a880bb145e1f1c1df5ab88ed26b1495ff9f09", "status": "affected", "version": "4a9c7bbe2ed4d2b240674b1fb606c41d3940c412", "versionType": "git" }, { "lessThan": "f7866c35873377313ff94398f17d425b28b71de1", "status": "affected", "version": "4a9c7bbe2ed4d2b240674b1fb606c41d3940c412", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "include/linux/bpf_verifier.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.18" }, { "lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT\n\nWhen loading a EXT program without specifying `attr-\u003eattach_prog_fd`,\nthe `prog-\u003eaux-\u003edst_prog` will be null. At this time, calling\nresolve_prog_type() anywhere will result in a null pointer dereference.\n\nExample stack trace:\n\n[ 8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004\n[ 8.108262] Mem abort info:\n[ 8.108384] ESR = 0x0000000096000004\n[ 8.108547] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 8.108722] SET = 0, FnV = 0\n[ 8.108827] EA = 0, S1PTW = 0\n[ 8.108939] FSC = 0x04: level 0 translation fault\n[ 8.109102] Data abort info:\n[ 8.109203] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[ 8.109399] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 8.109614] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000\n[ 8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000\n[ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[ 8.112783] Modules linked in:\n[ 8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1\n[ 8.113230] Hardware name: linux,dummy-virt (DT)\n[ 8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 8.113429] pc : may_access_direct_pkt_data+0x24/0xa0\n[ 8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8\n[ 8.113798] sp : ffff80008283b9f0\n[ 8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001\n[ 8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000\n[ 8.113897] x23: ffff0000c1134000 x22: 000000000001864f x21: ffff0000c1138000\n[ 8.113912] x20: 0000000000000001 x19: ffff0000c12b8000 x18: ffffffffffffffff\n[ 8.113929] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720\n[ 8.113944] x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720\n[ 8.113958] x11: 0720072007200720 x10: 0000000000f9fca4 x9 : ffff80008021f4e4\n[ 8.113991] x8 : 0101010101010101 x7 : 746f72705f6d656d x6 : 000000001e0e0f5f\n[ 8.114006] x5 : 000000000001864f x4 : ffff0000c12b8000 x3 : 000000000000001c\n[ 8.114020] x2 : 0000000000000002 x1 : 0000000000000000 x0 : 0000000000000000\n[ 8.114126] Call trace:\n[ 8.114159] may_access_direct_pkt_data+0x24/0xa0\n[ 8.114202] bpf_check+0x3bc/0x28c0\n[ 8.114214] bpf_prog_load+0x658/0xa58\n[ 8.114227] __sys_bpf+0xc50/0x2250\n[ 8.114240] __arm64_sys_bpf+0x28/0x40\n[ 8.114254] invoke_syscall.constprop.0+0x54/0xf0\n[ 8.114273] do_el0_svc+0x4c/0xd8\n[ 8.114289] el0_svc+0x3c/0x140\n[ 8.114305] el0t_64_sync_handler+0x134/0x150\n[ 8.114331] el0t_64_sync+0x168/0x170\n[ 8.114477] Code: 7100707f 54000081 f9401c00 f9403800 (b9400403)\n[ 8.118672] ---[ end trace 0000000000000000 ]---\n\nOne way to fix it is by forcing `attach_prog_fd` non-empty when\nbpf_prog_load(). But this will lead to `libbpf_probe_bpf_prog_type`\nAPI broken which use verifier log to probe prog type and will log\nnothing if we reject invalid EXT prog before bpf_check().\n\nAnother way is by adding null check in resolve_prog_type().\n\nThe issue was introduced by commit 4a9c7bbe2ed4 (\"bpf: Resolve to\nprog-\u003eaux-\u003edst_prog-\u003etype only for BPF_PROG_TYPE_EXT\") which wanted\nto correct type resolution for BPF_PROG_TYPE_TRACING programs. Before\nthat, the type resolution of BPF_PROG_TYPE_EXT prog actually follows\nthe logic below:\n\n prog-\u003eaux-\u003edst_prog ? prog-\u003eaux-\u003edst_prog-\u003etype : prog-\u003etype;\n\nIt implies that when EXT program is not yet attached to `dst_prog`,\nthe prog type should be EXT itself. This code worked fine in the past.\nSo just keep using it.\n\nFix this by returning `prog-\u003etype` for BPF_PROG_TYPE_EXT if `dst_prog`\nis not present in resolve_prog_type()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:51.217Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/fcac5feb06f31ee4c88bca9bf98d8bc3ca7d2615" }, { "url": "https://git.kernel.org/stable/c/9d40fd516aeae6779e3c84c6b96700ca76285847" }, { "url": "https://git.kernel.org/stable/c/b29a880bb145e1f1c1df5ab88ed26b1495ff9f09" }, { "url": "https://git.kernel.org/stable/c/f7866c35873377313ff94398f17d425b28b71de1" } ], "title": "bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43837", "datePublished": "2024-08-17T09:21:53.763Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:51.217Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43858
Vulnerability from cvelistv5
Published
2024-08-17 09:24
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
jfs: Fix array-index-out-of-bounds in diFree
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43858", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:01.781226Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:20.278Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/jfs/jfs_imap.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "55b732c8b09b41148eaab2fa8e31b0af47671e00", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "9b3a4345957f5372041bc4f59de322f62653e862", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "538a27c8048f081a5ddd286f886eb986fbbc7f80", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "63f7fdf733add82f126ea00e2e48f6eba15ac4b9", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "8d8f9a477de0d7962342eedf2a599215b7c63d28", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "ff14eadc278663cac69d57d3ca7fb2f394e1f8a7", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "6aa6892a90a5a7fabffe5692ab9f06a7a46c6e42", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "f73f969b2eb39ad8056f6c7f3a295fa2f85e313a", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/jfs/jfs_imap.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.12" }, { "lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix array-index-out-of-bounds in diFree" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:16.894Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/55b732c8b09b41148eaab2fa8e31b0af47671e00" }, { "url": "https://git.kernel.org/stable/c/9b3a4345957f5372041bc4f59de322f62653e862" }, { "url": "https://git.kernel.org/stable/c/538a27c8048f081a5ddd286f886eb986fbbc7f80" }, { "url": "https://git.kernel.org/stable/c/63f7fdf733add82f126ea00e2e48f6eba15ac4b9" }, { "url": "https://git.kernel.org/stable/c/8d8f9a477de0d7962342eedf2a599215b7c63d28" }, { "url": "https://git.kernel.org/stable/c/ff14eadc278663cac69d57d3ca7fb2f394e1f8a7" }, { "url": "https://git.kernel.org/stable/c/6aa6892a90a5a7fabffe5692ab9f06a7a46c6e42" }, { "url": "https://git.kernel.org/stable/c/f73f969b2eb39ad8056f6c7f3a295fa2f85e313a" } ], "title": "jfs: Fix array-index-out-of-bounds in diFree", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43858", "datePublished": "2024-08-17T09:24:27.976Z", "dateReserved": "2024-08-17T09:11:59.279Z", "dateUpdated": "2024-12-19T09:17:16.894Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43850
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove
The following warning is seen during bwmon_remove due to refcount
imbalance, fix this by releasing the OPPs after use.
Logs:
WARNING: at drivers/opp/core.c:1640 _opp_table_kref_release+0x150/0x158
Hardware name: Qualcomm Technologies, Inc. X1E80100 CRD (DT)
...
Call trace:
_opp_table_kref_release+0x150/0x158
dev_pm_opp_remove_table+0x100/0x1b4
devm_pm_opp_of_table_release+0x10/0x1c
devm_action_release+0x14/0x20
devres_release_all+0xa4/0x104
device_unbind_cleanup+0x18/0x60
device_release_driver_internal+0x1ec/0x228
driver_detach+0x50/0x98
bus_remove_driver+0x6c/0xbc
driver_unregister+0x30/0x60
platform_driver_unregister+0x14/0x20
bwmon_driver_exit+0x18/0x524 [icc_bwmon]
__arm64_sys_delete_module+0x184/0x264
invoke_syscall+0x48/0x118
el0_svc_common.constprop.0+0xc8/0xe8
do_el0_svc+0x20/0x2c
el0_svc+0x34/0xdc
el0t_64_sync_handler+0x13c/0x158
el0t_64_sync+0x190/0x194
--[ end trace 0000000000000000 ]---
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43850", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:27.286614Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:21.310Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/soc/qcom/icc-bwmon.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "aad41f4c169bcb800ae88123799bdf8cdec3d366", "status": "affected", "version": "b9c2ae6cac403dee3195fda9eb28d8ee733b225b", "versionType": "git" }, { "lessThan": "4100d4d019f8e140be1d4d3a9d8d93c1285f5d1c", "status": "affected", "version": "b9c2ae6cac403dee3195fda9eb28d8ee733b225b", "versionType": "git" }, { "lessThan": "24086640ab39396eb1a92d1cb1cd2f31b2677c52", "status": "affected", "version": "b9c2ae6cac403dee3195fda9eb28d8ee733b225b", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/soc/qcom/icc-bwmon.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove\n\nThe following warning is seen during bwmon_remove due to refcount\nimbalance, fix this by releasing the OPPs after use.\n\nLogs:\nWARNING: at drivers/opp/core.c:1640 _opp_table_kref_release+0x150/0x158\nHardware name: Qualcomm Technologies, Inc. X1E80100 CRD (DT)\n...\nCall trace:\n_opp_table_kref_release+0x150/0x158\ndev_pm_opp_remove_table+0x100/0x1b4\ndevm_pm_opp_of_table_release+0x10/0x1c\ndevm_action_release+0x14/0x20\ndevres_release_all+0xa4/0x104\ndevice_unbind_cleanup+0x18/0x60\ndevice_release_driver_internal+0x1ec/0x228\ndriver_detach+0x50/0x98\nbus_remove_driver+0x6c/0xbc\ndriver_unregister+0x30/0x60\nplatform_driver_unregister+0x14/0x20\nbwmon_driver_exit+0x18/0x524 [icc_bwmon]\n__arm64_sys_delete_module+0x184/0x264\ninvoke_syscall+0x48/0x118\nel0_svc_common.constprop.0+0xc8/0xe8\ndo_el0_svc+0x20/0x2c\nel0_svc+0x34/0xdc\nel0t_64_sync_handler+0x13c/0x158\nel0t_64_sync+0x190/0x194\n--[ end trace 0000000000000000 ]---" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:07.624Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/aad41f4c169bcb800ae88123799bdf8cdec3d366" }, { "url": "https://git.kernel.org/stable/c/4100d4d019f8e140be1d4d3a9d8d93c1285f5d1c" }, { "url": "https://git.kernel.org/stable/c/24086640ab39396eb1a92d1cb1cd2f31b2677c52" } ], "title": "soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43850", "datePublished": "2024-08-17T09:22:03.457Z", "dateReserved": "2024-08-17T09:11:59.276Z", "dateUpdated": "2024-12-19T09:17:07.624Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42275
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/client: Fix error code in drm_client_buffer_vmap_local()
This function accidentally returns zero/success on the failure path.
It leads to locking issues and an uninitialized *map_copy in the
caller.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42275", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:58.568874Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:31.871Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/drm_client.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c0f412961653237f52e2f16ee8747fb330bcf074", "status": "affected", "version": "b4b0193e83cb987143583e2b4011b35331f429bd", "versionType": "git" }, { "lessThan": "b5fbf924f125ba3638cfdc21c0515eb7e76264ca", "status": "affected", "version": "b4b0193e83cb987143583e2b4011b35331f429bd", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/drm_client.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Fix error code in drm_client_buffer_vmap_local()\n\nThis function accidentally returns zero/success on the failure path.\nIt leads to locking issues and an uninitialized *map_copy in the\ncaller." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:26.814Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c0f412961653237f52e2f16ee8747fb330bcf074" }, { "url": "https://git.kernel.org/stable/c/b5fbf924f125ba3638cfdc21c0515eb7e76264ca" } ], "title": "drm/client: Fix error code in drm_client_buffer_vmap_local()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42275", "datePublished": "2024-08-17T08:54:28.902Z", "dateReserved": "2024-07-30T07:40:12.261Z", "dateUpdated": "2024-12-19T09:15:26.814Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43820
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
rm-raid devices will occasionally trigger the following warning when
being resumed after a table load because DM_RECOVERY_RUNNING is set:
WARNING: CPU: 7 PID: 5660 at drivers/md/dm-raid.c:4105 raid_resume+0xee/0x100 [dm_raid]
The failing check is:
WARN_ON_ONCE(test_bit(MD_RECOVERY_RUNNING, &mddev->recovery));
This check is designed to make sure that the sync thread isn't
registered, but md_check_recovery can set MD_RECOVERY_RUNNING without
the sync_thread ever getting registered. Instead of checking if
MD_RECOVERY_RUNNING is set, check if sync_thread is non-NULL.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43820", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:03.715774Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:25.056Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/md/dm-raid.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "a5c15a78c0e1631b7df822b56e8b6424e4d1ca3e", "status": "affected", "version": "16c4770c75b1223998adbeb7286f9a15c65fba73", "versionType": "git" }, { "lessThan": "3199a34bfaf7561410e0be1e33a61eba870768fc", "status": "affected", "version": "16c4770c75b1223998adbeb7286f9a15c65fba73", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/md/dm-raid.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.9" }, { "lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume\n\nrm-raid devices will occasionally trigger the following warning when\nbeing resumed after a table load because DM_RECOVERY_RUNNING is set:\n\nWARNING: CPU: 7 PID: 5660 at drivers/md/dm-raid.c:4105 raid_resume+0xee/0x100 [dm_raid]\n\nThe failing check is:\nWARN_ON_ONCE(test_bit(MD_RECOVERY_RUNNING, \u0026mddev-\u003erecovery));\n\nThis check is designed to make sure that the sync thread isn\u0027t\nregistered, but md_check_recovery can set MD_RECOVERY_RUNNING without\nthe sync_thread ever getting registered. Instead of checking if\nMD_RECOVERY_RUNNING is set, check if sync_thread is non-NULL." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:30.193Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/a5c15a78c0e1631b7df822b56e8b6424e4d1ca3e" }, { "url": "https://git.kernel.org/stable/c/3199a34bfaf7561410e0be1e33a61eba870768fc" } ], "title": "dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43820", "datePublished": "2024-08-17T09:21:41.674Z", "dateReserved": "2024-08-17T09:11:59.271Z", "dateUpdated": "2024-12-19T09:16:30.193Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43833
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: v4l: async: Fix NULL pointer dereference in adding ancillary links
In v4l2_async_create_ancillary_links(), ancillary links are created for
lens and flash sub-devices. These are sub-device to sub-device links and
if the async notifier is related to a V4L2 device, the source sub-device
of the ancillary link is NULL, leading to a NULL pointer dereference.
Check the notifier's sd field is non-NULL in
v4l2_async_create_ancillary_links().
[Sakari Ailus: Reword the subject and commit messages slightly.]
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43833", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:21.590404Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:04.705Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/media/v4l2-core/v4l2-async.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "fe0f92fd5320b393e44ca210805e653ea90cc982", "status": "affected", "version": "aa4faf6eb27132532d5a133d9241254c16d4bafa", "versionType": "git" }, { "lessThan": "249212ceb4187783af3801c57b92a5a25d410621", "status": "affected", "version": "aa4faf6eb27132532d5a133d9241254c16d4bafa", "versionType": "git" }, { "lessThan": "b87e28050d9b0959de24574d587825cfab2f13fb", "status": "affected", "version": "aa4faf6eb27132532d5a133d9241254c16d4bafa", "versionType": "git" }, { "lessThan": "9b4667ea67854f0b116fe22ad11ef5628c5b5b5f", "status": "affected", "version": "aa4faf6eb27132532d5a133d9241254c16d4bafa", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/media/v4l2-core/v4l2-async.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.19" }, { "lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l: async: Fix NULL pointer dereference in adding ancillary links\n\nIn v4l2_async_create_ancillary_links(), ancillary links are created for\nlens and flash sub-devices. These are sub-device to sub-device links and\nif the async notifier is related to a V4L2 device, the source sub-device\nof the ancillary link is NULL, leading to a NULL pointer dereference.\nCheck the notifier\u0027s sd field is non-NULL in\nv4l2_async_create_ancillary_links().\n\n[Sakari Ailus: Reword the subject and commit messages slightly.]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:46.250Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/fe0f92fd5320b393e44ca210805e653ea90cc982" }, { "url": "https://git.kernel.org/stable/c/249212ceb4187783af3801c57b92a5a25d410621" }, { "url": "https://git.kernel.org/stable/c/b87e28050d9b0959de24574d587825cfab2f13fb" }, { "url": "https://git.kernel.org/stable/c/9b4667ea67854f0b116fe22ad11ef5628c5b5b5f" } ], "title": "media: v4l: async: Fix NULL pointer dereference in adding ancillary links", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43833", "datePublished": "2024-08-17T09:21:50.890Z", "dateReserved": "2024-08-17T09:11:59.273Z", "dateUpdated": "2024-12-19T09:16:46.250Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43845
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
udf: Fix bogus checksum computation in udf_rename()
Syzbot reports uninitialized memory access in udf_rename() when updating
checksum of '..' directory entry of a moved directory. This is indeed
true as we pass on-stack diriter.fi to the udf_update_tag() and because
that has only struct fileIdentDesc included in it and not the impUse or
name fields, the checksumming function is going to checksum random stack
contents beyond the end of the structure. This is actually harmless
because the following udf_fiiter_write_fi() will recompute the checksum
from on-disk buffers where everything is properly included. So all that
is needed is just removing the bogus calculation.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 626860c470ff88e5f7f22a282efd1bfe953a1b54 Version: 9616d00140a1cdf0bfa557019b36923dc7796942 Version: e9109a92d2a95889498bed3719cd2318892171a2 Version: e9109a92d2a95889498bed3719cd2318892171a2 Version: e9109a92d2a95889498bed3719cd2318892171a2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43845", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:43.116457Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:22.040Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/udf/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "9c439311c13fc6faab1921441165c9b8b500c83b", "status": "affected", "version": "626860c470ff88e5f7f22a282efd1bfe953a1b54", "versionType": "git" }, { "lessThan": "c996b570305e7a6910c2ce4cdcd4c22757ffe241", "status": "affected", "version": "9616d00140a1cdf0bfa557019b36923dc7796942", "versionType": "git" }, { "lessThan": "fe2ead240c31e8d158713beca9d0681a6e6a53ab", "status": "affected", "version": "e9109a92d2a95889498bed3719cd2318892171a2", "versionType": "git" }, { "lessThan": "40d7b3ed52449d36143bab8d3e70926aa61a60f4", "status": "affected", "version": "e9109a92d2a95889498bed3719cd2318892171a2", "versionType": "git" }, { "lessThan": "27ab33854873e6fb958cb074681a0107cc2ecc4c", "status": "affected", "version": "e9109a92d2a95889498bed3719cd2318892171a2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/udf/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.107", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix bogus checksum computation in udf_rename()\n\nSyzbot reports uninitialized memory access in udf_rename() when updating\nchecksum of \u0027..\u0027 directory entry of a moved directory. This is indeed\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\nthat has only struct fileIdentDesc included in it and not the impUse or\nname fields, the checksumming function is going to checksum random stack\ncontents beyond the end of the structure. This is actually harmless\nbecause the following udf_fiiter_write_fi() will recompute the checksum\nfrom on-disk buffers where everything is properly included. So all that\nis needed is just removing the bogus calculation." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:01.682Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/9c439311c13fc6faab1921441165c9b8b500c83b" }, { "url": "https://git.kernel.org/stable/c/c996b570305e7a6910c2ce4cdcd4c22757ffe241" }, { "url": "https://git.kernel.org/stable/c/fe2ead240c31e8d158713beca9d0681a6e6a53ab" }, { "url": "https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4" }, { "url": "https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c" } ], "title": "udf: Fix bogus checksum computation in udf_rename()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43845", "datePublished": "2024-08-17T09:21:59.735Z", "dateReserved": "2024-08-17T09:11:59.275Z", "dateUpdated": "2024-12-19T09:17:01.682Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42274
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Revert "ALSA: firewire-lib: operate for period elapse event in process context"
Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event
in process context") removed the process context workqueue from
amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() to remove
its overhead.
With RME Fireface 800, this lead to a regression since
Kernels 5.14.0, causing an AB/BA deadlock competition for the
substream lock with eventual system freeze under ALSA operation:
thread 0:
* (lock A) acquire substream lock by
snd_pcm_stream_lock_irq() in
snd_pcm_status64()
* (lock B) wait for tasklet to finish by calling
tasklet_unlock_spin_wait() in
tasklet_disable_in_atomic() in
ohci_flush_iso_completions() of ohci.c
thread 1:
* (lock B) enter tasklet
* (lock A) attempt to acquire substream lock,
waiting for it to be released:
snd_pcm_stream_lock_irqsave() in
snd_pcm_period_elapsed() in
update_pcm_pointers() in
process_ctx_payloads() in
process_rx_packets() of amdtp-stream.c
? tasklet_unlock_spin_wait
</NMI>
<TASK>
ohci_flush_iso_completions firewire_ohci
amdtp_domain_stream_pcm_pointer snd_firewire_lib
snd_pcm_update_hw_ptr0 snd_pcm
snd_pcm_status64 snd_pcm
? native_queued_spin_lock_slowpath
</NMI>
<IRQ>
_raw_spin_lock_irqsave
snd_pcm_period_elapsed snd_pcm
process_rx_packets snd_firewire_lib
irq_target_callback snd_firewire_lib
handle_it_packet firewire_ohci
context_tasklet firewire_ohci
Restore the process context work queue to prevent deadlock
AB/BA deadlock competition for ALSA substream lock of
snd_pcm_stream_lock_irq() in snd_pcm_status64()
and snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed().
revert commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period
elapse event in process context")
Replace inline description to prevent future deadlock.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 7ba5ca32fe6e8d2e153fb5602997336517b34743 Version: 7ba5ca32fe6e8d2e153fb5602997336517b34743 Version: 7ba5ca32fe6e8d2e153fb5602997336517b34743 Version: 7ba5ca32fe6e8d2e153fb5602997336517b34743 Version: 7ba5ca32fe6e8d2e153fb5602997336517b34743 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42274", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:01.822950Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:32.013Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "sound/firewire/amdtp-stream.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "7c07220cf634002f93a87ca2252a32766850f2d1", "status": "affected", "version": "7ba5ca32fe6e8d2e153fb5602997336517b34743", "versionType": "git" }, { "lessThan": "b239a37d68e8bc59f9516444da222841e3b13ba9", "status": "affected", "version": "7ba5ca32fe6e8d2e153fb5602997336517b34743", "versionType": "git" }, { "lessThan": "f5043e69aeb2786f32e84132817a007a6430aa7d", "status": "affected", "version": "7ba5ca32fe6e8d2e153fb5602997336517b34743", "versionType": "git" }, { "lessThan": "36c255db5a25edd42d1aca48e38b8e95ee5fd9ef", "status": "affected", "version": "7ba5ca32fe6e8d2e153fb5602997336517b34743", "versionType": "git" }, { "lessThan": "3dab73ab925a51ab05543b491bf17463a48ca323", "status": "affected", "version": "7ba5ca32fe6e8d2e153fb5602997336517b34743", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "sound/firewire/amdtp-stream.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.14" }, { "lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"ALSA: firewire-lib: operate for period elapse event in process context\"\n\nCommit 7ba5ca32fe6e (\"ALSA: firewire-lib: operate for period elapse event\nin process context\") removed the process context workqueue from\namdtp_domain_stream_pcm_pointer() and update_pcm_pointers() to remove\nits overhead.\n\nWith RME Fireface 800, this lead to a regression since\nKernels 5.14.0, causing an AB/BA deadlock competition for the\nsubstream lock with eventual system freeze under ALSA operation:\n\nthread 0:\n * (lock A) acquire substream lock by\n\tsnd_pcm_stream_lock_irq() in\n\tsnd_pcm_status64()\n * (lock B) wait for tasklet to finish by calling\n \ttasklet_unlock_spin_wait() in\n\ttasklet_disable_in_atomic() in\n\tohci_flush_iso_completions() of ohci.c\n\nthread 1:\n * (lock B) enter tasklet\n * (lock A) attempt to acquire substream lock,\n \twaiting for it to be released:\n\tsnd_pcm_stream_lock_irqsave() in\n \tsnd_pcm_period_elapsed() in\n\tupdate_pcm_pointers() in\n\tprocess_ctx_payloads() in\n\tprocess_rx_packets() of amdtp-stream.c\n\n? tasklet_unlock_spin_wait\n \u003c/NMI\u003e\n \u003cTASK\u003e\nohci_flush_iso_completions firewire_ohci\namdtp_domain_stream_pcm_pointer snd_firewire_lib\nsnd_pcm_update_hw_ptr0 snd_pcm\nsnd_pcm_status64 snd_pcm\n\n? native_queued_spin_lock_slowpath\n \u003c/NMI\u003e\n \u003cIRQ\u003e\n_raw_spin_lock_irqsave\nsnd_pcm_period_elapsed snd_pcm\nprocess_rx_packets snd_firewire_lib\nirq_target_callback snd_firewire_lib\nhandle_it_packet firewire_ohci\ncontext_tasklet firewire_ohci\n\nRestore the process context work queue to prevent deadlock\nAB/BA deadlock competition for ALSA substream lock of\nsnd_pcm_stream_lock_irq() in snd_pcm_status64()\nand snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed().\n\nrevert commit 7ba5ca32fe6e (\"ALSA: firewire-lib: operate for period\nelapse event in process context\")\n\nReplace inline description to prevent future deadlock." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:25.666Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/7c07220cf634002f93a87ca2252a32766850f2d1" }, { "url": "https://git.kernel.org/stable/c/b239a37d68e8bc59f9516444da222841e3b13ba9" }, { "url": "https://git.kernel.org/stable/c/f5043e69aeb2786f32e84132817a007a6430aa7d" }, { "url": "https://git.kernel.org/stable/c/36c255db5a25edd42d1aca48e38b8e95ee5fd9ef" }, { "url": "https://git.kernel.org/stable/c/3dab73ab925a51ab05543b491bf17463a48ca323" } ], "title": "Revert \"ALSA: firewire-lib: operate for period elapse event in process context\"", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42274", "datePublished": "2024-08-17T08:54:28.169Z", "dateReserved": "2024-07-30T07:40:12.260Z", "dateUpdated": "2024-12-19T09:15:25.666Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43829
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/qxl: Add check for drm_cvt_mode
Add check for the return value of drm_cvt_mode() and return the error if
it fails in order to avoid NULL pointer dereference.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1b043677d4be206c96b51811855502e50057f343 Version: 1b043677d4be206c96b51811855502e50057f343 Version: 1b043677d4be206c96b51811855502e50057f343 Version: 1b043677d4be206c96b51811855502e50057f343 Version: 1b043677d4be206c96b51811855502e50057f343 Version: 1b043677d4be206c96b51811855502e50057f343 Version: 1b043677d4be206c96b51811855502e50057f343 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43829", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:34.737528Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:23.928Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/qxl/qxl_display.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "62ef8d7816c8e4a6088275553818b9afc0ffaa03", "status": "affected", "version": "1b043677d4be206c96b51811855502e50057f343", "versionType": "git" }, { "lessThan": "4e87f592a46bb804d8f833da6ce702ae4b55053f", "status": "affected", "version": "1b043677d4be206c96b51811855502e50057f343", "versionType": "git" }, { "lessThan": "3efe34f95b1ac8c138a46b14ce75956db0d6ee7c", "status": "affected", "version": "1b043677d4be206c96b51811855502e50057f343", "versionType": "git" }, { "lessThan": "f28b353c0c6c7831a70ccca881bf2db5e6785cdd", "status": "affected", "version": "1b043677d4be206c96b51811855502e50057f343", "versionType": "git" }, { "lessThan": "4b1f303bdeceac049e56e4b20eb5280bd9e02f4f", "status": "affected", "version": "1b043677d4be206c96b51811855502e50057f343", "versionType": "git" }, { "lessThan": "d4c57354a06cb4a77998ff8aa40af89eee30e07b", "status": "affected", "version": "1b043677d4be206c96b51811855502e50057f343", "versionType": "git" }, { "lessThan": "7bd09a2db0f617377027a2bb0b9179e6959edff3", "status": "affected", "version": "1b043677d4be206c96b51811855502e50057f343", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/qxl/qxl_display.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.1" }, { "lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/qxl: Add check for drm_cvt_mode\n\nAdd check for the return value of drm_cvt_mode() and return the error if\nit fails in order to avoid NULL pointer dereference." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:41.191Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/62ef8d7816c8e4a6088275553818b9afc0ffaa03" }, { "url": "https://git.kernel.org/stable/c/4e87f592a46bb804d8f833da6ce702ae4b55053f" }, { "url": "https://git.kernel.org/stable/c/3efe34f95b1ac8c138a46b14ce75956db0d6ee7c" }, { "url": "https://git.kernel.org/stable/c/f28b353c0c6c7831a70ccca881bf2db5e6785cdd" }, { "url": "https://git.kernel.org/stable/c/4b1f303bdeceac049e56e4b20eb5280bd9e02f4f" }, { "url": "https://git.kernel.org/stable/c/d4c57354a06cb4a77998ff8aa40af89eee30e07b" }, { "url": "https://git.kernel.org/stable/c/7bd09a2db0f617377027a2bb0b9179e6959edff3" } ], "title": "drm/qxl: Add check for drm_cvt_mode", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43829", "datePublished": "2024-08-17T09:21:48.239Z", "dateReserved": "2024-08-17T09:11:59.273Z", "dateUpdated": "2024-12-19T09:16:41.191Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42296
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix return value of f2fs_convert_inline_inode()
If device is readonly, make f2fs_convert_inline_inode()
return EROFS instead of zero, otherwise it may trigger
panic during writeback of inline inode's dirty page as
below:
f2fs_write_single_data_page+0xbb6/0x1e90 fs/f2fs/data.c:2888
f2fs_write_cache_pages fs/f2fs/data.c:3187 [inline]
__f2fs_write_data_pages fs/f2fs/data.c:3342 [inline]
f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3369
do_writepages+0x359/0x870 mm/page-writeback.c:2634
filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397
__filemap_fdatawrite_range mm/filemap.c:430 [inline]
file_write_and_wait_range+0x1aa/0x290 mm/filemap.c:788
f2fs_do_sync_file+0x68a/0x1ae0 fs/f2fs/file.c:276
generic_write_sync include/linux/fs.h:2806 [inline]
f2fs_file_write_iter+0x7bd/0x24e0 fs/f2fs/file.c:4977
call_write_iter include/linux/fs.h:2114 [inline]
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42296", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:47.727572Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:28.998Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/f2fs/inline.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "70f5ef5f33c333cfb286116fa3af74ac9bc84f1b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "47a8ddcdcaccd9b891db4574795e46a33a121ac2", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "077f0e24b27c4b44841593c7edbd1993be9eecb5", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "1e7725814361c8c008d131db195cef8274ff26b8", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "a8eb3de28e7a365690c61161e7a07a4fc7c60bbf", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/f2fs/inline.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix return value of f2fs_convert_inline_inode()\n\nIf device is readonly, make f2fs_convert_inline_inode()\nreturn EROFS instead of zero, otherwise it may trigger\npanic during writeback of inline inode\u0027s dirty page as\nbelow:\n\n f2fs_write_single_data_page+0xbb6/0x1e90 fs/f2fs/data.c:2888\n f2fs_write_cache_pages fs/f2fs/data.c:3187 [inline]\n __f2fs_write_data_pages fs/f2fs/data.c:3342 [inline]\n f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3369\n do_writepages+0x359/0x870 mm/page-writeback.c:2634\n filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397\n __filemap_fdatawrite_range mm/filemap.c:430 [inline]\n file_write_and_wait_range+0x1aa/0x290 mm/filemap.c:788\n f2fs_do_sync_file+0x68a/0x1ae0 fs/f2fs/file.c:276\n generic_write_sync include/linux/fs.h:2806 [inline]\n f2fs_file_write_iter+0x7bd/0x24e0 fs/f2fs/file.c:4977\n call_write_iter include/linux/fs.h:2114 [inline]\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xa72/0xc90 fs/read_write.c:590\n ksys_write+0x1a0/0x2c0 fs/read_write.c:643\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:51.448Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/70f5ef5f33c333cfb286116fa3af74ac9bc84f1b" }, { "url": "https://git.kernel.org/stable/c/47a8ddcdcaccd9b891db4574795e46a33a121ac2" }, { "url": "https://git.kernel.org/stable/c/077f0e24b27c4b44841593c7edbd1993be9eecb5" }, { "url": "https://git.kernel.org/stable/c/1e7725814361c8c008d131db195cef8274ff26b8" }, { "url": "https://git.kernel.org/stable/c/a8eb3de28e7a365690c61161e7a07a4fc7c60bbf" } ], "title": "f2fs: fix return value of f2fs_convert_inline_inode()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42296", "datePublished": "2024-08-17T09:09:04.429Z", "dateReserved": "2024-07-30T07:40:12.269Z", "dateUpdated": "2024-12-19T09:15:51.448Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43817
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: missing check virtio
Two missing check in virtio_net_hdr_to_skb() allowed syzbot
to crash kernels again
1. After the skb_segment function the buffer may become non-linear
(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere
the __skb_linearize function will not be executed, then the buffer will
remain non-linear. Then the condition (offset >= skb_headlen(skb))
becomes true, which causes WARN_ON_ONCE in skb_checksum_help.
2. The struct sk_buff and struct virtio_net_hdr members must be
mathematically related.
(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.
(remainder) must be greater than (needed) otherwise WARN_ON_ONCE.
(remainder) may be 0 if division is without remainder.
offset+2 (4191) > skb_headlen() (1116)
WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303
Modules linked in:
CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0
Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303
Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef
RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209
RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001
RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c
R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d
FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777
ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584
ip_finish_output_gso net/ipv4/ip_output.c:286 [inline]
__ip_finish_output net/ipv4/ip_output.c:308 [inline]
__ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295
ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433
dst_output include/net/dst.h:451 [inline]
ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129
iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82
ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline]
sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076
__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
netdev_start_xmit include/linux/netdevice.h:4954 [inline]
xmit_one net/core/dev.c:3545 [inline]
dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561
__dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346
dev_queue_xmit include/linux/netdevice.h:3134 [inline]
packet_xmit+0x257/0x380 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3087 [inline]
packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Found by Linux Verification Center (linuxtesting.org) with Syzkaller
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 0f6925b3e8da0dbbb52447ca8a8b42b371aac7db Version: 0f6925b3e8da0dbbb52447ca8a8b42b371aac7db Version: 0f6925b3e8da0dbbb52447ca8a8b42b371aac7db Version: 0f6925b3e8da0dbbb52447ca8a8b42b371aac7db Version: 0f6925b3e8da0dbbb52447ca8a8b42b371aac7db |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43817", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:12.881524Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:25.439Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "include/linux/virtio_net.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "27874ca77bd2b05a3779c7b3a5c75d8dd7f0b40f", "status": "affected", "version": "0f6925b3e8da0dbbb52447ca8a8b42b371aac7db", "versionType": "git" }, { "lessThan": "5b1997487a3f3373b0f580c8a20b56c1b64b0775", "status": "affected", "version": "0f6925b3e8da0dbbb52447ca8a8b42b371aac7db", "versionType": "git" }, { "lessThan": "90d41ebe0cd4635f6410471efc1dd71b33e894cf", "status": "affected", "version": "0f6925b3e8da0dbbb52447ca8a8b42b371aac7db", "versionType": "git" }, { "lessThan": "e9164903b8b303c34723177b02fe91e49e3c4cd7", "status": "affected", "version": "0f6925b3e8da0dbbb52447ca8a8b42b371aac7db", "versionType": "git" }, { "lessThan": "e269d79c7d35aa3808b1f3c1737d63dab504ddc8", "status": "affected", "version": "0f6925b3e8da0dbbb52447ca8a8b42b371aac7db", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "include/linux/virtio_net.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.12" }, { "lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: missing check virtio\n\nTwo missing check in virtio_net_hdr_to_skb() allowed syzbot\nto crash kernels again\n\n1. After the skb_segment function the buffer may become non-linear\n(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere\nthe __skb_linearize function will not be executed, then the buffer will\nremain non-linear. Then the condition (offset \u003e= skb_headlen(skb))\nbecomes true, which causes WARN_ON_ONCE in skb_checksum_help.\n\n2. The struct sk_buff and struct virtio_net_hdr members must be\nmathematically related.\n(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.\n(remainder) must be greater than (needed) otherwise WARN_ON_ONCE.\n(remainder) may be 0 if division is without remainder.\n\noffset+2 (4191) \u003e skb_headlen() (1116)\nWARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303\nModules linked in:\nCPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023\nRIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303\nCode: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 \u003c0f\u003e 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef\nRSP: 0018:ffffc90003a9f338 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209\nRDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001\nRBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c\nR13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d\nFS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777\n ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584\n ip_finish_output_gso net/ipv4/ip_output.c:286 [inline]\n __ip_finish_output net/ipv4/ip_output.c:308 [inline]\n __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433\n dst_output include/net/dst.h:451 [inline]\n ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline]\n sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3545 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n packet_xmit+0x257/0x380 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3087 [inline]\n packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0xd5/0x180 net/socket.c:745\n __sys_sendto+0x255/0x340 net/socket.c:2190\n __do_sys_sendto net/socket.c:2202 [inline]\n __se_sys_sendto net/socket.c:2198 [inline]\n __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:26.464Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/27874ca77bd2b05a3779c7b3a5c75d8dd7f0b40f" }, { "url": "https://git.kernel.org/stable/c/5b1997487a3f3373b0f580c8a20b56c1b64b0775" }, { "url": "https://git.kernel.org/stable/c/90d41ebe0cd4635f6410471efc1dd71b33e894cf" }, { "url": "https://git.kernel.org/stable/c/e9164903b8b303c34723177b02fe91e49e3c4cd7" }, { "url": "https://git.kernel.org/stable/c/e269d79c7d35aa3808b1f3c1737d63dab504ddc8" } ], "title": "net: missing check virtio", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43817", "datePublished": "2024-08-17T09:21:39.636Z", "dateReserved": "2024-08-17T09:11:59.270Z", "dateUpdated": "2024-12-19T09:16:26.464Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42260
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Validate passed in drm syncobj handles in the performance extension
If userspace provides an unknown or invalid handle anywhere in the handle
array the rest of the driver will not handle that well.
Fix it by checking handle was looked up successfully or otherwise fail the
extension by jumping into the existing unwind.
(cherry picked from commit a546b7e4d73c23838d7e4d2c92882b3ca902d213)
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42260", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:47.115875Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:33.593Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "5d4aa25f47cd05e9eeac272906588728588605dd", "status": "affected", "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "versionType": "git" }, { "lessThan": "4ecc24a84d7e0254efd150ec23e0b89638386516", "status": "affected", "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Validate passed in drm syncobj handles in the performance extension\n\nIf userspace provides an unknown or invalid handle anywhere in the handle\narray the rest of the driver will not handle that well.\n\nFix it by checking handle was looked up successfully or otherwise fail the\nextension by jumping into the existing unwind.\n\n(cherry picked from commit a546b7e4d73c23838d7e4d2c92882b3ca902d213)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:03.832Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/5d4aa25f47cd05e9eeac272906588728588605dd" }, { "url": "https://git.kernel.org/stable/c/4ecc24a84d7e0254efd150ec23e0b89638386516" } ], "title": "drm/v3d: Validate passed in drm syncobj handles in the performance extension", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42260", "datePublished": "2024-08-17T08:54:18.155Z", "dateReserved": "2024-07-30T07:40:12.258Z", "dateUpdated": "2024-12-19T09:15:03.832Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42305
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: check dot and dotdot of dx_root before making dir indexed
Syzbot reports a issue as follows:
============================================
BUG: unable to handle page fault for address: ffffed11022e24fe
PGD 23ffee067 P4D 23ffee067 PUD 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0
Call Trace:
<TASK>
make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341
ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451
ext4_rename fs/ext4/namei.c:3936 [inline]
ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214
[...]
============================================
The immediate cause of this problem is that there is only one valid dentry
for the block to be split during do_split, so split==0 results in out of
bounds accesses to the map triggering the issue.
do_split
unsigned split
dx_make_map
count = 1
split = count/2 = 0;
continued = hash2 == map[split - 1].hash;
---> map[4294967295]
The maximum length of a filename is 255 and the minimum block size is 1024,
so it is always guaranteed that the number of entries is greater than or
equal to 2 when do_split() is called.
But syzbot's crafted image has no dot and dotdot in dir, and the dentry
distribution in dirblock is as follows:
bus dentry1 hole dentry2 free
|xx--|xx-------------|...............|xx-------------|...............|
0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024
So when renaming dentry1 increases its name_len length by 1, neither hole
nor free is sufficient to hold the new dentry, and make_indexed_dir() is
called.
In make_indexed_dir() it is assumed that the first two entries of the
dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root
because they are treated as dot and dotdot, and only dentry2 is moved
to the new leaf block. That's why count is equal to 1.
Therefore add the ext4_check_dx_root() helper function to add more sanity
checks to dot and dotdot before starting the conversion to avoid the above
issue.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: ac27a0ec112a089f1a5102bc8dffc79c8c815571 Version: ac27a0ec112a089f1a5102bc8dffc79c8c815571 Version: ac27a0ec112a089f1a5102bc8dffc79c8c815571 Version: ac27a0ec112a089f1a5102bc8dffc79c8c815571 Version: ac27a0ec112a089f1a5102bc8dffc79c8c815571 Version: ac27a0ec112a089f1a5102bc8dffc79c8c815571 Version: ac27a0ec112a089f1a5102bc8dffc79c8c815571 Version: ac27a0ec112a089f1a5102bc8dffc79c8c815571 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42305", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:19.161352Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:27.970Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/ext4/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git" }, { "lessThan": "19e13b4d7f0303186fcc891aba8d0de7c8fdbda8", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git" }, { "lessThan": "42d420517072028fb0eb852c358056b7717ba5aa", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git" }, { "lessThan": "8afe06ed3be7a874b3cd82ef5f8959aca8d6429a", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git" }, { "lessThan": "abb411ac991810c0bcbe51c2e76d2502bf611b5c", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git" }, { "lessThan": "9d241b7a39af192d1bb422714a458982c7cc67a2", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git" }, { "lessThan": "cdd345321699042ece4a9d2e70754d2397d378c5", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git" }, { "lessThan": "50ea741def587a64e08879ce6c6a30131f7111e7", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/ext4/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.19" }, { "lessThan": "2.6.19", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: check dot and dotdot of dx_root before making dir indexed\n\nSyzbot reports a issue as follows:\n============================================\nBUG: unable to handle page fault for address: ffffed11022e24fe\nPGD 23ffee067 P4D 23ffee067 PUD 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0\nCall Trace:\n \u003cTASK\u003e\n make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451\n ext4_rename fs/ext4/namei.c:3936 [inline]\n ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214\n[...]\n============================================\n\nThe immediate cause of this problem is that there is only one valid dentry\nfor the block to be split during do_split, so split==0 results in out of\nbounds accesses to the map triggering the issue.\n\n do_split\n unsigned split\n dx_make_map\n count = 1\n split = count/2 = 0;\n continued = hash2 == map[split - 1].hash;\n ---\u003e map[4294967295]\n\nThe maximum length of a filename is 255 and the minimum block size is 1024,\nso it is always guaranteed that the number of entries is greater than or\nequal to 2 when do_split() is called.\n\nBut syzbot\u0027s crafted image has no dot and dotdot in dir, and the dentry\ndistribution in dirblock is as follows:\n\n bus dentry1 hole dentry2 free\n|xx--|xx-------------|...............|xx-------------|...............|\n0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024\n\nSo when renaming dentry1 increases its name_len length by 1, neither hole\nnor free is sufficient to hold the new dentry, and make_indexed_dir() is\ncalled.\n\nIn make_indexed_dir() it is assumed that the first two entries of the\ndirblock must be dot and dotdot, so bus and dentry1 are left in dx_root\nbecause they are treated as dot and dotdot, and only dentry2 is moved\nto the new leaf block. That\u0027s why count is equal to 1.\n\nTherefore add the ext4_check_dx_root() helper function to add more sanity\nchecks to dot and dotdot before starting the conversion to avoid the above\nissue." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:03.235Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db" }, { "url": "https://git.kernel.org/stable/c/19e13b4d7f0303186fcc891aba8d0de7c8fdbda8" }, { "url": "https://git.kernel.org/stable/c/42d420517072028fb0eb852c358056b7717ba5aa" }, { "url": "https://git.kernel.org/stable/c/8afe06ed3be7a874b3cd82ef5f8959aca8d6429a" }, { "url": "https://git.kernel.org/stable/c/abb411ac991810c0bcbe51c2e76d2502bf611b5c" }, { "url": "https://git.kernel.org/stable/c/9d241b7a39af192d1bb422714a458982c7cc67a2" }, { "url": "https://git.kernel.org/stable/c/cdd345321699042ece4a9d2e70754d2397d378c5" }, { "url": "https://git.kernel.org/stable/c/50ea741def587a64e08879ce6c6a30131f7111e7" } ], "title": "ext4: check dot and dotdot of dx_root before making dir indexed", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42305", "datePublished": "2024-08-17T09:09:11.296Z", "dateReserved": "2024-07-30T07:40:12.273Z", "dateUpdated": "2024-12-19T09:16:03.235Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42266
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: make cow_file_range_inline() honor locked_page on error
The btrfs buffered write path runs through __extent_writepage() which
has some tricky return value handling for writepage_delalloc().
Specifically, when that returns 1, we exit, but for other return values
we continue and end up calling btrfs_folio_end_all_writers(). If the
folio has been unlocked (note that we check the PageLocked bit at the
start of __extent_writepage()), this results in an assert panic like
this one from syzbot:
BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure
BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction.
BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure
assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871
------------[ cut here ]------------
kernel BUG at fs/btrfs/subpage.c:871!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted
6.10.0-syzkaller-05505-gb1bc554e009e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 06/27/2024
RIP: 0010:btrfs_folio_end_all_writers+0x55b/0x610 fs/btrfs/subpage.c:871
Code: e9 d3 fb ff ff e8 25 22 c2 fd 48 c7 c7 c0 3c 0e 8c 48 c7 c6 80 3d
0e 8c 48 c7 c2 60 3c 0e 8c b9 67 03 00 00 e8 66 47 ad 07 90 <0f> 0b e8
6e 45 b0 07 4c 89 ff be 08 00 00 00 e8 21 12 25 fe 4c 89
RSP: 0018:ffffc900033d72e0 EFLAGS: 00010246
RAX: 0000000000000045 RBX: 00fff0000000402c RCX: 663b7a08c50a0a00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffc900033d73b0 R08: ffffffff8176b98c R09: 1ffff9200067adfc
R10: dffffc0000000000 R11: fffff5200067adfd R12: 0000000000000001
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0001cbee80
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5f076012f8 CR3: 000000000e134000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__extent_writepage fs/btrfs/extent_io.c:1597 [inline]
extent_write_cache_pages fs/btrfs/extent_io.c:2251 [inline]
btrfs_writepages+0x14d7/0x2760 fs/btrfs/extent_io.c:2373
do_writepages+0x359/0x870 mm/page-writeback.c:2656
filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397
__filemap_fdatawrite_range mm/filemap.c:430 [inline]
__filemap_fdatawrite mm/filemap.c:436 [inline]
filemap_flush+0xdf/0x130 mm/filemap.c:463
btrfs_release_file+0x117/0x130 fs/btrfs/file.c:1547
__fput+0x24a/0x8a0 fs/file_table.c:422
task_work_run+0x24f/0x310 kernel/task_work.c:222
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xa2f/0x27f0 kernel/exit.c:877
do_group_exit+0x207/0x2c0 kernel/exit.c:1026
__do_sys_exit_group kernel/exit.c:1037 [inline]
__se_sys_exit_group kernel/exit.c:1035 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035
x64_sys_call+0x2634/0x2640
arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5f075b70c9
Code: Unable to access opcode bytes at
0x7f5f075b709f.
I was hitting the same issue by doing hundreds of accelerated runs of
generic/475, which also hits IO errors by design.
I instrumented that reproducer with bpftrace and found that the
undesirable folio_unlock was coming from the following callstack:
folio_unlock+5
__process_pages_contig+475
cow_file_range_inline.constprop.0+230
cow_file_range+803
btrfs_run_delalloc_range+566
writepage_delalloc+332
__extent_writepage # inlined in my stacktrace, but I added it here
extent_write_cache_pages+622
Looking at the bisected-to pa
---truncated---
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42266", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:27.580534Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:05.700Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/btrfs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "061e41581606000a83ce0f0f01d6ad338f3704e9", "status": "affected", "version": "0586d0a89e77d717da14df42648ace4a9fd67981", "versionType": "git" }, { "lessThan": "478574370bef7951fbd9ef5155537d6cbed49472", "status": "affected", "version": "0586d0a89e77d717da14df42648ace4a9fd67981", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/btrfs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: make cow_file_range_inline() honor locked_page on error\n\nThe btrfs buffered write path runs through __extent_writepage() which\nhas some tricky return value handling for writepage_delalloc().\nSpecifically, when that returns 1, we exit, but for other return values\nwe continue and end up calling btrfs_folio_end_all_writers(). If the\nfolio has been unlocked (note that we check the PageLocked bit at the\nstart of __extent_writepage()), this results in an assert panic like\nthis one from syzbot:\n\n BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure\n BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction.\n BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure\n assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871\n ------------[ cut here ]------------\n kernel BUG at fs/btrfs/subpage.c:871!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted\n 6.10.0-syzkaller-05505-gb1bc554e009e #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS\n Google 06/27/2024\n RIP: 0010:btrfs_folio_end_all_writers+0x55b/0x610 fs/btrfs/subpage.c:871\n Code: e9 d3 fb ff ff e8 25 22 c2 fd 48 c7 c7 c0 3c 0e 8c 48 c7 c6 80 3d\n 0e 8c 48 c7 c2 60 3c 0e 8c b9 67 03 00 00 e8 66 47 ad 07 90 \u003c0f\u003e 0b e8\n 6e 45 b0 07 4c 89 ff be 08 00 00 00 e8 21 12 25 fe 4c 89\n RSP: 0018:ffffc900033d72e0 EFLAGS: 00010246\n RAX: 0000000000000045 RBX: 00fff0000000402c RCX: 663b7a08c50a0a00\n RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000\n RBP: ffffc900033d73b0 R08: ffffffff8176b98c R09: 1ffff9200067adfc\n R10: dffffc0000000000 R11: fffff5200067adfd R12: 0000000000000001\n R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0001cbee80\n FS: 0000000000000000(0000) GS:ffff8880b9500000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f5f076012f8 CR3: 000000000e134000 CR4: 00000000003506f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \u003cTASK\u003e\n __extent_writepage fs/btrfs/extent_io.c:1597 [inline]\n extent_write_cache_pages fs/btrfs/extent_io.c:2251 [inline]\n btrfs_writepages+0x14d7/0x2760 fs/btrfs/extent_io.c:2373\n do_writepages+0x359/0x870 mm/page-writeback.c:2656\n filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397\n __filemap_fdatawrite_range mm/filemap.c:430 [inline]\n __filemap_fdatawrite mm/filemap.c:436 [inline]\n filemap_flush+0xdf/0x130 mm/filemap.c:463\n btrfs_release_file+0x117/0x130 fs/btrfs/file.c:1547\n __fput+0x24a/0x8a0 fs/file_table.c:422\n task_work_run+0x24f/0x310 kernel/task_work.c:222\n exit_task_work include/linux/task_work.h:40 [inline]\n do_exit+0xa2f/0x27f0 kernel/exit.c:877\n do_group_exit+0x207/0x2c0 kernel/exit.c:1026\n __do_sys_exit_group kernel/exit.c:1037 [inline]\n __se_sys_exit_group kernel/exit.c:1035 [inline]\n __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035\n x64_sys_call+0x2634/0x2640\n arch/x86/include/generated/asm/syscalls_64.h:232\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f5f075b70c9\n Code: Unable to access opcode bytes at\n 0x7f5f075b709f.\n\nI was hitting the same issue by doing hundreds of accelerated runs of\ngeneric/475, which also hits IO errors by design.\n\nI instrumented that reproducer with bpftrace and found that the\nundesirable folio_unlock was coming from the following callstack:\n\n folio_unlock+5\n __process_pages_contig+475\n cow_file_range_inline.constprop.0+230\n cow_file_range+803\n btrfs_run_delalloc_range+566\n writepage_delalloc+332\n __extent_writepage # inlined in my stacktrace, but I added it here\n extent_write_cache_pages+622\n\nLooking at the bisected-to pa\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:10.844Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/061e41581606000a83ce0f0f01d6ad338f3704e9" }, { "url": "https://git.kernel.org/stable/c/478574370bef7951fbd9ef5155537d6cbed49472" } ], "title": "btrfs: make cow_file_range_inline() honor locked_page on error", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42266", "datePublished": "2024-08-17T08:54:22.308Z", "dateReserved": "2024-07-30T07:40:12.259Z", "dateUpdated": "2024-12-19T09:15:10.844Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43816
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages
On big endian architectures, it is possible to run into a memory out of
bounds pointer dereference when FCP targets are zoned.
In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is
referencing a little endian formatted sgl->sge_len value. So, the memcpy
can cause big endian systems to crash.
Redefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are
referring to a little endian formatted data structure. And, update the
routine with proper le32_to_cpu macro usages.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43816", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:16.258182Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:04.878Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/scsi/lpfc/lpfc_sli.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "9fd003f344d502f65252963169df3dd237054e49", "status": "affected", "version": "af20bb73ac2591631d504f3f859f073bcdb7e11e", "versionType": "git" }, { "lessThan": "8bc7c617642db6d8d20ee671fb6c4513017e7a7e", "status": "affected", "version": "af20bb73ac2591631d504f3f859f073bcdb7e11e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/scsi/lpfc/lpfc_sli.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages\n\nOn big endian architectures, it is possible to run into a memory out of\nbounds pointer dereference when FCP targets are zoned.\n\nIn lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl-\u003esge_len) is\nreferencing a little endian formatted sgl-\u003esge_len value. So, the memcpy\ncan cause big endian systems to crash.\n\nRedefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are\nreferring to a little endian formatted data structure. And, update the\nroutine with proper le32_to_cpu macro usages." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:25.162Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/9fd003f344d502f65252963169df3dd237054e49" }, { "url": "https://git.kernel.org/stable/c/8bc7c617642db6d8d20ee671fb6c4513017e7a7e" } ], "title": "scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43816", "datePublished": "2024-08-17T09:21:38.926Z", "dateReserved": "2024-08-17T09:11:59.270Z", "dateUpdated": "2024-12-19T09:16:25.162Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42299
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
If an NTFS file system is mounted to another system with different
PAGE_SIZE from the original system, log->page_size will change in
log_replay(), but log->page_{mask,bits} don't change correspondingly.
This will cause a panic because "u32 bytes = log->page_size - page_off"
will get a negative value in the later read_log_page().
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42299", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:38.451073Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:28.553Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/ntfs3/fslog.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "0484adcb5fbcadd9ba0fd4485c42630f72e97da9", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git" }, { "lessThan": "b90ceffdc975502bc085ce8e79c6adeff05f9521", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git" }, { "lessThan": "2cac0df3324b5e287d8020bc0708f7d2dec88a6f", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git" }, { "lessThan": "0a4ae2644e2a3b3b219aad9639fb2b0691d08420", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git" }, { "lessThan": "2fef55d8f78383c8e6d6d4c014b9597375132696", "status": "affected", "version": "b46acd6a6a627d876898e1c84d3f84902264b445", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/ntfs3/fslog.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.15" }, { "lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Update log-\u003epage_{mask,bits} if log-\u003epage_size changed\n\nIf an NTFS file system is mounted to another system with different\nPAGE_SIZE from the original system, log-\u003epage_size will change in\nlog_replay(), but log-\u003epage_{mask,bits} don\u0027t change correspondingly.\nThis will cause a panic because \"u32 bytes = log-\u003epage_size - page_off\"\nwill get a negative value in the later read_log_page()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:55.223Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/0484adcb5fbcadd9ba0fd4485c42630f72e97da9" }, { "url": "https://git.kernel.org/stable/c/b90ceffdc975502bc085ce8e79c6adeff05f9521" }, { "url": "https://git.kernel.org/stable/c/2cac0df3324b5e287d8020bc0708f7d2dec88a6f" }, { "url": "https://git.kernel.org/stable/c/0a4ae2644e2a3b3b219aad9639fb2b0691d08420" }, { "url": "https://git.kernel.org/stable/c/2fef55d8f78383c8e6d6d4c014b9597375132696" } ], "title": "fs/ntfs3: Update log-\u003epage_{mask,bits} if log-\u003epage_size changed", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42299", "datePublished": "2024-08-17T09:09:06.570Z", "dateReserved": "2024-07-30T07:40:12.270Z", "dateUpdated": "2024-12-19T09:15:55.223Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42278
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: TAS2781: Fix tasdev_load_calibrated_data()
This function has a reversed if statement so it's either a no-op or it
leads to a NULL dereference.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42278", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:46.015448Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:31.311Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "sound/soc/codecs/tas2781-fmwlib.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6d98741dbd1309a6f2d7cffbb10a8f036ec3ca06", "status": "affected", "version": "57847c2ec5fb5e951fe9028f9e587e3e878d9129", "versionType": "git" }, { "lessThan": "51be301d29d674ff328dfcf23705851f326f35b3", "status": "affected", "version": "b195acf5266d2dee4067f89345c3e6b88d925311", "versionType": "git" }, { "lessThan": "92c78222168e9035a9bfb8841c2e56ce23e51f73", "status": "affected", "version": "b195acf5266d2dee4067f89345c3e6b88d925311", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "sound/soc/codecs/tas2781-fmwlib.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: TAS2781: Fix tasdev_load_calibrated_data()\n\nThis function has a reversed if statement so it\u0027s either a no-op or it\nleads to a NULL dereference." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:30.329Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/6d98741dbd1309a6f2d7cffbb10a8f036ec3ca06" }, { "url": "https://git.kernel.org/stable/c/51be301d29d674ff328dfcf23705851f326f35b3" }, { "url": "https://git.kernel.org/stable/c/92c78222168e9035a9bfb8841c2e56ce23e51f73" } ], "title": "ASoC: TAS2781: Fix tasdev_load_calibrated_data()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42278", "datePublished": "2024-08-17T09:08:46.120Z", "dateReserved": "2024-07-30T07:40:12.261Z", "dateUpdated": "2024-12-19T09:15:30.329Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42263
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Fix potential memory leak in the timestamp extension
If fetching of userspace memory fails during the main loop, all drm sync
objs looked up until that point will be leaked because of the missing
drm_syncobj_put.
Fix it by exporting and using a common cleanup helper.
(cherry picked from commit 753ce4fea62182c77e1691ab4f9022008f25b62e)
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42263", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:37.175659Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:33.123Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_drv.h", "drivers/gpu/drm/v3d/v3d_sched.c", "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "9b5033ee2c5af6d1135a403df32d219ab57e55f9", "status": "affected", "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "versionType": "git" }, { "lessThan": "0e50fcc20bd87584840266e8004f9064a8985b4f", "status": "affected", "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_drv.h", "drivers/gpu/drm/v3d/v3d_sched.c", "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix potential memory leak in the timestamp extension\n\nIf fetching of userspace memory fails during the main loop, all drm sync\nobjs looked up until that point will be leaked because of the missing\ndrm_syncobj_put.\n\nFix it by exporting and using a common cleanup helper.\n\n(cherry picked from commit 753ce4fea62182c77e1691ab4f9022008f25b62e)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:07.283Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/9b5033ee2c5af6d1135a403df32d219ab57e55f9" }, { "url": "https://git.kernel.org/stable/c/0e50fcc20bd87584840266e8004f9064a8985b4f" } ], "title": "drm/v3d: Fix potential memory leak in the timestamp extension", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42263", "datePublished": "2024-08-17T08:54:20.255Z", "dateReserved": "2024-07-30T07:40:12.259Z", "dateUpdated": "2024-12-19T09:15:07.283Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42288
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix for possible memory corruption
Init Control Block is dereferenced incorrectly. Correctly dereference ICB
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42288", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:13.401777Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:30.047Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/scsi/qla2xxx/qla_os.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "87db8d7b7520e99de71791260989f06f9c94953d", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "2a15b59a2c5afac89696e44acf5bbfc0599c6c5e", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "571d7f2a08836698c2fb0d792236424575b9829b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "8192c533e89d9fb69b2490398939236b78cda79b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "c03d740152f78e86945a75b2ad541bf972fab92a", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/scsi/qla2xxx/qla_os.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix for possible memory corruption\n\nInit Control Block is dereferenced incorrectly. Correctly dereference ICB" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:41.894Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb" }, { "url": "https://git.kernel.org/stable/c/87db8d7b7520e99de71791260989f06f9c94953d" }, { "url": "https://git.kernel.org/stable/c/b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce" }, { "url": "https://git.kernel.org/stable/c/2a15b59a2c5afac89696e44acf5bbfc0599c6c5e" }, { "url": "https://git.kernel.org/stable/c/571d7f2a08836698c2fb0d792236424575b9829b" }, { "url": "https://git.kernel.org/stable/c/8192c533e89d9fb69b2490398939236b78cda79b" }, { "url": "https://git.kernel.org/stable/c/c03d740152f78e86945a75b2ad541bf972fab92a" } ], "title": "scsi: qla2xxx: Fix for possible memory corruption", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42288", "datePublished": "2024-08-17T09:08:53.466Z", "dateReserved": "2024-07-30T07:40:12.262Z", "dateUpdated": "2024-12-19T09:15:41.894Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42300
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix race in z_erofs_get_gbuf()
In z_erofs_get_gbuf(), the current task may be migrated to another
CPU between `z_erofs_gbuf_id()` and `spin_lock(&gbuf->lock)`.
Therefore, z_erofs_put_gbuf() will trigger the following issue
which was found by stress test:
<2>[772156.434168] kernel BUG at fs/erofs/zutil.c:58!
..
<4>[772156.435007]
<4>[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2
<4>[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017
<4>[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
<4>[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs]
<4>[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs]
..
<6>[772156.445958] stress (3127): drop_caches: 1
<4>[772156.446120] Call trace:
<4>[772156.446121] z_erofs_put_gbuf+0x64/0x70 [erofs]
<4>[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs]
<4>[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs]
<4>[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs]
<4>[772156.447160] z_erofs_readahead+0x224/0x390 [erofs]
..
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42300", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:35.332066Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:28.436Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/erofs/zutil.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "49b22e06a947727a6d1c802d2d9ad92420b90fc5", "status": "affected", "version": "f36f3010f67611a45d66e773bc91e4c66a9abab5", "versionType": "git" }, { "lessThan": "7dc5537c3f8be87e005f0844a7626c987914f8fd", "status": "affected", "version": "f36f3010f67611a45d66e773bc91e4c66a9abab5", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/erofs/zutil.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix race in z_erofs_get_gbuf()\n\nIn z_erofs_get_gbuf(), the current task may be migrated to another\nCPU between `z_erofs_gbuf_id()` and `spin_lock(\u0026gbuf-\u003elock)`.\n\nTherefore, z_erofs_put_gbuf() will trigger the following issue\nwhich was found by stress test:\n\n\u003c2\u003e[772156.434168] kernel BUG at fs/erofs/zutil.c:58!\n..\n\u003c4\u003e[772156.435007]\n\u003c4\u003e[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2\n\u003c4\u003e[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017\n\u003c4\u003e[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n\u003c4\u003e[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs]\n\u003c4\u003e[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\n..\n\u003c6\u003e[772156.445958] stress (3127): drop_caches: 1\n\u003c4\u003e[772156.446120] Call trace:\n\u003c4\u003e[772156.446121] z_erofs_put_gbuf+0x64/0x70 [erofs]\n\u003c4\u003e[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\n\u003c4\u003e[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs]\n\u003c4\u003e[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs]\n\u003c4\u003e[772156.447160] z_erofs_readahead+0x224/0x390 [erofs]\n.." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:56.408Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/49b22e06a947727a6d1c802d2d9ad92420b90fc5" }, { "url": "https://git.kernel.org/stable/c/7dc5537c3f8be87e005f0844a7626c987914f8fd" } ], "title": "erofs: fix race in z_erofs_get_gbuf()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42300", "datePublished": "2024-08-17T09:09:07.311Z", "dateReserved": "2024-07-30T07:40:12.270Z", "dateUpdated": "2024-12-19T09:15:56.408Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42270
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().
We had a report that iptables-restore sometimes triggered null-ptr-deref
at boot time. [0]
The problem is that iptable_nat_table_init() is exposed to user space
before the kernel fully initialises netns.
In the small race window, a user could call iptable_nat_table_init()
that accesses net_generic(net, iptable_nat_net_id), which is available
only after registering iptable_nat_net_ops.
Let's call register_pernet_subsys() before xt_register_template().
[0]:
bpfilter: Loaded bpfilter_umh pid 11702
Started bpfilter
BUG: kernel NULL pointer dereference, address: 0000000000000013
PF: supervisor write access in kernel mode
PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
PREEMPT SMP NOPTI
CPU: 2 PID: 11879 Comm: iptables-restor Not tainted 6.1.92-99.174.amzn2023.x86_64 #1
Hardware name: Amazon EC2 c6i.4xlarge/, BIOS 1.0 10/16/2017
RIP: 0010:iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat
Code: 10 4c 89 f6 48 89 ef e8 0b 19 bb ff 41 89 c4 85 c0 75 38 41 83 c7 01 49 83 c6 28 41 83 ff 04 75 dc 48 8b 44 24 08 48 8b 0c 24 <48> 89 08 4c 89 ef e8 a2 3b a2 cf 48 83 c4 10 44 89 e0 5b 5d 41 5c
RSP: 0018:ffffbef902843cd0 EFLAGS: 00010246
RAX: 0000000000000013 RBX: ffff9f4b052caa20 RCX: ffff9f4b20988d80
RDX: 0000000000000000 RSI: 0000000000000064 RDI: ffffffffc04201c0
RBP: ffff9f4b29394000 R08: ffff9f4b07f77258 R09: ffff9f4b07f77240
R10: 0000000000000000 R11: ffff9f4b09635388 R12: 0000000000000000
R13: ffff9f4b1a3c6c00 R14: ffff9f4b20988e20 R15: 0000000000000004
FS: 00007f6284340000(0000) GS:ffff9f51fe280000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000013 CR3: 00000001d10a6005 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259)
? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259)
? xt_find_table_lock (net/netfilter/x_tables.c:1259)
? __die_body.cold (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420)
? page_fault_oops (arch/x86/mm/fault.c:727)
? exc_page_fault (./arch/x86/include/asm/irqflags.h:40 ./arch/x86/include/asm/irqflags.h:75 arch/x86/mm/fault.c:1470 arch/x86/mm/fault.c:1518)
? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:570)
? iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat
xt_find_table_lock (net/netfilter/x_tables.c:1259)
xt_request_find_table_lock (net/netfilter/x_tables.c:1287)
get_info (net/ipv4/netfilter/ip_tables.c:965)
? security_capable (security/security.c:809 (discriminator 13))
? ns_capable (kernel/capability.c:376 kernel/capability.c:397)
? do_ipt_get_ctl (net/ipv4/netfilter/ip_tables.c:1656)
? bpfilter_send_req (net/bpfilter/bpfilter_kern.c:52) bpfilter
nf_getsockopt (net/netfilter/nf_sockopt.c:116)
ip_getsockopt (net/ipv4/ip_sockglue.c:1827)
__sys_getsockopt (net/socket.c:2327)
__x64_sys_getsockopt (net/socket.c:2342 net/socket.c:2339 net/socket.c:2339)
do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:81)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
RIP: 0033:0x7f62844685ee
Code: 48 8b 0d 45 28 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 09
RSP: 002b:00007ffd1f83d638 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007ffd1f83d680 RCX: 00007f62844685ee
RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000004 R08: 00007ffd1f83d670 R09: 0000558798ffa2a0
R10: 00007ffd1f83d680 R11: 0000000000000246 R12: 00007ffd1f83e3b2
R13: 00007f6284
---truncated---
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42270", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:14.793502Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:32.466Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/ipv4/netfilter/iptable_nat.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b98ddb65fa1674b0e6b52de8af9103b63f51b643", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" }, { "lessThan": "95590a4929027769af35b153645c0ab6fd22b29b", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" }, { "lessThan": "70014b73d7539fcbb6b4ff5f37368d7241d8e626", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" }, { "lessThan": "08ed888b69a22647153fe2bec55b7cd0a46102cc", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" }, { "lessThan": "5830aa863981d43560748aa93589c0695191d95d", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/ipv4/netfilter/iptable_nat.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.15" }, { "lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().\n\nWe had a report that iptables-restore sometimes triggered null-ptr-deref\nat boot time. [0]\n\nThe problem is that iptable_nat_table_init() is exposed to user space\nbefore the kernel fully initialises netns.\n\nIn the small race window, a user could call iptable_nat_table_init()\nthat accesses net_generic(net, iptable_nat_net_id), which is available\nonly after registering iptable_nat_net_ops.\n\nLet\u0027s call register_pernet_subsys() before xt_register_template().\n\n[0]:\nbpfilter: Loaded bpfilter_umh pid 11702\nStarted bpfilter\nBUG: kernel NULL pointer dereference, address: 0000000000000013\n PF: supervisor write access in kernel mode\n PF: error_code(0x0002) - not-present page\nPGD 0 P4D 0\nPREEMPT SMP NOPTI\nCPU: 2 PID: 11879 Comm: iptables-restor Not tainted 6.1.92-99.174.amzn2023.x86_64 #1\nHardware name: Amazon EC2 c6i.4xlarge/, BIOS 1.0 10/16/2017\nRIP: 0010:iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat\nCode: 10 4c 89 f6 48 89 ef e8 0b 19 bb ff 41 89 c4 85 c0 75 38 41 83 c7 01 49 83 c6 28 41 83 ff 04 75 dc 48 8b 44 24 08 48 8b 0c 24 \u003c48\u003e 89 08 4c 89 ef e8 a2 3b a2 cf 48 83 c4 10 44 89 e0 5b 5d 41 5c\nRSP: 0018:ffffbef902843cd0 EFLAGS: 00010246\nRAX: 0000000000000013 RBX: ffff9f4b052caa20 RCX: ffff9f4b20988d80\nRDX: 0000000000000000 RSI: 0000000000000064 RDI: ffffffffc04201c0\nRBP: ffff9f4b29394000 R08: ffff9f4b07f77258 R09: ffff9f4b07f77240\nR10: 0000000000000000 R11: ffff9f4b09635388 R12: 0000000000000000\nR13: ffff9f4b1a3c6c00 R14: ffff9f4b20988e20 R15: 0000000000000004\nFS: 00007f6284340000(0000) GS:ffff9f51fe280000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000013 CR3: 00000001d10a6005 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259)\n ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259)\n ? xt_find_table_lock (net/netfilter/x_tables.c:1259)\n ? __die_body.cold (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420)\n ? page_fault_oops (arch/x86/mm/fault.c:727)\n ? exc_page_fault (./arch/x86/include/asm/irqflags.h:40 ./arch/x86/include/asm/irqflags.h:75 arch/x86/mm/fault.c:1470 arch/x86/mm/fault.c:1518)\n ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:570)\n ? iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat\n xt_find_table_lock (net/netfilter/x_tables.c:1259)\n xt_request_find_table_lock (net/netfilter/x_tables.c:1287)\n get_info (net/ipv4/netfilter/ip_tables.c:965)\n ? security_capable (security/security.c:809 (discriminator 13))\n ? ns_capable (kernel/capability.c:376 kernel/capability.c:397)\n ? do_ipt_get_ctl (net/ipv4/netfilter/ip_tables.c:1656)\n ? bpfilter_send_req (net/bpfilter/bpfilter_kern.c:52) bpfilter\n nf_getsockopt (net/netfilter/nf_sockopt.c:116)\n ip_getsockopt (net/ipv4/ip_sockglue.c:1827)\n __sys_getsockopt (net/socket.c:2327)\n __x64_sys_getsockopt (net/socket.c:2342 net/socket.c:2339 net/socket.c:2339)\n do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:81)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\nRIP: 0033:0x7f62844685ee\nCode: 48 8b 0d 45 28 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 09\nRSP: 002b:00007ffd1f83d638 EFLAGS: 00000246 ORIG_RAX: 0000000000000037\nRAX: ffffffffffffffda RBX: 00007ffd1f83d680 RCX: 00007f62844685ee\nRDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004\nRBP: 0000000000000004 R08: 00007ffd1f83d670 R09: 0000558798ffa2a0\nR10: 00007ffd1f83d680 R11: 0000000000000246 R12: 00007ffd1f83e3b2\nR13: 00007f6284\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:15.789Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b98ddb65fa1674b0e6b52de8af9103b63f51b643" }, { "url": "https://git.kernel.org/stable/c/95590a4929027769af35b153645c0ab6fd22b29b" }, { "url": "https://git.kernel.org/stable/c/70014b73d7539fcbb6b4ff5f37368d7241d8e626" }, { "url": "https://git.kernel.org/stable/c/08ed888b69a22647153fe2bec55b7cd0a46102cc" }, { "url": "https://git.kernel.org/stable/c/5830aa863981d43560748aa93589c0695191d95d" } ], "title": "netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42270", "datePublished": "2024-08-17T08:54:25.178Z", "dateReserved": "2024-07-30T07:40:12.260Z", "dateUpdated": "2024-12-19T09:15:15.789Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42264
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Prevent out of bounds access in performance query extensions
Check that the number of perfmons userspace is passing in the copy and
reset extensions is not greater than the internal kernel storage where
the ids will be copied into.
(cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb)
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42264", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:34.023274Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:32.942Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "73ad583bd4938bf37d2709fc36901eb6f22f2722", "status": "affected", "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "versionType": "git" }, { "lessThan": "6ce9efd12ae81cf46bf44eb0348594558dfbb9d2", "status": "affected", "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Prevent out of bounds access in performance query extensions\n\nCheck that the number of perfmons userspace is passing in the copy and\nreset extensions is not greater than the internal kernel storage where\nthe ids will be copied into.\n\n(cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:08.397Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/73ad583bd4938bf37d2709fc36901eb6f22f2722" }, { "url": "https://git.kernel.org/stable/c/6ce9efd12ae81cf46bf44eb0348594558dfbb9d2" } ], "title": "drm/v3d: Prevent out of bounds access in performance query extensions", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42264", "datePublished": "2024-08-17T08:54:20.908Z", "dateReserved": "2024-07-30T07:40:12.259Z", "dateUpdated": "2024-12-19T09:15:08.397Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43860
Vulnerability from cvelistv5
Published
2024-08-17 09:24
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: imx_rproc: Skip over memory region when node value is NULL
In imx_rproc_addr_init() "nph = of_count_phandle_with_args()" just counts
number of phandles. But phandles may be empty. So of_parse_phandle() in
the parsing loop (0 < a < nph) may return NULL which is later dereferenced.
Adjust this issue by adding NULL-return check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[Fixed title to fit within the prescribed 70-75 charcters]
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: a0ff4aa6f010801b2a61c203c6e09d01b110fddf Version: a0ff4aa6f010801b2a61c203c6e09d01b110fddf Version: a0ff4aa6f010801b2a61c203c6e09d01b110fddf Version: a0ff4aa6f010801b2a61c203c6e09d01b110fddf Version: a0ff4aa6f010801b2a61c203c6e09d01b110fddf Version: a0ff4aa6f010801b2a61c203c6e09d01b110fddf Version: a0ff4aa6f010801b2a61c203c6e09d01b110fddf Version: a0ff4aa6f010801b2a61c203c6e09d01b110fddf |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43860", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:06:55.386082Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:20.012Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/remoteproc/imx_rproc.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6884fd0283e0831be153fb8d82d9eda8a55acaaa", "status": "affected", "version": "a0ff4aa6f010801b2a61c203c6e09d01b110fddf", "versionType": "git" }, { "lessThan": "84beb7738459cac0ff9f8a7c4654b8ff82a702c0", "status": "affected", "version": "a0ff4aa6f010801b2a61c203c6e09d01b110fddf", "versionType": "git" }, { "lessThan": "6b50462b473fdccdc0dfad73001147e40ff19a66", "status": "affected", "version": "a0ff4aa6f010801b2a61c203c6e09d01b110fddf", "versionType": "git" }, { "lessThan": "4e13b7c23988c0a13fdca92e94296a3bc2ff9f21", "status": "affected", "version": "a0ff4aa6f010801b2a61c203c6e09d01b110fddf", "versionType": "git" }, { "lessThan": "9a17cf8b2ce483fa75258bc2cdcf628f24bcf5f8", "status": "affected", "version": "a0ff4aa6f010801b2a61c203c6e09d01b110fddf", "versionType": "git" }, { "lessThan": "6c9ea3547fad252fe9ae5d3ed7e066e2085bf3a2", "status": "affected", "version": "a0ff4aa6f010801b2a61c203c6e09d01b110fddf", "versionType": "git" }, { "lessThan": "c877a5f5268d4ab8224b9c9fbce3d746e4e72bc9", "status": "affected", "version": "a0ff4aa6f010801b2a61c203c6e09d01b110fddf", "versionType": "git" }, { "lessThan": "2fa26ca8b786888673689ccc9da6094150939982", "status": "affected", "version": "a0ff4aa6f010801b2a61c203c6e09d01b110fddf", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/remoteproc/imx_rproc.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.14" }, { "lessThan": "4.14", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: imx_rproc: Skip over memory region when node value is NULL\n\nIn imx_rproc_addr_init() \"nph = of_count_phandle_with_args()\" just counts\nnumber of phandles. But phandles may be empty. So of_parse_phandle() in\nthe parsing loop (0 \u003c a \u003c nph) may return NULL which is later dereferenced.\nAdjust this issue by adding NULL-return check.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[Fixed title to fit within the prescribed 70-75 charcters]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:19.211Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/6884fd0283e0831be153fb8d82d9eda8a55acaaa" }, { "url": "https://git.kernel.org/stable/c/84beb7738459cac0ff9f8a7c4654b8ff82a702c0" }, { "url": "https://git.kernel.org/stable/c/6b50462b473fdccdc0dfad73001147e40ff19a66" }, { "url": "https://git.kernel.org/stable/c/4e13b7c23988c0a13fdca92e94296a3bc2ff9f21" }, { "url": "https://git.kernel.org/stable/c/9a17cf8b2ce483fa75258bc2cdcf628f24bcf5f8" }, { "url": "https://git.kernel.org/stable/c/6c9ea3547fad252fe9ae5d3ed7e066e2085bf3a2" }, { "url": "https://git.kernel.org/stable/c/c877a5f5268d4ab8224b9c9fbce3d746e4e72bc9" }, { "url": "https://git.kernel.org/stable/c/2fa26ca8b786888673689ccc9da6094150939982" } ], "title": "remoteproc: imx_rproc: Skip over memory region when node value is NULL", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43860", "datePublished": "2024-08-17T09:24:29.436Z", "dateReserved": "2024-08-17T09:11:59.279Z", "dateUpdated": "2024-12-19T09:17:19.211Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42315
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 18:32
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
exfat: fix potential deadlock on __exfat_get_dentry_set
When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array
is allocated in __exfat_get_entry_set. The problem is that the bh-array is
allocated with GFP_KERNEL. It does not make sense. In the following cases,
a deadlock for sbi->s_lock between the two processes may occur.
CPU0 CPU1
---- ----
kswapd
balance_pgdat
lock(fs_reclaim)
exfat_iterate
lock(&sbi->s_lock)
exfat_readdir
exfat_get_uniname_from_ext_entry
exfat_get_dentry_set
__exfat_get_dentry_set
kmalloc_array
...
lock(fs_reclaim)
...
evict
exfat_evict_inode
lock(&sbi->s_lock)
To fix this, let's allocate bh-array with GFP_NOFS.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: bd3bdb9e0d656f760b11d0c638d35d7f7068144d Version: 92dcd7d6c6068bf4fd35a6f64d606e27d634807e Version: d8fe01ad2d8ab33aaf8f2efad9e8f1dae11c4b0c Version: a3ff29a95fde16906304455aa8c0bd84eb770258 Version: a3ff29a95fde16906304455aa8c0bd84eb770258 Version: a3ff29a95fde16906304455aa8c0bd84eb770258 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42315", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:45.977516Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:26.638Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/exfat/dir.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "632fb232b6bbf8277edcbe9ecd4b4d98ecb122eb", "status": "affected", "version": "bd3bdb9e0d656f760b11d0c638d35d7f7068144d", "versionType": "git" }, { "lessThan": "c052f775ee6ccacd3c97e4cf41a2a657e63d4259", "status": "affected", "version": "92dcd7d6c6068bf4fd35a6f64d606e27d634807e", "versionType": "git" }, { "lessThan": "cd1c7858641384191ff7033fb1fc65dfcd559c6f", "status": "affected", "version": "d8fe01ad2d8ab33aaf8f2efad9e8f1dae11c4b0c", "versionType": "git" }, { "lessThan": "a7ac198f8dba791e3144c4da48a5a9b95773ee4b", "status": "affected", "version": "a3ff29a95fde16906304455aa8c0bd84eb770258", "versionType": "git" }, { "lessThan": "1d1970493c289e3f44b9ec847ed26a5dbdf56a62", "status": "affected", "version": "a3ff29a95fde16906304455aa8c0bd84eb770258", "versionType": "git" }, { "lessThan": "89fc548767a2155231128cb98726d6d2ea1256c9", "status": "affected", "version": "a3ff29a95fde16906304455aa8c0bd84eb770258", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/exfat/dir.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.2" }, { "lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.232", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.175", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix potential deadlock on __exfat_get_dentry_set\n\nWhen accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array\nis allocated in __exfat_get_entry_set. The problem is that the bh-array is\nallocated with GFP_KERNEL. It does not make sense. In the following cases,\na deadlock for sbi-\u003es_lock between the two processes may occur.\n\n CPU0 CPU1\n ---- ----\n kswapd\n balance_pgdat\n lock(fs_reclaim)\n exfat_iterate\n lock(\u0026sbi-\u003es_lock)\n exfat_readdir\n exfat_get_uniname_from_ext_entry\n exfat_get_dentry_set\n __exfat_get_dentry_set\n kmalloc_array\n ...\n lock(fs_reclaim)\n ...\n evict\n exfat_evict_inode\n lock(\u0026sbi-\u003es_lock)\n\nTo fix this, let\u0027s allocate bh-array with GFP_NOFS." } ], "providerMetadata": { "dateUpdated": "2024-12-19T18:32:38.021Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/632fb232b6bbf8277edcbe9ecd4b4d98ecb122eb" }, { "url": "https://git.kernel.org/stable/c/c052f775ee6ccacd3c97e4cf41a2a657e63d4259" }, { "url": "https://git.kernel.org/stable/c/cd1c7858641384191ff7033fb1fc65dfcd559c6f" }, { "url": "https://git.kernel.org/stable/c/a7ac198f8dba791e3144c4da48a5a9b95773ee4b" }, { "url": "https://git.kernel.org/stable/c/1d1970493c289e3f44b9ec847ed26a5dbdf56a62" }, { "url": "https://git.kernel.org/stable/c/89fc548767a2155231128cb98726d6d2ea1256c9" } ], "title": "exfat: fix potential deadlock on __exfat_get_dentry_set", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42315", "datePublished": "2024-08-17T09:09:23.779Z", "dateReserved": "2024-07-30T07:40:12.278Z", "dateUpdated": "2024-12-19T18:32:38.021Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43822
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoc: PCM6240: Return directly after a failed devm_kzalloc() in pcmdevice_i2c_probe()
The value “-ENOMEM” was assigned to the local variable “ret”
in one if branch after a devm_kzalloc() call failed at the beginning.
This error code will trigger then a pcmdevice_remove() call with a passed
null pointer so that an undesirable dereference will be performed.
Thus return the appropriate error code directly.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43822", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:57.547820Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:24.816Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "sound/soc/codecs/pcm6240.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "fa6f16eff7320c91e908309e31be34cbbe4b7e58", "status": "affected", "version": "1324eafd37aa5c5b970c1b48a857acc81f0685c8", "versionType": "git" }, { "lessThan": "3722873d49a1788d5420894d4f6f63e35f5c1f13", "status": "affected", "version": "1324eafd37aa5c5b970c1b48a857acc81f0685c8", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "sound/soc/codecs/pcm6240.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoc: PCM6240: Return directly after a failed devm_kzalloc() in pcmdevice_i2c_probe()\n\nThe value \u201c-ENOMEM\u201d was assigned to the local variable \u201cret\u201d\nin one if branch after a devm_kzalloc() call failed at the beginning.\nThis error code will trigger then a pcmdevice_remove() call with a passed\nnull pointer so that an undesirable dereference will be performed.\nThus return the appropriate error code directly." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:32.971Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/fa6f16eff7320c91e908309e31be34cbbe4b7e58" }, { "url": "https://git.kernel.org/stable/c/3722873d49a1788d5420894d4f6f63e35f5c1f13" } ], "title": "ASoc: PCM6240: Return directly after a failed devm_kzalloc() in pcmdevice_i2c_probe()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43822", "datePublished": "2024-08-17T09:21:42.997Z", "dateReserved": "2024-08-17T09:11:59.271Z", "dateUpdated": "2024-12-19T09:16:32.971Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43855
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md: fix deadlock between mddev_suspend and flush bio
Deadlock occurs when mddev is being suspended while some flush bio is in
progress. It is a complex issue.
T1. the first flush is at the ending stage, it clears 'mddev->flush_bio'
and tries to submit data, but is blocked because mddev is suspended
by T4.
T2. the second flush sets 'mddev->flush_bio', and attempts to queue
md_submit_flush_data(), which is already running (T1) and won't
execute again if on the same CPU as T1.
T3. the third flush inc active_io and tries to flush, but is blocked because
'mddev->flush_bio' is not NULL (set by T2).
T4. mddev_suspend() is called and waits for active_io dec to 0 which is inc
by T3.
T1 T2 T3 T4
(flush 1) (flush 2) (third 3) (suspend)
md_submit_flush_data
mddev->flush_bio = NULL;
.
. md_flush_request
. mddev->flush_bio = bio
. queue submit_flushes
. .
. . md_handle_request
. . active_io + 1
. . md_flush_request
. . wait !mddev->flush_bio
. .
. . mddev_suspend
. . wait !active_io
. .
. submit_flushes
. queue_work md_submit_flush_data
. //md_submit_flush_data is already running (T1)
.
md_handle_request
wait resume
The root issue is non-atomic inc/dec of active_io during flush process.
active_io is dec before md_submit_flush_data is queued, and inc soon
after md_submit_flush_data() run.
md_flush_request
active_io + 1
submit_flushes
active_io - 1
md_submit_flush_data
md_handle_request
active_io + 1
make_request
active_io - 1
If active_io is dec after md_handle_request() instead of within
submit_flushes(), make_request() can be called directly intead of
md_handle_request() in md_submit_flush_data(), and active_io will
only inc and dec once in the whole flush process. Deadlock will be
fixed.
Additionally, the only difference between fixing the issue and before is
that there is no return error handling of make_request(). But after
previous patch cleaned md_write_start(), make_requst() only return error
in raid5_make_request() by dm-raid, see commit 41425f96d7aa ("dm-raid456,
md/raid456: fix a deadlock for dm-raid456 while io concurrent with
reshape)". Since dm always splits data and flush operation into two
separate io, io size of flush submitted by dm always is 0, make_request()
will not be called in md_submit_flush_data(). To prevent future
modifications from introducing issues, add WARN_ON to ensure
make_request() no error is returned in this context.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43855", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:11.388425Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:20.659Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/md/md.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "32226070813140234b6c507084738e8e8385c5c6", "status": "affected", "version": "f9f2d957a8ea93c73182aebf7de30935a58c027d", "versionType": "git" }, { "lessThan": "2d0738a8322bf4e5bfe693d16b3111928a9ccfbf", "status": "affected", "version": "530cec617f5a8ba6f26bcbf0d64d75c951d17730", "versionType": "git" }, { "lessThan": "ca963eefbc3331222b6121baa696d49ba2008811", "status": "affected", "version": "fa2bbff7b0b4e211fec5e5686ef96350690597b5", "versionType": "git" }, { "lessThan": "611d5cbc0b35a752e657a83eebadf40d814d006b", "status": "affected", "version": "fa2bbff7b0b4e211fec5e5686ef96350690597b5", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/md/md.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears \u0027mddev-\u003eflush_bio\u0027\n and tries to submit data, but is blocked because mddev is suspended\n by T4.\nT2. the second flush sets \u0027mddev-\u003eflush_bio\u0027, and attempts to queue\n md_submit_flush_data(), which is already running (T1) and won\u0027t\n execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n \u0027mddev-\u003eflush_bio\u0027 is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n by T3.\n\n T1\t\tT2\t\tT3\t\tT4\n (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n md_submit_flush_data\n mddev-\u003eflush_bio = NULL;\n .\n .\t \tmd_flush_request\n .\t \t mddev-\u003eflush_bio = bio\n .\t \t queue submit_flushes\n .\t\t .\n .\t\t .\t\tmd_handle_request\n .\t\t .\t\t active_io + 1\n .\t\t .\t\t md_flush_request\n .\t\t .\t\t wait !mddev-\u003eflush_bio\n .\t\t .\n .\t\t .\t\t\t\tmddev_suspend\n .\t\t .\t\t\t\t wait !active_io\n .\t\t .\n .\t\t submit_flushes\n .\t\t queue_work md_submit_flush_data\n .\t\t //md_submit_flush_data is already running (T1)\n .\n md_handle_request\n wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n md_flush_request\n active_io + 1\n submit_flushes\n active_io - 1\n md_submit_flush_data\n md_handle_request\n active_io + 1\n make_request\n active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:13.493Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/32226070813140234b6c507084738e8e8385c5c6" }, { "url": "https://git.kernel.org/stable/c/2d0738a8322bf4e5bfe693d16b3111928a9ccfbf" }, { "url": "https://git.kernel.org/stable/c/ca963eefbc3331222b6121baa696d49ba2008811" }, { "url": "https://git.kernel.org/stable/c/611d5cbc0b35a752e657a83eebadf40d814d006b" } ], "title": "md: fix deadlock between mddev_suspend and flush bio", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43855", "datePublished": "2024-08-17T09:22:11.985Z", "dateReserved": "2024-08-17T09:11:59.278Z", "dateUpdated": "2024-12-19T09:17:13.493Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42281
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix a segment issue when downgrading gso_size
Linearize the skb when downgrading gso_size because it may trigger a
BUG_ON() later when the skb is segmented as described in [1,2].
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 2be7e212d5419a400d051c84ca9fdd083e5aacac Version: 2be7e212d5419a400d051c84ca9fdd083e5aacac Version: 2be7e212d5419a400d051c84ca9fdd083e5aacac Version: 2be7e212d5419a400d051c84ca9fdd083e5aacac Version: 2be7e212d5419a400d051c84ca9fdd083e5aacac Version: 2be7e212d5419a400d051c84ca9fdd083e5aacac Version: 2be7e212d5419a400d051c84ca9fdd083e5aacac |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42281", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:36.471436Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:30.904Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/core/filter.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "a689f5eb13a90f892a088865478b3cd39f53d5dc", "status": "affected", "version": "2be7e212d5419a400d051c84ca9fdd083e5aacac", "versionType": "git" }, { "lessThan": "dda518dea60d556a2d171c0122ca7d9fdb7d473a", "status": "affected", "version": "2be7e212d5419a400d051c84ca9fdd083e5aacac", "versionType": "git" }, { "lessThan": "f6bb8c90cab97a3e03f8d30e3069efe6a742e0be", "status": "affected", "version": "2be7e212d5419a400d051c84ca9fdd083e5aacac", "versionType": "git" }, { "lessThan": "11ec79f5c7f74261874744039bc1551023edd6b2", "status": "affected", "version": "2be7e212d5419a400d051c84ca9fdd083e5aacac", "versionType": "git" }, { "lessThan": "c3496314c53e7e82ddb544c825defc3e8c0e45cf", "status": "affected", "version": "2be7e212d5419a400d051c84ca9fdd083e5aacac", "versionType": "git" }, { "lessThan": "ec4eea14d75f7b0491194dd413f540dd19b8c733", "status": "affected", "version": "2be7e212d5419a400d051c84ca9fdd083e5aacac", "versionType": "git" }, { "lessThan": "fa5ef655615a01533035c6139248c5b33aa27028", "status": "affected", "version": "2be7e212d5419a400d051c84ca9fdd083e5aacac", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/core/filter.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.13" }, { "lessThan": "4.13", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a segment issue when downgrading gso_size\n\nLinearize the skb when downgrading gso_size because it may trigger a\nBUG_ON() later when the skb is segmented as described in [1,2]." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:33.799Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/a689f5eb13a90f892a088865478b3cd39f53d5dc" }, { "url": "https://git.kernel.org/stable/c/dda518dea60d556a2d171c0122ca7d9fdb7d473a" }, { "url": "https://git.kernel.org/stable/c/f6bb8c90cab97a3e03f8d30e3069efe6a742e0be" }, { "url": "https://git.kernel.org/stable/c/11ec79f5c7f74261874744039bc1551023edd6b2" }, { "url": "https://git.kernel.org/stable/c/c3496314c53e7e82ddb544c825defc3e8c0e45cf" }, { "url": "https://git.kernel.org/stable/c/ec4eea14d75f7b0491194dd413f540dd19b8c733" }, { "url": "https://git.kernel.org/stable/c/fa5ef655615a01533035c6139248c5b33aa27028" } ], "title": "bpf: Fix a segment issue when downgrading gso_size", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42281", "datePublished": "2024-08-17T09:08:48.477Z", "dateReserved": "2024-07-30T07:40:12.261Z", "dateUpdated": "2024-12-19T09:15:33.799Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42309
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is
assigned to mode, which will lead to a possible NULL pointer dereference
on failure of drm_mode_duplicate(). Add a check to avoid npd.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 89c78134cc54dff016c83367912eb055637fa50c Version: 89c78134cc54dff016c83367912eb055637fa50c Version: 89c78134cc54dff016c83367912eb055637fa50c Version: 89c78134cc54dff016c83367912eb055637fa50c Version: 89c78134cc54dff016c83367912eb055637fa50c Version: 89c78134cc54dff016c83367912eb055637fa50c Version: 89c78134cc54dff016c83367912eb055637fa50c Version: 89c78134cc54dff016c83367912eb055637fa50c |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42309", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:05.824030Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:27.439Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/gma500/psb_intel_lvds.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "13b5f3ee94bdbdc4b5f40582aab62977905aedee", "status": "affected", "version": "89c78134cc54dff016c83367912eb055637fa50c", "versionType": "git" }, { "lessThan": "d6ad202f73f8edba0cbc0065aa57a79ffe8fdcdc", "status": "affected", "version": "89c78134cc54dff016c83367912eb055637fa50c", "versionType": "git" }, { "lessThan": "6735d02ead7dd3adf74eb8b70aebd09e0ce78ec9", "status": "affected", "version": "89c78134cc54dff016c83367912eb055637fa50c", "versionType": "git" }, { "lessThan": "7e52c62ff029f95005915c0a11863b5fb5185c8c", "status": "affected", "version": "89c78134cc54dff016c83367912eb055637fa50c", "versionType": "git" }, { "lessThan": "f70ffeca546452d1acd3a70ada56ecb2f3e7f811", "status": "affected", "version": "89c78134cc54dff016c83367912eb055637fa50c", "versionType": "git" }, { "lessThan": "46d2ef272957879cbe30a884574320e7f7d78692", "status": "affected", "version": "89c78134cc54dff016c83367912eb055637fa50c", "versionType": "git" }, { "lessThan": "475a5b3b7c8edf6e583a9eb59cf28ea770602e14", "status": "affected", "version": "89c78134cc54dff016c83367912eb055637fa50c", "versionType": "git" }, { "lessThan": "2df7aac81070987b0f052985856aa325a38debf6", "status": "affected", "version": "89c78134cc54dff016c83367912eb055637fa50c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/gma500/psb_intel_lvds.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.3" }, { "lessThan": "3.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes\n\nIn psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:06.811Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/13b5f3ee94bdbdc4b5f40582aab62977905aedee" }, { "url": "https://git.kernel.org/stable/c/d6ad202f73f8edba0cbc0065aa57a79ffe8fdcdc" }, { "url": "https://git.kernel.org/stable/c/6735d02ead7dd3adf74eb8b70aebd09e0ce78ec9" }, { "url": "https://git.kernel.org/stable/c/7e52c62ff029f95005915c0a11863b5fb5185c8c" }, { "url": "https://git.kernel.org/stable/c/f70ffeca546452d1acd3a70ada56ecb2f3e7f811" }, { "url": "https://git.kernel.org/stable/c/46d2ef272957879cbe30a884574320e7f7d78692" }, { "url": "https://git.kernel.org/stable/c/475a5b3b7c8edf6e583a9eb59cf28ea770602e14" }, { "url": "https://git.kernel.org/stable/c/2df7aac81070987b0f052985856aa325a38debf6" } ], "title": "drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42309", "datePublished": "2024-08-17T09:09:14.164Z", "dateReserved": "2024-07-30T07:40:12.276Z", "dateUpdated": "2024-12-19T09:16:06.811Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42289
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: During vport delete send async logout explicitly
During vport delete, it is observed that during unload we hit a crash
because of stale entries in outstanding command array. For all these stale
I/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but
I/Os could not complete while vport delete is in process of deleting.
BUG: kernel NULL pointer dereference, address: 000000000000001c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
Workqueue: qla2xxx_wq qla_do_work [qla2xxx]
RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0
RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000001
RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0
RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8
R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0
Call Trace:
<TASK>
qla2xxx_qpair_sp_free_dma+0x417/0x4e0
? qla2xxx_qpair_sp_compl+0x10d/0x1a0
? qla2x00_status_entry+0x768/0x2830
? newidle_balance+0x2f0/0x430
? dequeue_entity+0x100/0x3c0
? qla24xx_process_response_queue+0x6a1/0x19e0
? __schedule+0x2d5/0x1140
? qla_do_work+0x47/0x60
? process_one_work+0x267/0x440
? process_one_work+0x440/0x440
? worker_thread+0x2d/0x3d0
? process_one_work+0x440/0x440
? kthread+0x156/0x180
? set_kthread_struct+0x50/0x50
? ret_from_fork+0x22/0x30
</TASK>
Send out async logout explicitly for all the ports during vport delete.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42289", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:10.283568Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:29.913Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/scsi/qla2xxx/qla_mid.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "086489256696eb774654a5410e86381c346356fe", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "171ac4b495f9473bc134356a00095b47e6409e52", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "e5ed6a26ffdec0c91cf0b6138afbd675c00ad5fc", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "b12c54e51ba83c1fbc619d35083d7872e42ecdef", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "d28a2075bb530489715a3b011e1dd8765ba20313", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "87c25fcb95aafabb6a4914239f4ab41b07a4f9b7", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "b35d6d5a2f38605cddea7d5c64cded894fbe8ede", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "76f480d7c717368f29a3870f7d64471ce0ff8fb2", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/scsi/qla2xxx/qla_mid.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: During vport delete send async logout explicitly\n\nDuring vport delete, it is observed that during unload we hit a crash\nbecause of stale entries in outstanding command array. For all these stale\nI/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but\nI/Os could not complete while vport delete is in process of deleting.\n\n BUG: kernel NULL pointer dereference, address: 000000000000001c\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n Workqueue: qla2xxx_wq qla_do_work [qla2xxx]\n RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0\n RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046\n RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000001\n RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0\n RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8\n R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: 0000000000000000\n R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0\n Call Trace:\n \u003cTASK\u003e\n qla2xxx_qpair_sp_free_dma+0x417/0x4e0\n ? qla2xxx_qpair_sp_compl+0x10d/0x1a0\n ? qla2x00_status_entry+0x768/0x2830\n ? newidle_balance+0x2f0/0x430\n ? dequeue_entity+0x100/0x3c0\n ? qla24xx_process_response_queue+0x6a1/0x19e0\n ? __schedule+0x2d5/0x1140\n ? qla_do_work+0x47/0x60\n ? process_one_work+0x267/0x440\n ? process_one_work+0x440/0x440\n ? worker_thread+0x2d/0x3d0\n ? process_one_work+0x440/0x440\n ? kthread+0x156/0x180\n ? set_kthread_struct+0x50/0x50\n ? ret_from_fork+0x22/0x30\n \u003c/TASK\u003e\n\nSend out async logout explicitly for all the ports during vport delete." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:43.055Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/086489256696eb774654a5410e86381c346356fe" }, { "url": "https://git.kernel.org/stable/c/171ac4b495f9473bc134356a00095b47e6409e52" }, { "url": "https://git.kernel.org/stable/c/e5ed6a26ffdec0c91cf0b6138afbd675c00ad5fc" }, { "url": "https://git.kernel.org/stable/c/b12c54e51ba83c1fbc619d35083d7872e42ecdef" }, { "url": "https://git.kernel.org/stable/c/d28a2075bb530489715a3b011e1dd8765ba20313" }, { "url": "https://git.kernel.org/stable/c/87c25fcb95aafabb6a4914239f4ab41b07a4f9b7" }, { "url": "https://git.kernel.org/stable/c/b35d6d5a2f38605cddea7d5c64cded894fbe8ede" }, { "url": "https://git.kernel.org/stable/c/76f480d7c717368f29a3870f7d64471ce0ff8fb2" } ], "title": "scsi: qla2xxx: During vport delete send async logout explicitly", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42289", "datePublished": "2024-08-17T09:08:59.113Z", "dateReserved": "2024-07-30T07:40:12.267Z", "dateUpdated": "2024-12-19T09:15:43.055Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42272
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched: act_ct: take care of padding in struct zones_ht_key
Blamed commit increased lookup key size from 2 bytes to 16 bytes,
because zones_ht_key got a struct net pointer.
Make sure rhashtable_lookup() is not using the padding bytes
which are not initialized.
BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
__rhashtable_lookup include/linux/rhashtable.h:607 [inline]
rhashtable_lookup include/linux/rhashtable.h:646 [inline]
rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425
tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488
tcf_action_add net/sched/act_api.c:2061 [inline]
tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118
rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647
netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665
netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357
netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
____sys_sendmsg+0x877/0xb60 net/socket.c:2597
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651
__sys_sendmsg net/socket.c:2680 [inline]
__do_sys_sendmsg net/socket.c:2689 [inline]
__se_sys_sendmsg net/socket.c:2687 [inline]
__x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687
x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable key created at:
tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324
tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 03f625505e27f709390a86c9b78d3707f4c23df8 Version: aa1f81fe3a059bc984b230b5352ab89d06aa3c7b Version: 2f82f75f843445daa81e8b2a76774b1348033ce6 Version: 9126fd82e9edc7b4796f756e4b258d34f17e5e4a Version: 88c67aeb14070bab61d3dd8be96c8b42ebcaf53a Version: 88c67aeb14070bab61d3dd8be96c8b42ebcaf53a |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42272", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:08.203348Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:05.421Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/sched/act_ct.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "7c03ab555eb1ba26c77fd7c25bdf44a0ac23edee", "status": "affected", "version": "03f625505e27f709390a86c9b78d3707f4c23df8", "versionType": "git" }, { "lessThan": "3ddefcb8f75e312535e2e7d5fef9932019ba60f2", "status": "affected", "version": "aa1f81fe3a059bc984b230b5352ab89d06aa3c7b", "versionType": "git" }, { "lessThan": "d06daf0ad645d9225a3ff6958dd82e1f3988fa64", "status": "affected", "version": "2f82f75f843445daa81e8b2a76774b1348033ce6", "versionType": "git" }, { "lessThan": "d7cc186d0973afce0e1237c37f7512c01981fb79", "status": "affected", "version": "9126fd82e9edc7b4796f756e4b258d34f17e5e4a", "versionType": "git" }, { "lessThan": "3a5b68869dbe14f1157c6a24ac71923db060eeab", "status": "affected", "version": "88c67aeb14070bab61d3dd8be96c8b42ebcaf53a", "versionType": "git" }, { "lessThan": "2191a54f63225b548fd8346be3611c3219a24738", "status": "affected", "version": "88c67aeb14070bab61d3dd8be96c8b42ebcaf53a", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/sched/act_ct.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: act_ct: take care of padding in struct zones_ht_key\n\nBlamed commit increased lookup key size from 2 bytes to 16 bytes,\nbecause zones_ht_key got a struct net pointer.\n\nMake sure rhashtable_lookup() is not using the padding bytes\nwhich are not initialized.\n\n BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]\n BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]\n BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\n BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329\n rht_ptr_rcu include/linux/rhashtable.h:376 [inline]\n __rhashtable_lookup include/linux/rhashtable.h:607 [inline]\n rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\n tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329\n tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408\n tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425\n tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488\n tcf_action_add net/sched/act_api.c:2061 [inline]\n tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118\n rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647\n netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550\n rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665\n netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]\n netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357\n netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:745\n ____sys_sendmsg+0x877/0xb60 net/socket.c:2597\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651\n __sys_sendmsg net/socket.c:2680 [inline]\n __do_sys_sendmsg net/socket.c:2689 [inline]\n __se_sys_sendmsg net/socket.c:2687 [inline]\n __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687\n x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable key created at:\n tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324\n tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:18.265Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/7c03ab555eb1ba26c77fd7c25bdf44a0ac23edee" }, { "url": "https://git.kernel.org/stable/c/3ddefcb8f75e312535e2e7d5fef9932019ba60f2" }, { "url": "https://git.kernel.org/stable/c/d06daf0ad645d9225a3ff6958dd82e1f3988fa64" }, { "url": "https://git.kernel.org/stable/c/d7cc186d0973afce0e1237c37f7512c01981fb79" }, { "url": "https://git.kernel.org/stable/c/3a5b68869dbe14f1157c6a24ac71923db060eeab" }, { "url": "https://git.kernel.org/stable/c/2191a54f63225b548fd8346be3611c3219a24738" } ], "title": "sched: act_ct: take care of padding in struct zones_ht_key", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42272", "datePublished": "2024-08-17T08:54:26.755Z", "dateReserved": "2024-07-30T07:40:12.260Z", "dateUpdated": "2024-12-19T09:15:18.265Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42279
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
While transmitting with rx_len == 0, the RX FIFO is not going to be
emptied in the interrupt handler. A subsequent transfer could then
read crap from the previous transfer out of the RX FIFO into the
start RX buffer. The core provides a register that will empty the RX and
TX FIFOs, so do that before each transfer.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42279", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:42.802690Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:31.191Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/spi/spi-microchip-core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "3feda3677e8bbe833c3a62a4091377a08f015b80", "status": "affected", "version": "9ac8d17694b66d54b13e9718b25c14ca36dbebbd", "versionType": "git" }, { "lessThan": "45e03d35229b680b79dfea1103a1f2f07d0b5d75", "status": "affected", "version": "9ac8d17694b66d54b13e9718b25c14ca36dbebbd", "versionType": "git" }, { "lessThan": "9cf71eb0faef4bff01df4264841b8465382d7927", "status": "affected", "version": "9ac8d17694b66d54b13e9718b25c14ca36dbebbd", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/spi/spi-microchip-core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer\n\nWhile transmitting with rx_len == 0, the RX FIFO is not going to be\nemptied in the interrupt handler. A subsequent transfer could then\nread crap from the previous transfer out of the RX FIFO into the\nstart RX buffer. The core provides a register that will empty the RX and\nTX FIFOs, so do that before each transfer." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:31.471Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/3feda3677e8bbe833c3a62a4091377a08f015b80" }, { "url": "https://git.kernel.org/stable/c/45e03d35229b680b79dfea1103a1f2f07d0b5d75" }, { "url": "https://git.kernel.org/stable/c/9cf71eb0faef4bff01df4264841b8465382d7927" } ], "title": "spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42279", "datePublished": "2024-08-17T09:08:46.829Z", "dateReserved": "2024-07-30T07:40:12.261Z", "dateUpdated": "2024-12-19T09:15:31.471Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43831
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: Handle invalid decoder vsi
Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi
is valid for future use.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43831", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:27.988158Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:23.652Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1c109f23b271a02b9bb195c173fab41e3285a8db", "status": "affected", "version": "590577a4e5257ac3ed72999a94666ad6ba8f24bc", "versionType": "git" }, { "lessThan": "cdf05ae76198c513836bde4eb55f099c44773280", "status": "affected", "version": "590577a4e5257ac3ed72999a94666ad6ba8f24bc", "versionType": "git" }, { "lessThan": "59d438f8e02ca641c58d77e1feffa000ff809e9f", "status": "affected", "version": "590577a4e5257ac3ed72999a94666ad6ba8f24bc", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.10" }, { "lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Handle invalid decoder vsi\n\nHandle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi\nis valid for future use." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:43.642Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1c109f23b271a02b9bb195c173fab41e3285a8db" }, { "url": "https://git.kernel.org/stable/c/cdf05ae76198c513836bde4eb55f099c44773280" }, { "url": "https://git.kernel.org/stable/c/59d438f8e02ca641c58d77e1feffa000ff809e9f" } ], "title": "media: mediatek: vcodec: Handle invalid decoder vsi", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43831", "datePublished": "2024-08-17T09:21:49.593Z", "dateReserved": "2024-08-17T09:11:59.273Z", "dateUpdated": "2024-12-19T09:16:43.642Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43852
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (ltc2991) re-order conditions to fix off by one bug
LTC2991_T_INT_CH_NR is 4. The st->temp_en[] array has LTC2991_MAX_CHANNEL
(4) elements. Thus if "channel" is equal to LTC2991_T_INT_CH_NR then we
have read one element beyond the end of the array. Flip the conditions
around so that we check if "channel" is valid before using it as an array
index.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43852", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:20.867385Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:21.036Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/hwmon/ltc2991.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c180311c0a520692e2d0e9ca44dcd6c2ff1b41c4", "status": "affected", "version": "2b9ea4262ae9114b0b86ac893b4d6175d8520001", "versionType": "git" }, { "lessThan": "99bf7c2eccff82760fa23ce967cc67c8c219c6a6", "status": "affected", "version": "2b9ea4262ae9114b0b86ac893b4d6175d8520001", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/hwmon/ltc2991.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.7" }, { "lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc2991) re-order conditions to fix off by one bug\n\nLTC2991_T_INT_CH_NR is 4. The st-\u003etemp_en[] array has LTC2991_MAX_CHANNEL\n(4) elements. Thus if \"channel\" is equal to LTC2991_T_INT_CH_NR then we\nhave read one element beyond the end of the array. Flip the conditions\naround so that we check if \"channel\" is valid before using it as an array\nindex." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:09.895Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c180311c0a520692e2d0e9ca44dcd6c2ff1b41c4" }, { "url": "https://git.kernel.org/stable/c/99bf7c2eccff82760fa23ce967cc67c8c219c6a6" } ], "title": "hwmon: (ltc2991) re-order conditions to fix off by one bug", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43852", "datePublished": "2024-08-17T09:22:09.844Z", "dateReserved": "2024-08-17T09:11:59.277Z", "dateUpdated": "2024-12-19T09:17:09.895Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42313
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: venus: fix use after free in vdec_close
There appears to be a possible use after free with vdec_close().
The firmware will add buffer release work to the work queue through
HFI callbacks as a normal part of decoding. Randomly closing the
decoder device from userspace during normal decoding can incur
a read after free for inst.
Fix it by cancelling the work in vdec_close.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: af2c3834c8ca7cc65d15592ac671933df8848115 Version: af2c3834c8ca7cc65d15592ac671933df8848115 Version: af2c3834c8ca7cc65d15592ac671933df8848115 Version: af2c3834c8ca7cc65d15592ac671933df8848115 Version: af2c3834c8ca7cc65d15592ac671933df8848115 Version: af2c3834c8ca7cc65d15592ac671933df8848115 Version: af2c3834c8ca7cc65d15592ac671933df8848115 Version: af2c3834c8ca7cc65d15592ac671933df8848115 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42313", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:52.303644Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:26.779Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/media/platform/qcom/venus/vdec.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ad8cf035baf29467158e0550c7a42b7bb43d1db6", "status": "affected", "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "versionType": "git" }, { "lessThan": "72aff311194c8ceda934f24fd6f250b8827d7567", "status": "affected", "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "versionType": "git" }, { "lessThan": "4c9d235630d35db762b85a4149bbb0be9d504c36", "status": "affected", "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "versionType": "git" }, { "lessThan": "f8e9a63b982a8345470c225679af4ba86e4a7282", "status": "affected", "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "versionType": "git" }, { "lessThan": "da55685247f409bf7f976cc66ba2104df75d8dad", "status": "affected", "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "versionType": "git" }, { "lessThan": "66fa52edd32cdbb675f0803b3c4da10ea19b6635", "status": "affected", "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "versionType": "git" }, { "lessThan": "6a96041659e834dc0b172dda4b2df512d63920c2", "status": "affected", "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "versionType": "git" }, { "lessThan": "a0157b5aa34eb43ec4c5510f9c260bbb03be937e", "status": "affected", "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/media/platform/qcom/venus/vdec.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.13" }, { "lessThan": "4.13", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free in vdec_close\n\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\n\nFix it by cancelling the work in vdec_close." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:11.778Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ad8cf035baf29467158e0550c7a42b7bb43d1db6" }, { "url": "https://git.kernel.org/stable/c/72aff311194c8ceda934f24fd6f250b8827d7567" }, { "url": "https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36" }, { "url": "https://git.kernel.org/stable/c/f8e9a63b982a8345470c225679af4ba86e4a7282" }, { "url": "https://git.kernel.org/stable/c/da55685247f409bf7f976cc66ba2104df75d8dad" }, { "url": "https://git.kernel.org/stable/c/66fa52edd32cdbb675f0803b3c4da10ea19b6635" }, { "url": "https://git.kernel.org/stable/c/6a96041659e834dc0b172dda4b2df512d63920c2" }, { "url": "https://git.kernel.org/stable/c/a0157b5aa34eb43ec4c5510f9c260bbb03be937e" } ], "title": "media: venus: fix use after free in vdec_close", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42313", "datePublished": "2024-08-17T09:09:17.334Z", "dateReserved": "2024-07-30T07:40:12.277Z", "dateUpdated": "2024-12-19T09:16:11.778Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42317
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: avoid PMD-size page cache if needed
xarray can't support arbitrary page cache size. the largest and supported
page cache size is defined as MAX_PAGECACHE_ORDER by commit 099d90642a71
("mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray"). However,
it's possible to have 512MB page cache in the huge memory's collapsing
path on ARM64 system whose base page size is 64KB. 512MB page cache is
breaking the limitation and a warning is raised when the xarray entry is
split as shown in the following example.
[root@dhcp-10-26-1-207 ~]# cat /proc/1/smaps | grep KernelPageSize
KernelPageSize: 64 kB
[root@dhcp-10-26-1-207 ~]# cat /tmp/test.c
:
int main(int argc, char **argv)
{
const char *filename = TEST_XFS_FILENAME;
int fd = 0;
void *buf = (void *)-1, *p;
int pgsize = getpagesize();
int ret = 0;
if (pgsize != 0x10000) {
fprintf(stdout, "System with 64KB base page size is required!\n");
return -EPERM;
}
system("echo 0 > /sys/devices/virtual/bdi/253:0/read_ahead_kb");
system("echo 1 > /proc/sys/vm/drop_caches");
/* Open the xfs file */
fd = open(filename, O_RDONLY);
assert(fd > 0);
/* Create VMA */
buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ, MAP_SHARED, fd, 0);
assert(buf != (void *)-1);
fprintf(stdout, "mapped buffer at 0x%p\n", buf);
/* Populate VMA */
ret = madvise(buf, TEST_MEM_SIZE, MADV_NOHUGEPAGE);
assert(ret == 0);
ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_READ);
assert(ret == 0);
/* Collapse VMA */
ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);
assert(ret == 0);
ret = madvise(buf, TEST_MEM_SIZE, MADV_COLLAPSE);
if (ret) {
fprintf(stdout, "Error %d to madvise(MADV_COLLAPSE)\n", errno);
goto out;
}
/* Split xarray entry. Write permission is needed */
munmap(buf, TEST_MEM_SIZE);
buf = (void *)-1;
close(fd);
fd = open(filename, O_RDWR);
assert(fd > 0);
fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,
TEST_MEM_SIZE - pgsize, pgsize);
out:
if (buf != (void *)-1)
munmap(buf, TEST_MEM_SIZE);
if (fd > 0)
close(fd);
return ret;
}
[root@dhcp-10-26-1-207 ~]# gcc /tmp/test.c -o /tmp/test
[root@dhcp-10-26-1-207 ~]# /tmp/test
------------[ cut here ]------------
WARNING: CPU: 25 PID: 7560 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128
Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \
nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \
nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \
ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse \
xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 virtio_net \
sha1_ce net_failover virtio_blk virtio_console failover dimlib virtio_mmio
CPU: 25 PID: 7560 Comm: test Kdump: loaded Not tainted 6.10.0-rc7-gavin+ #9
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : xas_split_alloc+0xf8/0x128
lr : split_huge_page_to_list_to_order+0x1c4/0x780
sp : ffff8000ac32f660
x29: ffff8000ac32f660 x28: ffff0000e0969eb0 x27: ffff8000ac32f6c0
x26: 0000000000000c40 x25: ffff0000e0969eb0 x24: 000000000000000d
x23: ffff8000ac32f6c0 x22: ffffffdfc0700000 x21: 0000000000000000
x20: 0000000000000000 x19: ffffffdfc0700000 x18: 0000000000000000
x17: 0000000000000000 x16: ffffd5f3708ffc70 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: ffffffffffffffc0 x10: 0000000000000040 x9 : ffffd5f3708e692c
x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff0000e0969eb8
x5 : ffffd5f37289e378 x4 : 0000000000000000 x3 : 0000000000000c40
x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000
Call trace:
xas_split_alloc+0xf8/0x128
split_huge_page_to_list_to_order+0x1c4/0x780
truncate_inode_partial_folio+0xdc/0x160
truncate_inode_pages_range+0x1b4/0x4a8
truncate_pagecache_range+0x84/0xa
---truncated---
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42317", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:38.858847Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:26.338Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "include/linux/huge_mm.h", "mm/huge_memory.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e60f62f75c99740a28e2bf7e6044086033012a16", "status": "affected", "version": "6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3", "versionType": "git" }, { "lessThan": "d659b715e94ac039803d7601505d3473393fc0be", "status": "affected", "version": "6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "include/linux/huge_mm.h", "mm/huge_memory.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.17" }, { "lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: avoid PMD-size page cache if needed\n\nxarray can\u0027t support arbitrary page cache size. the largest and supported\npage cache size is defined as MAX_PAGECACHE_ORDER by commit 099d90642a71\n(\"mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray\"). However,\nit\u0027s possible to have 512MB page cache in the huge memory\u0027s collapsing\npath on ARM64 system whose base page size is 64KB. 512MB page cache is\nbreaking the limitation and a warning is raised when the xarray entry is\nsplit as shown in the following example.\n\n[root@dhcp-10-26-1-207 ~]# cat /proc/1/smaps | grep KernelPageSize\nKernelPageSize: 64 kB\n[root@dhcp-10-26-1-207 ~]# cat /tmp/test.c\n :\nint main(int argc, char **argv)\n{\n\tconst char *filename = TEST_XFS_FILENAME;\n\tint fd = 0;\n\tvoid *buf = (void *)-1, *p;\n\tint pgsize = getpagesize();\n\tint ret = 0;\n\n\tif (pgsize != 0x10000) {\n\t\tfprintf(stdout, \"System with 64KB base page size is required!\\n\");\n\t\treturn -EPERM;\n\t}\n\n\tsystem(\"echo 0 \u003e /sys/devices/virtual/bdi/253:0/read_ahead_kb\");\n\tsystem(\"echo 1 \u003e /proc/sys/vm/drop_caches\");\n\n\t/* Open the xfs file */\n\tfd = open(filename, O_RDONLY);\n\tassert(fd \u003e 0);\n\n\t/* Create VMA */\n\tbuf = mmap(NULL, TEST_MEM_SIZE, PROT_READ, MAP_SHARED, fd, 0);\n\tassert(buf != (void *)-1);\n\tfprintf(stdout, \"mapped buffer at 0x%p\\n\", buf);\n\n\t/* Populate VMA */\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_NOHUGEPAGE);\n\tassert(ret == 0);\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_READ);\n\tassert(ret == 0);\n\n\t/* Collapse VMA */\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);\n\tassert(ret == 0);\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_COLLAPSE);\n\tif (ret) {\n\t\tfprintf(stdout, \"Error %d to madvise(MADV_COLLAPSE)\\n\", errno);\n\t\tgoto out;\n\t}\n\n\t/* Split xarray entry. Write permission is needed */\n\tmunmap(buf, TEST_MEM_SIZE);\n\tbuf = (void *)-1;\n\tclose(fd);\n\tfd = open(filename, O_RDWR);\n\tassert(fd \u003e 0);\n\tfallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,\n \t\t TEST_MEM_SIZE - pgsize, pgsize);\nout:\n\tif (buf != (void *)-1)\n\t\tmunmap(buf, TEST_MEM_SIZE);\n\tif (fd \u003e 0)\n\t\tclose(fd);\n\n\treturn ret;\n}\n\n[root@dhcp-10-26-1-207 ~]# gcc /tmp/test.c -o /tmp/test\n[root@dhcp-10-26-1-207 ~]# /tmp/test\n ------------[ cut here ]------------\n WARNING: CPU: 25 PID: 7560 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128\n Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \\\n nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \\\n nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \\\n ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse \\\n xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 virtio_net \\\n sha1_ce net_failover virtio_blk virtio_console failover dimlib virtio_mmio\n CPU: 25 PID: 7560 Comm: test Kdump: loaded Not tainted 6.10.0-rc7-gavin+ #9\n Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024\n pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : xas_split_alloc+0xf8/0x128\n lr : split_huge_page_to_list_to_order+0x1c4/0x780\n sp : ffff8000ac32f660\n x29: ffff8000ac32f660 x28: ffff0000e0969eb0 x27: ffff8000ac32f6c0\n x26: 0000000000000c40 x25: ffff0000e0969eb0 x24: 000000000000000d\n x23: ffff8000ac32f6c0 x22: ffffffdfc0700000 x21: 0000000000000000\n x20: 0000000000000000 x19: ffffffdfc0700000 x18: 0000000000000000\n x17: 0000000000000000 x16: ffffd5f3708ffc70 x15: 0000000000000000\n x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n x11: ffffffffffffffc0 x10: 0000000000000040 x9 : ffffd5f3708e692c\n x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff0000e0969eb8\n x5 : ffffd5f37289e378 x4 : 0000000000000000 x3 : 0000000000000c40\n x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000\n Call trace:\n xas_split_alloc+0xf8/0x128\n split_huge_page_to_list_to_order+0x1c4/0x780\n truncate_inode_partial_folio+0xdc/0x160\n truncate_inode_pages_range+0x1b4/0x4a8\n truncate_pagecache_range+0x84/0xa\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:16.627Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e60f62f75c99740a28e2bf7e6044086033012a16" }, { "url": "https://git.kernel.org/stable/c/d659b715e94ac039803d7601505d3473393fc0be" } ], "title": "mm/huge_memory: avoid PMD-size page cache if needed", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42317", "datePublished": "2024-08-17T09:09:30.433Z", "dateReserved": "2024-07-30T07:40:12.278Z", "dateUpdated": "2024-12-19T09:16:16.627Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43815
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: mxs-dcp - Ensure payload is zero when using key slot
We could leak stack memory through the payload field when running
AES with a key from one of the hardware's key slots. Fix this by
ensuring the payload field is set to 0 in such cases.
This does not affect the common use case when the key is supplied
from main memory via the descriptor payload.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43815", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:19.469117Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:25.555Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/crypto/mxs-dcp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e1640fed0377bf7276efb70d03cb821a6931063d", "status": "affected", "version": "3d16af0b4cfac4b2c3b238e2ec37b38c2f316978", "versionType": "git" }, { "lessThan": "dd52b5eeb0f70893f762da7254e923fd23fd1379", "status": "affected", "version": "3d16af0b4cfac4b2c3b238e2ec37b38c2f316978", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/crypto/mxs-dcp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: mxs-dcp - Ensure payload is zero when using key slot\n\nWe could leak stack memory through the payload field when running\nAES with a key from one of the hardware\u0027s key slots. Fix this by\nensuring the payload field is set to 0 in such cases.\n\nThis does not affect the common use case when the key is supplied\nfrom main memory via the descriptor payload." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:23.921Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e1640fed0377bf7276efb70d03cb821a6931063d" }, { "url": "https://git.kernel.org/stable/c/dd52b5eeb0f70893f762da7254e923fd23fd1379" } ], "title": "crypto: mxs-dcp - Ensure payload is zero when using key slot", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43815", "datePublished": "2024-08-17T09:21:38.065Z", "dateReserved": "2024-08-17T09:11:59.270Z", "dateUpdated": "2024-12-19T09:16:23.921Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42261
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Validate passed in drm syncobj handles in the timestamp extension
If userspace provides an unknown or invalid handle anywhere in the handle
array the rest of the driver will not handle that well.
Fix it by checking handle was looked up successfully or otherwise fail the
extension by jumping into the existing unwind.
(cherry picked from commit 8d1276d1b8f738c3afe1457d4dff5cc66fc848a3)
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42261", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:43.962377Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:33.434Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "5c56f104edd02a537e9327dc543574e55713e1d7", "status": "affected", "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "versionType": "git" }, { "lessThan": "023d22e8bb0cdd6900382ad1ed06df3b6c2ea791", "status": "affected", "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_submit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Validate passed in drm syncobj handles in the timestamp extension\n\nIf userspace provides an unknown or invalid handle anywhere in the handle\narray the rest of the driver will not handle that well.\n\nFix it by checking handle was looked up successfully or otherwise fail the\nextension by jumping into the existing unwind.\n\n(cherry picked from commit 8d1276d1b8f738c3afe1457d4dff5cc66fc848a3)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:04.967Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/5c56f104edd02a537e9327dc543574e55713e1d7" }, { "url": "https://git.kernel.org/stable/c/023d22e8bb0cdd6900382ad1ed06df3b6c2ea791" } ], "title": "drm/v3d: Validate passed in drm syncobj handles in the timestamp extension", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42261", "datePublished": "2024-08-17T08:54:18.826Z", "dateReserved": "2024-07-30T07:40:12.258Z", "dateUpdated": "2024-12-19T09:15:04.967Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43818
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd: Adjust error handling in case of absent codec device
acpi_get_first_physical_node() can return NULL in several cases (no such
device, ACPI table error, reference count drop to 0, etc).
Existing check just emit error message, but doesn't perform return.
Then this NULL pointer is passed to devm_acpi_dev_add_driver_gpios()
where it is dereferenced.
Adjust this error handling by adding error code return.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43818", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:09.791728Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:25.328Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "sound/soc/amd/acp-es8336.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1ba9856cf7f6492b47c1edf853137f320d583db5", "status": "affected", "version": "02527c3f2300100a25524c8c020d98c7957e485e", "versionType": "git" }, { "lessThan": "99b642dac24f6d09ba3ebf1d690be8aefff86164", "status": "affected", "version": "02527c3f2300100a25524c8c020d98c7957e485e", "versionType": "git" }, { "lessThan": "b1173d64edd276c957b6d09e1f971c85b38f1519", "status": "affected", "version": "02527c3f2300100a25524c8c020d98c7957e485e", "versionType": "git" }, { "lessThan": "5080808c3339de2220c602ab7c7fa23dc6c1a5a3", "status": "affected", "version": "02527c3f2300100a25524c8c020d98c7957e485e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "sound/soc/amd/acp-es8336.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: Adjust error handling in case of absent codec device\n\nacpi_get_first_physical_node() can return NULL in several cases (no such\ndevice, ACPI table error, reference count drop to 0, etc).\nExisting check just emit error message, but doesn\u0027t perform return.\nThen this NULL pointer is passed to devm_acpi_dev_add_driver_gpios()\nwhere it is dereferenced.\n\nAdjust this error handling by adding error code return.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:27.746Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1ba9856cf7f6492b47c1edf853137f320d583db5" }, { "url": "https://git.kernel.org/stable/c/99b642dac24f6d09ba3ebf1d690be8aefff86164" }, { "url": "https://git.kernel.org/stable/c/b1173d64edd276c957b6d09e1f971c85b38f1519" }, { "url": "https://git.kernel.org/stable/c/5080808c3339de2220c602ab7c7fa23dc6c1a5a3" } ], "title": "ASoC: amd: Adjust error handling in case of absent codec device", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43818", "datePublished": "2024-08-17T09:21:40.341Z", "dateReserved": "2024-08-17T09:11:59.271Z", "dateUpdated": "2024-12-19T09:16:27.746Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43844
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: wow: fix GTK offload H2C skbuff issue
We mistakenly put skb too large and that may exceed skb->end.
Therefore, we fix it.
skbuff: skb_over_panic: text:ffffffffc09e9a9d len:416 put:204 head:ffff8fba04eca780 data:ffff8fba04eca7e0 tail:0x200 end:0x140 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:192!
invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 4747 Comm: kworker/u4:44 Tainted: G O 6.6.30-02659-gc18865c4dfbd #1 86547039b47e46935493f615ee31d0b2d711d35e
Hardware name: HP Meep/Meep, BIOS Google_Meep.11297.262.0 03/18/2021
Workqueue: events_unbound async_run_entry_fn
RIP: 0010:skb_panic+0x5d/0x60
Code: c6 63 8b 8f bb 4c 0f 45 f6 48 c7 c7 4d 89 8b bb 48 89 ce 44 89 d1 41 56 53 41 53 ff b0 c8 00 00 00 e8 27 5f 23 00 48 83 c4 20 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44
RSP: 0018:ffffaa700144bad0 EFLAGS: 00010282
RAX: 0000000000000089 RBX: 0000000000000140 RCX: 14432c5aad26c900
RDX: 0000000000000000 RSI: 00000000ffffdfff RDI: 0000000000000001
RBP: ffffaa700144bae0 R08: 0000000000000000 R09: ffffaa700144b920
R10: 00000000ffffdfff R11: ffffffffbc28fbc0 R12: ffff8fba4e57a010
R13: 0000000000000000 R14: ffffffffbb8f8b63 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8fba7bd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007999c4ad1000 CR3: 000000015503a000 CR4: 0000000000350ee0
Call Trace:
<TASK>
? __die_body+0x1f/0x70
? die+0x3d/0x60
? do_trap+0xa4/0x110
? skb_panic+0x5d/0x60
? do_error_trap+0x6d/0x90
? skb_panic+0x5d/0x60
? handle_invalid_op+0x30/0x40
? skb_panic+0x5d/0x60
? exc_invalid_op+0x3c/0x50
? asm_exc_invalid_op+0x16/0x20
? skb_panic+0x5d/0x60
skb_put+0x49/0x50
rtw89_fw_h2c_wow_gtk_ofld+0xbd/0x220 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5]
rtw89_wow_resume+0x31f/0x540 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5]
rtw89_ops_resume+0x2b/0xa0 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5]
ieee80211_reconfig+0x84/0x13e0 [mac80211 818a894e3b77da6298269c59ed7cdff065a4ed52]
? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d]
? dev_printk_emit+0x51/0x70
? _dev_info+0x6e/0x90
? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d]
wiphy_resume+0x89/0x180 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d]
? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d]
dpm_run_callback+0x3c/0x140
device_resume+0x1f9/0x3c0
? __pfx_dpm_watchdog_handler+0x10/0x10
async_resume+0x1d/0x30
async_run_entry_fn+0x29/0xd0
process_scheduled_works+0x1d8/0x3d0
worker_thread+0x1fc/0x2f0
kthread+0xed/0x110
? __pfx_worker_thread+0x10/0x10
? __pfx_kthread+0x10/0x10
ret_from_fork+0x38/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1b/0x30
</TASK>
Modules linked in: ccm 8021q r8153_ecm cdc_ether usbnet r8152 mii dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc uinput rfcomm cmac algif_hash rtw89_8922ae(O) algif_skcipher rtw89_8922a(O) af_alg rtw89_pci(O) rtw89_core(O) btusb(O) snd_soc_sst_bxt_da7219_max98357a btbcm(O) snd_soc_hdac_hdmi btintel(O) snd_soc_intel_hda_dsp_common snd_sof_probes btrtl(O) btmtk(O) snd_hda_codec_hdmi snd_soc_dmic uvcvideo videobuf2_vmalloc uvc videobuf2_memops videobuf2_v4l2 videobuf2_common snd_sof_pci_intel_apl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation snd_sof_intel_hda_mlink soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp mac80211 snd_soc_acpi_intel_match snd_soc_acpi snd_sof snd_sof_utils soundwire_bus snd_soc_max98357a snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_intel_dspcfg snd_intel_sdw_acpi snd_soc_da7219 snd_hda_codec snd_hwdep snd_hda_core veth ip6table_nat xt_MASQUERADE xt_cgroup fuse bluetooth ecdh_generic
cfg80211 ecc
gsmi: Log Shutdown
---truncated---
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43844", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:46.241286Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:22.162Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/wireless/realtek/rtw89/fw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ef0d9d2f0dc1133db3d3a1c5167190c6627146b2", "status": "affected", "version": "ed9a3c0d4dd9ce79ff7f65238164a96da1b52dbf", "versionType": "git" }, { "lessThan": "dda364c345913fe03ddbe4d5ae14a2754c100296", "status": "affected", "version": "ed9a3c0d4dd9ce79ff7f65238164a96da1b52dbf", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/wireless/realtek/rtw89/fw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: wow: fix GTK offload H2C skbuff issue\n\nWe mistakenly put skb too large and that may exceed skb-\u003eend.\nTherefore, we fix it.\n\nskbuff: skb_over_panic: text:ffffffffc09e9a9d len:416 put:204 head:ffff8fba04eca780 data:ffff8fba04eca7e0 tail:0x200 end:0x140 dev:\u003cNULL\u003e\n------------[ cut here ]------------\nkernel BUG at net/core/skbuff.c:192!\ninvalid opcode: 0000 [#1] PREEMPT SMP PTI\nCPU: 1 PID: 4747 Comm: kworker/u4:44 Tainted: G O 6.6.30-02659-gc18865c4dfbd #1 86547039b47e46935493f615ee31d0b2d711d35e\nHardware name: HP Meep/Meep, BIOS Google_Meep.11297.262.0 03/18/2021\nWorkqueue: events_unbound async_run_entry_fn\nRIP: 0010:skb_panic+0x5d/0x60\nCode: c6 63 8b 8f bb 4c 0f 45 f6 48 c7 c7 4d 89 8b bb 48 89 ce 44 89 d1 41 56 53 41 53 ff b0 c8 00 00 00 e8 27 5f 23 00 48 83 c4 20 \u003c0f\u003e 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44\nRSP: 0018:ffffaa700144bad0 EFLAGS: 00010282\nRAX: 0000000000000089 RBX: 0000000000000140 RCX: 14432c5aad26c900\nRDX: 0000000000000000 RSI: 00000000ffffdfff RDI: 0000000000000001\nRBP: ffffaa700144bae0 R08: 0000000000000000 R09: ffffaa700144b920\nR10: 00000000ffffdfff R11: ffffffffbc28fbc0 R12: ffff8fba4e57a010\nR13: 0000000000000000 R14: ffffffffbb8f8b63 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8fba7bd00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007999c4ad1000 CR3: 000000015503a000 CR4: 0000000000350ee0\nCall Trace:\n \u003cTASK\u003e\n ? __die_body+0x1f/0x70\n ? die+0x3d/0x60\n ? do_trap+0xa4/0x110\n ? skb_panic+0x5d/0x60\n ? do_error_trap+0x6d/0x90\n ? skb_panic+0x5d/0x60\n ? handle_invalid_op+0x30/0x40\n ? skb_panic+0x5d/0x60\n ? exc_invalid_op+0x3c/0x50\n ? asm_exc_invalid_op+0x16/0x20\n ? skb_panic+0x5d/0x60\n skb_put+0x49/0x50\n rtw89_fw_h2c_wow_gtk_ofld+0xbd/0x220 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5]\n rtw89_wow_resume+0x31f/0x540 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5]\n rtw89_ops_resume+0x2b/0xa0 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5]\n ieee80211_reconfig+0x84/0x13e0 [mac80211 818a894e3b77da6298269c59ed7cdff065a4ed52]\n ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d]\n ? dev_printk_emit+0x51/0x70\n ? _dev_info+0x6e/0x90\n ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d]\n wiphy_resume+0x89/0x180 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d]\n ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d]\n dpm_run_callback+0x3c/0x140\n device_resume+0x1f9/0x3c0\n ? __pfx_dpm_watchdog_handler+0x10/0x10\n async_resume+0x1d/0x30\n async_run_entry_fn+0x29/0xd0\n process_scheduled_works+0x1d8/0x3d0\n worker_thread+0x1fc/0x2f0\n kthread+0xed/0x110\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x38/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n \u003c/TASK\u003e\nModules linked in: ccm 8021q r8153_ecm cdc_ether usbnet r8152 mii dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc uinput rfcomm cmac algif_hash rtw89_8922ae(O) algif_skcipher rtw89_8922a(O) af_alg rtw89_pci(O) rtw89_core(O) btusb(O) snd_soc_sst_bxt_da7219_max98357a btbcm(O) snd_soc_hdac_hdmi btintel(O) snd_soc_intel_hda_dsp_common snd_sof_probes btrtl(O) btmtk(O) snd_hda_codec_hdmi snd_soc_dmic uvcvideo videobuf2_vmalloc uvc videobuf2_memops videobuf2_v4l2 videobuf2_common snd_sof_pci_intel_apl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation snd_sof_intel_hda_mlink soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp mac80211 snd_soc_acpi_intel_match snd_soc_acpi snd_sof snd_sof_utils soundwire_bus snd_soc_max98357a snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_intel_dspcfg snd_intel_sdw_acpi snd_soc_da7219 snd_hda_codec snd_hwdep snd_hda_core veth ip6table_nat xt_MASQUERADE xt_cgroup fuse bluetooth ecdh_generic\n cfg80211 ecc\ngsmi: Log Shutdown \n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:00.408Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ef0d9d2f0dc1133db3d3a1c5167190c6627146b2" }, { "url": "https://git.kernel.org/stable/c/dda364c345913fe03ddbe4d5ae14a2754c100296" } ], "title": "wifi: rtw89: wow: fix GTK offload H2C skbuff issue", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43844", "datePublished": "2024-08-17T09:21:58.819Z", "dateReserved": "2024-08-17T09:11:59.275Z", "dateUpdated": "2024-12-19T09:17:00.408Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42314
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix extent map use-after-free when adding pages to compressed bio
At add_ra_bio_pages() we are accessing the extent map to calculate
'add_size' after we dropped our reference on the extent map, resulting
in a use-after-free. Fix this by computing 'add_size' before dropping our
extent map reference.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42314", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:49.130519Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:04.999Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/btrfs/compression.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c1cc3326e27b0bd7a2806b40bc48e49afaf951e7", "status": "affected", "version": "6a4049102055250256623ab1875fabd89004bff8", "versionType": "git" }, { "lessThan": "c205565e0f2f439f278a4a94ee97b67ef7b56ae8", "status": "affected", "version": "6a4049102055250256623ab1875fabd89004bff8", "versionType": "git" }, { "lessThan": "b7859ff398b6b656e1689daa860eb34837b4bb89", "status": "affected", "version": "6a4049102055250256623ab1875fabd89004bff8", "versionType": "git" }, { "lessThan": "8e7860543a94784d744c7ce34b78a2e11beefa5c", "status": "affected", "version": "6a4049102055250256623ab1875fabd89004bff8", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/btrfs/compression.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.16" }, { "lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix extent map use-after-free when adding pages to compressed bio\n\nAt add_ra_bio_pages() we are accessing the extent map to calculate\n\u0027add_size\u0027 after we dropped our reference on the extent map, resulting\nin a use-after-free. Fix this by computing \u0027add_size\u0027 before dropping our\nextent map reference." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:12.912Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c1cc3326e27b0bd7a2806b40bc48e49afaf951e7" }, { "url": "https://git.kernel.org/stable/c/c205565e0f2f439f278a4a94ee97b67ef7b56ae8" }, { "url": "https://git.kernel.org/stable/c/b7859ff398b6b656e1689daa860eb34837b4bb89" }, { "url": "https://git.kernel.org/stable/c/8e7860543a94784d744c7ce34b78a2e11beefa5c" } ], "title": "btrfs: fix extent map use-after-free when adding pages to compressed bio", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42314", "datePublished": "2024-08-17T09:09:23.047Z", "dateReserved": "2024-07-30T07:40:12.277Z", "dateUpdated": "2024-12-19T09:16:12.912Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42267
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly
kill the process and we don't BUG() the kernel.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 07037db5d479f90377c998259a4f9a469c404edf Version: 07037db5d479f90377c998259a4f9a469c404edf Version: 07037db5d479f90377c998259a4f9a469c404edf Version: 07037db5d479f90377c998259a4f9a469c404edf Version: 07037db5d479f90377c998259a4f9a469c404edf Version: 07037db5d479f90377c998259a4f9a469c404edf |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42267", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:24.517486Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:05.548Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/riscv/mm/fault.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "59be4a167782d68e21068a761b90b01fadc09146", "status": "affected", "version": "07037db5d479f90377c998259a4f9a469c404edf", "versionType": "git" }, { "lessThan": "20dbdebc5580cd472a310d56a6e252275ee4c864", "status": "affected", "version": "07037db5d479f90377c998259a4f9a469c404edf", "versionType": "git" }, { "lessThan": "d7ccf2ca772bfe33e2c53ef80fa20d2d87eb6144", "status": "affected", "version": "07037db5d479f90377c998259a4f9a469c404edf", "versionType": "git" }, { "lessThan": "917f598209f3f5e4ab175d5079d8aeb523e58b1f", "status": "affected", "version": "07037db5d479f90377c998259a4f9a469c404edf", "versionType": "git" }, { "lessThan": "d4e7db757e2d7f4c407a007e92c98477eab215d2", "status": "affected", "version": "07037db5d479f90377c998259a4f9a469c404edf", "versionType": "git" }, { "lessThan": "0c710050c47d45eb77b28c271cddefc5c785cb40", "status": "affected", "version": "07037db5d479f90377c998259a4f9a469c404edf", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/riscv/mm/fault.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.15" }, { "lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()\n\nHandle VM_FAULT_SIGSEGV in the page fault path so that we correctly\nkill the process and we don\u0027t BUG() the kernel." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:12.029Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/59be4a167782d68e21068a761b90b01fadc09146" }, { "url": "https://git.kernel.org/stable/c/20dbdebc5580cd472a310d56a6e252275ee4c864" }, { "url": "https://git.kernel.org/stable/c/d7ccf2ca772bfe33e2c53ef80fa20d2d87eb6144" }, { "url": "https://git.kernel.org/stable/c/917f598209f3f5e4ab175d5079d8aeb523e58b1f" }, { "url": "https://git.kernel.org/stable/c/d4e7db757e2d7f4c407a007e92c98477eab215d2" }, { "url": "https://git.kernel.org/stable/c/0c710050c47d45eb77b28c271cddefc5c785cb40" } ], "title": "riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42267", "datePublished": "2024-08-17T08:54:22.964Z", "dateReserved": "2024-07-30T07:40:12.259Z", "dateUpdated": "2024-12-19T09:15:12.029Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42269
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().
ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id],
but the function is exposed to user space before the entry is allocated
via register_pernet_subsys().
Let's call register_pernet_subsys() before xt_register_template().
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 Version: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42269", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:17.928163Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:32.642Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/ipv6/netfilter/ip6table_nat.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "419ee6274c5153b89c4393c1946faa4c3cad4f9e", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" }, { "lessThan": "91b6df6611b7edb28676c4f63f90c56c30d3e601", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" }, { "lessThan": "e85b9b6a87be4cb3710082038b677e97f2389003", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" }, { "lessThan": "87dba44e9471b79b255d0736858a897332db9226", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" }, { "lessThan": "c22921df777de5606f1047b1345b8d22ef1c0b34", "status": "affected", "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/ipv6/netfilter/ip6table_nat.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.15" }, { "lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.104", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.45", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().\n\nip6table_nat_table_init() accesses net-\u003egen-\u003eptr[ip6table_nat_net_ops.id],\nbut the function is exposed to user space before the entry is allocated\nvia register_pernet_subsys().\n\nLet\u0027s call register_pernet_subsys() before xt_register_template()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:14.508Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/419ee6274c5153b89c4393c1946faa4c3cad4f9e" }, { "url": "https://git.kernel.org/stable/c/91b6df6611b7edb28676c4f63f90c56c30d3e601" }, { "url": "https://git.kernel.org/stable/c/e85b9b6a87be4cb3710082038b677e97f2389003" }, { "url": "https://git.kernel.org/stable/c/87dba44e9471b79b255d0736858a897332db9226" }, { "url": "https://git.kernel.org/stable/c/c22921df777de5606f1047b1345b8d22ef1c0b34" } ], "title": "netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42269", "datePublished": "2024-08-17T08:54:24.267Z", "dateReserved": "2024-07-30T07:40:12.260Z", "dateUpdated": "2024-12-19T09:15:14.508Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43842
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()
In rtw89_sta_info_get_iter() 'status->he_gi' is compared to array size.
But then 'rate->he_gi' is used as array index instead of 'status->he_gi'.
This can lead to go beyond array boundaries in case of 'rate->he_gi' is
not equal to 'status->he_gi' and is bigger than array size. Looks like
"copy-paste" mistake.
Fix this mistake by replacing 'rate->he_gi' with 'status->he_gi'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43842", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:52.507676Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:22.419Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/wireless/realtek/rtw89/debug.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "a2a095c08b95372d6d0c5819b77f071af5e75366", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git" }, { "lessThan": "7a0edc3d83aff3a48813d78c9cad9daf38decc74", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git" }, { "lessThan": "96ae4de5bc4c8ba39fd072369398f59495b73f58", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git" }, { "lessThan": "85099c7ce4f9e64c66aa397cd9a37473637ab891", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/wireless/realtek/rtw89/debug.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.16" }, { "lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()\n\nIn rtw89_sta_info_get_iter() \u0027status-\u003ehe_gi\u0027 is compared to array size.\nBut then \u0027rate-\u003ehe_gi\u0027 is used as array index instead of \u0027status-\u003ehe_gi\u0027.\nThis can lead to go beyond array boundaries in case of \u0027rate-\u003ehe_gi\u0027 is\nnot equal to \u0027status-\u003ehe_gi\u0027 and is bigger than array size. Looks like\n\"copy-paste\" mistake.\n\nFix this mistake by replacing \u0027rate-\u003ehe_gi\u0027 with \u0027status-\u003ehe_gi\u0027.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:57.482Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/a2a095c08b95372d6d0c5819b77f071af5e75366" }, { "url": "https://git.kernel.org/stable/c/7a0edc3d83aff3a48813d78c9cad9daf38decc74" }, { "url": "https://git.kernel.org/stable/c/96ae4de5bc4c8ba39fd072369398f59495b73f58" }, { "url": "https://git.kernel.org/stable/c/85099c7ce4f9e64c66aa397cd9a37473637ab891" } ], "title": "wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43842", "datePublished": "2024-08-17T09:21:57.172Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:57.482Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43841
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: virt_wifi: avoid reporting connection success with wrong SSID
When user issues a connection with a different SSID than the one
virt_wifi has advertised, the __cfg80211_connect_result() will
trigger the warning: WARN_ON(bss_not_found).
The issue is because the connection code in virt_wifi does not
check the SSID from user space (it only checks the BSSID), and
virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS
even if the SSID is different from the one virt_wifi has advertised.
Eventually cfg80211 won't be able to find the cfg80211_bss and generate
the warning.
Fixed it by checking the SSID (from user space) in the connection code.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43841", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:55.756844Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:22.634Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/wireless/virtual/virt_wifi.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "994fc2164a03200c3bf42fb45b3d49d9d6d33a4d", "status": "affected", "version": "c7cdba31ed8b87526db978976392802d3f93110c", "versionType": "git" }, { "lessThan": "05c4488a0e446c6ccde9f22b573950665e1cd414", "status": "affected", "version": "c7cdba31ed8b87526db978976392802d3f93110c", "versionType": "git" }, { "lessThan": "93e898a264b4e0a475552ba9f99a016eb43ef942", "status": "affected", "version": "c7cdba31ed8b87526db978976392802d3f93110c", "versionType": "git" }, { "lessThan": "d3cc85a10abc8eae48988336cdd3689ab92581b3", "status": "affected", "version": "c7cdba31ed8b87526db978976392802d3f93110c", "versionType": "git" }, { "lessThan": "36e92b5edc8e0daa18e9325674313802ce3fbc29", "status": "affected", "version": "c7cdba31ed8b87526db978976392802d3f93110c", "versionType": "git" }, { "lessThan": "416d3c1538df005195721a200b0371d39636e05d", "status": "affected", "version": "c7cdba31ed8b87526db978976392802d3f93110c", "versionType": "git" }, { "lessThan": "b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7", "status": "affected", "version": "c7cdba31ed8b87526db978976392802d3f93110c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/wireless/virtual/virt_wifi.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.0" }, { "lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: avoid reporting connection success with wrong SSID\n\nWhen user issues a connection with a different SSID than the one\nvirt_wifi has advertised, the __cfg80211_connect_result() will\ntrigger the warning: WARN_ON(bss_not_found).\n\nThe issue is because the connection code in virt_wifi does not\ncheck the SSID from user space (it only checks the BSSID), and\nvirt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS\neven if the SSID is different from the one virt_wifi has advertised.\nEventually cfg80211 won\u0027t be able to find the cfg80211_bss and generate\nthe warning.\n\nFixed it by checking the SSID (from user space) in the connection code." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:56.002Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/994fc2164a03200c3bf42fb45b3d49d9d6d33a4d" }, { "url": "https://git.kernel.org/stable/c/05c4488a0e446c6ccde9f22b573950665e1cd414" }, { "url": "https://git.kernel.org/stable/c/93e898a264b4e0a475552ba9f99a016eb43ef942" }, { "url": "https://git.kernel.org/stable/c/d3cc85a10abc8eae48988336cdd3689ab92581b3" }, { "url": "https://git.kernel.org/stable/c/36e92b5edc8e0daa18e9325674313802ce3fbc29" }, { "url": "https://git.kernel.org/stable/c/416d3c1538df005195721a200b0371d39636e05d" }, { "url": "https://git.kernel.org/stable/c/b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7" } ], "title": "wifi: virt_wifi: avoid reporting connection success with wrong SSID", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43841", "datePublished": "2024-08-17T09:21:56.517Z", "dateReserved": "2024-08-17T09:11:59.274Z", "dateUpdated": "2024-12-19T09:16:56.002Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42319
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()
When mtk-cmdq unbinds, a WARN_ON message with condition
pm_runtime_get_sync() < 0 occurs.
According to the call tracei below:
cmdq_mbox_shutdown
mbox_free_channel
mbox_controller_unregister
__devm_mbox_controller_unregister
...
The root cause can be deduced to be calling pm_runtime_get_sync() after
calling pm_runtime_disable() as observed below:
1. CMDQ driver uses devm_mbox_controller_register() in cmdq_probe()
to bind the cmdq device to the mbox_controller, so
devm_mbox_controller_unregister() will automatically unregister
the device bound to the mailbox controller when the device-managed
resource is removed. That means devm_mbox_controller_unregister()
and cmdq_mbox_shoutdown() will be called after cmdq_remove().
2. CMDQ driver also uses devm_pm_runtime_enable() in cmdq_probe() after
devm_mbox_controller_register(), so that devm_pm_runtime_disable()
will be called after cmdq_remove(), but before
devm_mbox_controller_unregister().
To fix this problem, cmdq_probe() needs to move
devm_mbox_controller_register() after devm_pm_runtime_enable() to make
devm_pm_runtime_disable() be called after
devm_mbox_controller_unregister().
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42319", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:32.477080Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:26.095Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/mailbox/mtk-cmdq-mailbox.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1403991a40b94438a2acc749bf05c117abdb34f9", "status": "affected", "version": "623a6143a845bd485b00ba684f0ccef11835edab", "versionType": "git" }, { "lessThan": "d00df6700ad10974a7e20646956f4ff22cdbe0ec", "status": "affected", "version": "623a6143a845bd485b00ba684f0ccef11835edab", "versionType": "git" }, { "lessThan": "11fa625b45faf0649118b9deaf2d31c86ac41911", "status": "affected", "version": "623a6143a845bd485b00ba684f0ccef11835edab", "versionType": "git" }, { "lessThan": "a8bd68e4329f9a0ad1b878733e0f80be6a971649", "status": "affected", "version": "623a6143a845bd485b00ba684f0ccef11835edab", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/mailbox/mtk-cmdq-mailbox.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.19" }, { "lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.120", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.64", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()\n\nWhen mtk-cmdq unbinds, a WARN_ON message with condition\npm_runtime_get_sync() \u003c 0 occurs.\n\nAccording to the call tracei below:\n cmdq_mbox_shutdown\n mbox_free_channel\n mbox_controller_unregister\n __devm_mbox_controller_unregister\n ...\n\nThe root cause can be deduced to be calling pm_runtime_get_sync() after\ncalling pm_runtime_disable() as observed below:\n1. CMDQ driver uses devm_mbox_controller_register() in cmdq_probe()\n to bind the cmdq device to the mbox_controller, so\n devm_mbox_controller_unregister() will automatically unregister\n the device bound to the mailbox controller when the device-managed\n resource is removed. That means devm_mbox_controller_unregister()\n and cmdq_mbox_shoutdown() will be called after cmdq_remove().\n2. CMDQ driver also uses devm_pm_runtime_enable() in cmdq_probe() after\n devm_mbox_controller_register(), so that devm_pm_runtime_disable()\n will be called after cmdq_remove(), but before\n devm_mbox_controller_unregister().\n\nTo fix this problem, cmdq_probe() needs to move\ndevm_mbox_controller_register() after devm_pm_runtime_enable() to make\ndevm_pm_runtime_disable() be called after\ndevm_mbox_controller_unregister()." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:19.031Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1403991a40b94438a2acc749bf05c117abdb34f9" }, { "url": "https://git.kernel.org/stable/c/d00df6700ad10974a7e20646956f4ff22cdbe0ec" }, { "url": "https://git.kernel.org/stable/c/11fa625b45faf0649118b9deaf2d31c86ac41911" }, { "url": "https://git.kernel.org/stable/c/a8bd68e4329f9a0ad1b878733e0f80be6a971649" } ], "title": "mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42319", "datePublished": "2024-08-17T09:09:31.867Z", "dateReserved": "2024-07-30T07:40:12.278Z", "dateUpdated": "2024-12-19T09:16:19.031Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42293
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: Fix lockless walks with static and dynamic page-table folding
Lina reports random oopsen originating from the fast GUP code when
16K pages are used with 4-level page-tables, the fourth level being
folded at runtime due to lack of LPA2.
In this configuration, the generic implementation of
p4d_offset_lockless() will return a 'p4d_t *' corresponding to the
'pgd_t' allocated on the stack of the caller, gup_fast_pgd_range().
This is normally fine, but when the fourth level of page-table is folded
at runtime, pud_offset_lockless() will offset from the address of the
'p4d_t' to calculate the address of the PUD in the same page-table page.
This results in a stray stack read when the 'p4d_t' has been allocated
on the stack and can send the walker into the weeds.
Fix the problem by providing our own definition of p4d_offset_lockless()
when CONFIG_PGTABLE_LEVELS <= 4 which returns the real page-table
pointer rather than the address of the local stack variable.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42293", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:57.009784Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:29.368Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/arm64/include/asm/pgtable.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "78672d49d3eebbcda3589f4d6e589caf357c5a59", "status": "affected", "version": "0dd4f60a2c76938c2625f6c630c225699d97608b", "versionType": "git" }, { "lessThan": "36639013b3462c06ff8e3400a427f775b4fc97f5", "status": "affected", "version": "0dd4f60a2c76938c2625f6c630c225699d97608b", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/arm64/include/asm/pgtable.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.9" }, { "lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix lockless walks with static and dynamic page-table folding\n\nLina reports random oopsen originating from the fast GUP code when\n16K pages are used with 4-level page-tables, the fourth level being\nfolded at runtime due to lack of LPA2.\n\nIn this configuration, the generic implementation of\np4d_offset_lockless() will return a \u0027p4d_t *\u0027 corresponding to the\n\u0027pgd_t\u0027 allocated on the stack of the caller, gup_fast_pgd_range().\nThis is normally fine, but when the fourth level of page-table is folded\nat runtime, pud_offset_lockless() will offset from the address of the\n\u0027p4d_t\u0027 to calculate the address of the PUD in the same page-table page.\nThis results in a stray stack read when the \u0027p4d_t\u0027 has been allocated\non the stack and can send the walker into the weeds.\n\nFix the problem by providing our own definition of p4d_offset_lockless()\nwhen CONFIG_PGTABLE_LEVELS \u003c= 4 which returns the real page-table\npointer rather than the address of the local stack variable." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:47.868Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/78672d49d3eebbcda3589f4d6e589caf357c5a59" }, { "url": "https://git.kernel.org/stable/c/36639013b3462c06ff8e3400a427f775b4fc97f5" } ], "title": "arm64: mm: Fix lockless walks with static and dynamic page-table folding", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42293", "datePublished": "2024-08-17T09:09:02.303Z", "dateReserved": "2024-07-30T07:40:12.268Z", "dateUpdated": "2024-12-19T09:15:47.868Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43823
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
If IORESOURCE_MEM is not provided in Device Tree due to
any error, resource_list_first_type() will return NULL and
pci_parse_request_of_pci_ranges() will just emit a warning.
This will cause a NULL pointer dereference. Fix this bug by adding NULL
return check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43823", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:54.421311Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:24.690Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/pci/controller/dwc/pci-keystone.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "bbba48ad67c53feea05936ea1e029dcca8057506", "status": "affected", "version": "0f71c60ffd26943fa9646aa73ad7889ace116ce2", "versionType": "git" }, { "lessThan": "0a6f1b5fe8ef8268aaa069035639968ceeea0a23", "status": "affected", "version": "0f71c60ffd26943fa9646aa73ad7889ace116ce2", "versionType": "git" }, { "lessThan": "dbcdd1863ba2ec9b76ec131df25d797709e05597", "status": "affected", "version": "0f71c60ffd26943fa9646aa73ad7889ace116ce2", "versionType": "git" }, { "lessThan": "a231707a91f323af1e5d9f1722055ec2fc1c7775", "status": "affected", "version": "0f71c60ffd26943fa9646aa73ad7889ace116ce2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/pci/controller/dwc/pci-keystone.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.10" }, { "lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()\n\nIf IORESOURCE_MEM is not provided in Device Tree due to\nany error, resource_list_first_type() will return NULL and\npci_parse_request_of_pci_ranges() will just emit a warning.\n\nThis will cause a NULL pointer dereference. Fix this bug by adding NULL\nreturn check.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:34.167Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/bbba48ad67c53feea05936ea1e029dcca8057506" }, { "url": "https://git.kernel.org/stable/c/0a6f1b5fe8ef8268aaa069035639968ceeea0a23" }, { "url": "https://git.kernel.org/stable/c/dbcdd1863ba2ec9b76ec131df25d797709e05597" }, { "url": "https://git.kernel.org/stable/c/a231707a91f323af1e5d9f1722055ec2fc1c7775" } ], "title": "PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43823", "datePublished": "2024-08-17T09:21:43.843Z", "dateReserved": "2024-08-17T09:11:59.271Z", "dateUpdated": "2024-12-19T09:16:34.167Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43846
Vulnerability from cvelistv5
Published
2024-08-17 09:22
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
lib: objagg: Fix general protection fault
The library supports aggregation of objects into other objects only if
the parent object does not have a parent itself. That is, nesting is not
supported.
Aggregation happens in two cases: Without and with hints, where hints
are a pre-computed recommendation on how to aggregate the provided
objects.
Nesting is not possible in the first case due to a check that prevents
it, but in the second case there is no check because the assumption is
that nesting cannot happen when creating objects based on hints. The
violation of this assumption leads to various warnings and eventually to
a general protection fault [1].
Before fixing the root cause, error out when nesting happens and warn.
[1]
general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7
Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work
RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80
[...]
Call Trace:
<TASK>
mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0
mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0
mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270
mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510
process_one_work+0x151/0x370
worker_thread+0x2cb/0x3e0
kthread+0xd0/0x100
ret_from_fork+0x34/0x50
ret_from_fork_asm+0x1a/0x30
</TASK>
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 9069a3817d82b01b3a55da382c774e3575946130 Version: 9069a3817d82b01b3a55da382c774e3575946130 Version: 9069a3817d82b01b3a55da382c774e3575946130 Version: 9069a3817d82b01b3a55da382c774e3575946130 Version: 9069a3817d82b01b3a55da382c774e3575946130 Version: 9069a3817d82b01b3a55da382c774e3575946130 Version: 9069a3817d82b01b3a55da382c774e3575946130 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43846", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:39.903240Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:21.861Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "lib/objagg.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "8161263362154cbebfbf4808097b956a6a8cb98a", "status": "affected", "version": "9069a3817d82b01b3a55da382c774e3575946130", "versionType": "git" }, { "lessThan": "22ae17a267f4812861f0c644186c3421ff97dbfc", "status": "affected", "version": "9069a3817d82b01b3a55da382c774e3575946130", "versionType": "git" }, { "lessThan": "565213e005557eb6cc4e42189d26eb300e02f170", "status": "affected", "version": "9069a3817d82b01b3a55da382c774e3575946130", "versionType": "git" }, { "lessThan": "5adc61d29bbb461d7f7c2b48dceaa90ecd182eb7", "status": "affected", "version": "9069a3817d82b01b3a55da382c774e3575946130", "versionType": "git" }, { "lessThan": "1936fa05a180834c3b52e0439a6bddc07814d3eb", "status": "affected", "version": "9069a3817d82b01b3a55da382c774e3575946130", "versionType": "git" }, { "lessThan": "499f742fed42e74f1321f4b12ca196a66a2b49fc", "status": "affected", "version": "9069a3817d82b01b3a55da382c774e3575946130", "versionType": "git" }, { "lessThan": "b4a3a89fffcdf09702b1f161b914e52abca1894d", "status": "affected", "version": "9069a3817d82b01b3a55da382c774e3575946130", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "lib/objagg.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.1" }, { "lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib: objagg: Fix general protection fault\n\nThe library supports aggregation of objects into other objects only if\nthe parent object does not have a parent itself. That is, nesting is not\nsupported.\n\nAggregation happens in two cases: Without and with hints, where hints\nare a pre-computed recommendation on how to aggregate the provided\nobjects.\n\nNesting is not possible in the first case due to a check that prevents\nit, but in the second case there is no check because the assumption is\nthat nesting cannot happen when creating objects based on hints. The\nviolation of this assumption leads to various warnings and eventually to\na general protection fault [1].\n\nBefore fixing the root cause, error out when nesting happens and warn.\n\n[1]\ngeneral protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI\nCPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80\n[...]\nCall Trace:\n \u003cTASK\u003e\n mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270\n mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:02.917Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/8161263362154cbebfbf4808097b956a6a8cb98a" }, { "url": "https://git.kernel.org/stable/c/22ae17a267f4812861f0c644186c3421ff97dbfc" }, { "url": "https://git.kernel.org/stable/c/565213e005557eb6cc4e42189d26eb300e02f170" }, { "url": "https://git.kernel.org/stable/c/5adc61d29bbb461d7f7c2b48dceaa90ecd182eb7" }, { "url": "https://git.kernel.org/stable/c/1936fa05a180834c3b52e0439a6bddc07814d3eb" }, { "url": "https://git.kernel.org/stable/c/499f742fed42e74f1321f4b12ca196a66a2b49fc" }, { "url": "https://git.kernel.org/stable/c/b4a3a89fffcdf09702b1f161b914e52abca1894d" } ], "title": "lib: objagg: Fix general protection fault", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43846", "datePublished": "2024-08-17T09:22:00.481Z", "dateReserved": "2024-08-17T09:11:59.275Z", "dateUpdated": "2024-12-19T09:17:02.917Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42294
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: fix deadlock between sd_remove & sd_release
Our test report the following hung task:
[ 2538.459400] INFO: task "kworker/0:0":7 blocked for more than 188 seconds.
[ 2538.459427] Call trace:
[ 2538.459430] __switch_to+0x174/0x338
[ 2538.459436] __schedule+0x628/0x9c4
[ 2538.459442] schedule+0x7c/0xe8
[ 2538.459447] schedule_preempt_disabled+0x24/0x40
[ 2538.459453] __mutex_lock+0x3ec/0xf04
[ 2538.459456] __mutex_lock_slowpath+0x14/0x24
[ 2538.459459] mutex_lock+0x30/0xd8
[ 2538.459462] del_gendisk+0xdc/0x350
[ 2538.459466] sd_remove+0x30/0x60
[ 2538.459470] device_release_driver_internal+0x1c4/0x2c4
[ 2538.459474] device_release_driver+0x18/0x28
[ 2538.459478] bus_remove_device+0x15c/0x174
[ 2538.459483] device_del+0x1d0/0x358
[ 2538.459488] __scsi_remove_device+0xa8/0x198
[ 2538.459493] scsi_forget_host+0x50/0x70
[ 2538.459497] scsi_remove_host+0x80/0x180
[ 2538.459502] usb_stor_disconnect+0x68/0xf4
[ 2538.459506] usb_unbind_interface+0xd4/0x280
[ 2538.459510] device_release_driver_internal+0x1c4/0x2c4
[ 2538.459514] device_release_driver+0x18/0x28
[ 2538.459518] bus_remove_device+0x15c/0x174
[ 2538.459523] device_del+0x1d0/0x358
[ 2538.459528] usb_disable_device+0x84/0x194
[ 2538.459532] usb_disconnect+0xec/0x300
[ 2538.459537] hub_event+0xb80/0x1870
[ 2538.459541] process_scheduled_works+0x248/0x4dc
[ 2538.459545] worker_thread+0x244/0x334
[ 2538.459549] kthread+0x114/0x1bc
[ 2538.461001] INFO: task "fsck.":15415 blocked for more than 188 seconds.
[ 2538.461014] Call trace:
[ 2538.461016] __switch_to+0x174/0x338
[ 2538.461021] __schedule+0x628/0x9c4
[ 2538.461025] schedule+0x7c/0xe8
[ 2538.461030] blk_queue_enter+0xc4/0x160
[ 2538.461034] blk_mq_alloc_request+0x120/0x1d4
[ 2538.461037] scsi_execute_cmd+0x7c/0x23c
[ 2538.461040] ioctl_internal_command+0x5c/0x164
[ 2538.461046] scsi_set_medium_removal+0x5c/0xb0
[ 2538.461051] sd_release+0x50/0x94
[ 2538.461054] blkdev_put+0x190/0x28c
[ 2538.461058] blkdev_release+0x28/0x40
[ 2538.461063] __fput+0xf8/0x2a8
[ 2538.461066] __fput_sync+0x28/0x5c
[ 2538.461070] __arm64_sys_close+0x84/0xe8
[ 2538.461073] invoke_syscall+0x58/0x114
[ 2538.461078] el0_svc_common+0xac/0xe0
[ 2538.461082] do_el0_svc+0x1c/0x28
[ 2538.461087] el0_svc+0x38/0x68
[ 2538.461090] el0t_64_sync_handler+0x68/0xbc
[ 2538.461093] el0t_64_sync+0x1a8/0x1ac
T1: T2:
sd_remove
del_gendisk
__blk_mark_disk_dead
blk_freeze_queue_start
++q->mq_freeze_depth
bdev_release
mutex_lock(&disk->open_mutex)
sd_release
scsi_execute_cmd
blk_queue_enter
wait_event(!q->mq_freeze_depth)
mutex_lock(&disk->open_mutex)
SCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in
this scenario. This is a classic ABBA deadlock. To fix the deadlock,
make sure we don't try to acquire disk->open_mutex after freezing
the queue.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42294", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:53.890596Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:29.244Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "block/genhd.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "5a5625a83eac91fdff1d5f0202ecfc45a31983c9", "status": "affected", "version": "eec1be4c30df73238b936fa9f3653773a6f8b15c", "versionType": "git" }, { "lessThan": "f5418f48a93b69ed9e6a2281eee06b412f14a544", "status": "affected", "version": "eec1be4c30df73238b936fa9f3653773a6f8b15c", "versionType": "git" }, { "lessThan": "7e04da2dc7013af50ed3a2beb698d5168d1e594b", "status": "affected", "version": "eec1be4c30df73238b936fa9f3653773a6f8b15c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "block/genhd.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.5" }, { "lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix deadlock between sd_remove \u0026 sd_release\n\nOur test report the following hung task:\n\n[ 2538.459400] INFO: task \"kworker/0:0\":7 blocked for more than 188 seconds.\n[ 2538.459427] Call trace:\n[ 2538.459430] __switch_to+0x174/0x338\n[ 2538.459436] __schedule+0x628/0x9c4\n[ 2538.459442] schedule+0x7c/0xe8\n[ 2538.459447] schedule_preempt_disabled+0x24/0x40\n[ 2538.459453] __mutex_lock+0x3ec/0xf04\n[ 2538.459456] __mutex_lock_slowpath+0x14/0x24\n[ 2538.459459] mutex_lock+0x30/0xd8\n[ 2538.459462] del_gendisk+0xdc/0x350\n[ 2538.459466] sd_remove+0x30/0x60\n[ 2538.459470] device_release_driver_internal+0x1c4/0x2c4\n[ 2538.459474] device_release_driver+0x18/0x28\n[ 2538.459478] bus_remove_device+0x15c/0x174\n[ 2538.459483] device_del+0x1d0/0x358\n[ 2538.459488] __scsi_remove_device+0xa8/0x198\n[ 2538.459493] scsi_forget_host+0x50/0x70\n[ 2538.459497] scsi_remove_host+0x80/0x180\n[ 2538.459502] usb_stor_disconnect+0x68/0xf4\n[ 2538.459506] usb_unbind_interface+0xd4/0x280\n[ 2538.459510] device_release_driver_internal+0x1c4/0x2c4\n[ 2538.459514] device_release_driver+0x18/0x28\n[ 2538.459518] bus_remove_device+0x15c/0x174\n[ 2538.459523] device_del+0x1d0/0x358\n[ 2538.459528] usb_disable_device+0x84/0x194\n[ 2538.459532] usb_disconnect+0xec/0x300\n[ 2538.459537] hub_event+0xb80/0x1870\n[ 2538.459541] process_scheduled_works+0x248/0x4dc\n[ 2538.459545] worker_thread+0x244/0x334\n[ 2538.459549] kthread+0x114/0x1bc\n\n[ 2538.461001] INFO: task \"fsck.\":15415 blocked for more than 188 seconds.\n[ 2538.461014] Call trace:\n[ 2538.461016] __switch_to+0x174/0x338\n[ 2538.461021] __schedule+0x628/0x9c4\n[ 2538.461025] schedule+0x7c/0xe8\n[ 2538.461030] blk_queue_enter+0xc4/0x160\n[ 2538.461034] blk_mq_alloc_request+0x120/0x1d4\n[ 2538.461037] scsi_execute_cmd+0x7c/0x23c\n[ 2538.461040] ioctl_internal_command+0x5c/0x164\n[ 2538.461046] scsi_set_medium_removal+0x5c/0xb0\n[ 2538.461051] sd_release+0x50/0x94\n[ 2538.461054] blkdev_put+0x190/0x28c\n[ 2538.461058] blkdev_release+0x28/0x40\n[ 2538.461063] __fput+0xf8/0x2a8\n[ 2538.461066] __fput_sync+0x28/0x5c\n[ 2538.461070] __arm64_sys_close+0x84/0xe8\n[ 2538.461073] invoke_syscall+0x58/0x114\n[ 2538.461078] el0_svc_common+0xac/0xe0\n[ 2538.461082] do_el0_svc+0x1c/0x28\n[ 2538.461087] el0_svc+0x38/0x68\n[ 2538.461090] el0t_64_sync_handler+0x68/0xbc\n[ 2538.461093] el0t_64_sync+0x1a8/0x1ac\n\n T1:\t\t\t\tT2:\n sd_remove\n del_gendisk\n __blk_mark_disk_dead\n blk_freeze_queue_start\n ++q-\u003emq_freeze_depth\n \t\t\t\tbdev_release\n \t\t\t\tmutex_lock(\u0026disk-\u003eopen_mutex)\n \t\t\t\tsd_release\n \t\t\t\tscsi_execute_cmd\n \t\t\t\tblk_queue_enter\n \t\t\t\twait_event(!q-\u003emq_freeze_depth)\n mutex_lock(\u0026disk-\u003eopen_mutex)\n\nSCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in\nthis scenario. This is a classic ABBA deadlock. To fix the deadlock,\nmake sure we don\u0027t try to acquire disk-\u003eopen_mutex after freezing\nthe queue." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:49.039Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/5a5625a83eac91fdff1d5f0202ecfc45a31983c9" }, { "url": "https://git.kernel.org/stable/c/f5418f48a93b69ed9e6a2281eee06b412f14a544" }, { "url": "https://git.kernel.org/stable/c/7e04da2dc7013af50ed3a2beb698d5168d1e594b" } ], "title": "block: fix deadlock between sd_remove \u0026 sd_release", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42294", "datePublished": "2024-08-17T09:09:02.984Z", "dateReserved": "2024-07-30T07:40:12.269Z", "dateUpdated": "2024-12-19T09:15:49.039Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43857
Vulnerability from cvelistv5
Published
2024-08-17 09:24
Modified
2024-12-19 09:17
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix null reference error when checking end of zone
This patch fixes a potentially null pointer being accessed by
is_end_zone_blkaddr() that checks the last block of a zone
when f2fs is mounted as a single device.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43857", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:04.892219Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:20.398Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/f2fs/data.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b98777309756ebe15cc9ad4e8ab64bbfaf878a3f", "status": "affected", "version": "e067dc3c6b9c419bac43c6a0be2d85f44681f863", "versionType": "git" }, { "lessThan": "381cbe85592c78fbaeb3e770e3e9f3bfa3e67efb", "status": "affected", "version": "e067dc3c6b9c419bac43c6a0be2d85f44681f863", "versionType": "git" }, { "lessThan": "c82bc1ab2a8a5e73d9728e80c4c2ed87e8921a38", "status": "affected", "version": "e067dc3c6b9c419bac43c6a0be2d85f44681f863", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/f2fs/data.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.5" }, { "lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.64", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix null reference error when checking end of zone\n\nThis patch fixes a potentially null pointer being accessed by\nis_end_zone_blkaddr() that checks the last block of a zone\nwhen f2fs is mounted as a single device." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:17:15.754Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b98777309756ebe15cc9ad4e8ab64bbfaf878a3f" }, { "url": "https://git.kernel.org/stable/c/381cbe85592c78fbaeb3e770e3e9f3bfa3e67efb" }, { "url": "https://git.kernel.org/stable/c/c82bc1ab2a8a5e73d9728e80c4c2ed87e8921a38" } ], "title": "f2fs: fix null reference error when checking end of zone", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-43857", "datePublished": "2024-08-17T09:24:27.279Z", "dateReserved": "2024-08-17T09:11:59.279Z", "dateUpdated": "2024-12-19T09:17:15.754Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42284
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: Return non-zero value from tipc_udp_addr2str() on error
tipc_udp_addr2str() should return non-zero value if the UDP media
address is invalid. Otherwise, a buffer overflow access can occur in
tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP
media address.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: d0f91938bede204a343473792529e0db7d599836 Version: d0f91938bede204a343473792529e0db7d599836 Version: d0f91938bede204a343473792529e0db7d599836 Version: d0f91938bede204a343473792529e0db7d599836 Version: d0f91938bede204a343473792529e0db7d599836 Version: d0f91938bede204a343473792529e0db7d599836 Version: d0f91938bede204a343473792529e0db7d599836 Version: d0f91938bede204a343473792529e0db7d599836 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42284", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:26.639456Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:30.616Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/tipc/udp_media.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "7ec3335dd89c8d169e9650e4bac64fde71fdf15b", "status": "affected", "version": "d0f91938bede204a343473792529e0db7d599836", "versionType": "git" }, { "lessThan": "253405541be2f15ffebdeac2f4cf4b7e9144d12f", "status": "affected", "version": "d0f91938bede204a343473792529e0db7d599836", "versionType": "git" }, { "lessThan": "aa38bf74899de07cf70b50cd17f8ad45fb6654c8", "status": "affected", "version": "d0f91938bede204a343473792529e0db7d599836", "versionType": "git" }, { "lessThan": "5eea127675450583680c8170358bcba43227bd69", "status": "affected", "version": "d0f91938bede204a343473792529e0db7d599836", "versionType": "git" }, { "lessThan": "728734352743a78b4c5a7285b282127696a4a813", "status": "affected", "version": "d0f91938bede204a343473792529e0db7d599836", "versionType": "git" }, { "lessThan": "76ddf84a52f0d8ec3f5db6ccce08faf202a17d28", "status": "affected", "version": "d0f91938bede204a343473792529e0db7d599836", "versionType": "git" }, { "lessThan": "2abe350db1aa599eeebc6892237d0bce0f1de62a", "status": "affected", "version": "d0f91938bede204a343473792529e0db7d599836", "versionType": "git" }, { "lessThan": "fa96c6baef1b5385e2f0c0677b32b3839e716076", "status": "affected", "version": "d0f91938bede204a343473792529e0db7d599836", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/tipc/udp_media.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.1" }, { "lessThan": "4.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Return non-zero value from tipc_udp_addr2str() on error\n\ntipc_udp_addr2str() should return non-zero value if the UDP media\naddress is invalid. Otherwise, a buffer overflow access can occur in\ntipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP\nmedia address." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:37.218Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/7ec3335dd89c8d169e9650e4bac64fde71fdf15b" }, { "url": "https://git.kernel.org/stable/c/253405541be2f15ffebdeac2f4cf4b7e9144d12f" }, { "url": "https://git.kernel.org/stable/c/aa38bf74899de07cf70b50cd17f8ad45fb6654c8" }, { "url": "https://git.kernel.org/stable/c/5eea127675450583680c8170358bcba43227bd69" }, { "url": "https://git.kernel.org/stable/c/728734352743a78b4c5a7285b282127696a4a813" }, { "url": "https://git.kernel.org/stable/c/76ddf84a52f0d8ec3f5db6ccce08faf202a17d28" }, { "url": "https://git.kernel.org/stable/c/2abe350db1aa599eeebc6892237d0bce0f1de62a" }, { "url": "https://git.kernel.org/stable/c/fa96c6baef1b5385e2f0c0677b32b3839e716076" } ], "title": "tipc: Return non-zero value from tipc_udp_addr2str() on error", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42284", "datePublished": "2024-08-17T09:08:50.576Z", "dateReserved": "2024-07-30T07:40:12.262Z", "dateUpdated": "2024-12-19T09:15:37.218Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42290
Vulnerability from cvelistv5
Published
2024-08-17 09:08
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
irqchip/imx-irqsteer: Handle runtime power management correctly
The power domain is automatically activated from clk_prepare(). However, on
certain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes
sleeping functions, which triggers the 'scheduling while atomic' bug in the
context switch path during device probing:
BUG: scheduling while atomic: kworker/u13:1/48/0x00000002
Call trace:
__schedule_bug+0x54/0x6c
__schedule+0x7f0/0xa94
schedule+0x5c/0xc4
schedule_preempt_disabled+0x24/0x40
__mutex_lock.constprop.0+0x2c0/0x540
__mutex_lock_slowpath+0x14/0x20
mutex_lock+0x48/0x54
clk_prepare_lock+0x44/0xa0
clk_prepare+0x20/0x44
imx_irqsteer_resume+0x28/0xe0
pm_generic_runtime_resume+0x2c/0x44
__genpd_runtime_resume+0x30/0x80
genpd_runtime_resume+0xc8/0x2c0
__rpm_callback+0x48/0x1d8
rpm_callback+0x6c/0x78
rpm_resume+0x490/0x6b4
__pm_runtime_resume+0x50/0x94
irq_chip_pm_get+0x2c/0xa0
__irq_do_set_handler+0x178/0x24c
irq_set_chained_handler_and_data+0x60/0xa4
mxc_gpio_probe+0x160/0x4b0
Cure this by implementing the irq_bus_lock/sync_unlock() interrupt chip
callbacks and handle power management in them as they are invoked from
non-atomic context.
[ tglx: Rewrote change log, added Fixes tag ]
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 0136afa08967f6e160b9b4e85a7a70e4180a8333 Version: 0136afa08967f6e160b9b4e85a7a70e4180a8333 Version: 0136afa08967f6e160b9b4e85a7a70e4180a8333 Version: 0136afa08967f6e160b9b4e85a7a70e4180a8333 Version: 0136afa08967f6e160b9b4e85a7a70e4180a8333 Version: 0136afa08967f6e160b9b4e85a7a70e4180a8333 Version: 0136afa08967f6e160b9b4e85a7a70e4180a8333 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42290", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:11:06.963924Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:29.783Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/irqchip/irq-imx-irqsteer.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "a590e8dea3df2639921f874d763be961dd74e8f9", "status": "affected", "version": "0136afa08967f6e160b9b4e85a7a70e4180a8333", "versionType": "git" }, { "lessThan": "3a2884a44e5cda192df1b28e9925661f79f599a1", "status": "affected", "version": "0136afa08967f6e160b9b4e85a7a70e4180a8333", "versionType": "git" }, { "lessThan": "fa1803401e1c360efe6342fb41d161cc51748a11", "status": "affected", "version": "0136afa08967f6e160b9b4e85a7a70e4180a8333", "versionType": "git" }, { "lessThan": "58c56735facb225a5c46fa4b8bbbe7f31d1cb894", "status": "affected", "version": "0136afa08967f6e160b9b4e85a7a70e4180a8333", "versionType": "git" }, { "lessThan": "21bd3f9e7f924cd2fc892a484e7a50c7e1847565", "status": "affected", "version": "0136afa08967f6e160b9b4e85a7a70e4180a8333", "versionType": "git" }, { "lessThan": "f8ae38f1dfe652779c7c613facbc257cec00ac44", "status": "affected", "version": "0136afa08967f6e160b9b4e85a7a70e4180a8333", "versionType": "git" }, { "lessThan": "33b1c47d1fc0b5f06a393bb915db85baacba18ea", "status": "affected", "version": "0136afa08967f6e160b9b4e85a7a70e4180a8333", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/irqchip/irq-imx-irqsteer.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.0" }, { "lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/imx-irqsteer: Handle runtime power management correctly\n\nThe power domain is automatically activated from clk_prepare(). However, on\ncertain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes\nsleeping functions, which triggers the \u0027scheduling while atomic\u0027 bug in the\ncontext switch path during device probing:\n\n BUG: scheduling while atomic: kworker/u13:1/48/0x00000002\n Call trace:\n __schedule_bug+0x54/0x6c\n __schedule+0x7f0/0xa94\n schedule+0x5c/0xc4\n schedule_preempt_disabled+0x24/0x40\n __mutex_lock.constprop.0+0x2c0/0x540\n __mutex_lock_slowpath+0x14/0x20\n mutex_lock+0x48/0x54\n clk_prepare_lock+0x44/0xa0\n clk_prepare+0x20/0x44\n imx_irqsteer_resume+0x28/0xe0\n pm_generic_runtime_resume+0x2c/0x44\n __genpd_runtime_resume+0x30/0x80\n genpd_runtime_resume+0xc8/0x2c0\n __rpm_callback+0x48/0x1d8\n rpm_callback+0x6c/0x78\n rpm_resume+0x490/0x6b4\n __pm_runtime_resume+0x50/0x94\n irq_chip_pm_get+0x2c/0xa0\n __irq_do_set_handler+0x178/0x24c\n irq_set_chained_handler_and_data+0x60/0xa4\n mxc_gpio_probe+0x160/0x4b0\n\nCure this by implementing the irq_bus_lock/sync_unlock() interrupt chip\ncallbacks and handle power management in them as they are invoked from\nnon-atomic context.\n\n[ tglx: Rewrote change log, added Fixes tag ]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:44.213Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/a590e8dea3df2639921f874d763be961dd74e8f9" }, { "url": "https://git.kernel.org/stable/c/3a2884a44e5cda192df1b28e9925661f79f599a1" }, { "url": "https://git.kernel.org/stable/c/fa1803401e1c360efe6342fb41d161cc51748a11" }, { "url": "https://git.kernel.org/stable/c/58c56735facb225a5c46fa4b8bbbe7f31d1cb894" }, { "url": "https://git.kernel.org/stable/c/21bd3f9e7f924cd2fc892a484e7a50c7e1847565" }, { "url": "https://git.kernel.org/stable/c/f8ae38f1dfe652779c7c613facbc257cec00ac44" }, { "url": "https://git.kernel.org/stable/c/33b1c47d1fc0b5f06a393bb915db85baacba18ea" } ], "title": "irqchip/imx-irqsteer: Handle runtime power management correctly", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42290", "datePublished": "2024-08-17T09:08:59.848Z", "dateReserved": "2024-07-30T07:40:12.268Z", "dateUpdated": "2024-12-19T09:15:44.213Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42301
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dev/parport: fix the array out-of-bounds risk
Fixed array out-of-bounds issues caused by sprintf
by replacing it with snprintf for safer data copying,
ensuring the destination buffer is not overflowed.
Below is the stack trace I encountered during the actual issue:
[ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector:
Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport]
[ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm:
QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2
[ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp
[ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun
PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024
[ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace:
[ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0
[ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20
[ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c
[ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc
[ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38
[ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport]
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-42301", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:10:32.108495Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:05.142Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/parport/procfs.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "166a0bddcc27de41fe13f861c8348e8e53e988c8", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "47b3dce100778001cd76f7e9188944b5cb27a76d", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "c719b393374d3763e64900ee19aaed767d5a08d6", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "7f4da759092a1a6ce35fb085182d02de8cc4cc84", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "b579ea3516c371ecf59d073772bc45dfd28c8a0e", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "7789a1d6792af410aa9b39a1eb237ed24fa2170a", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "ab11dac93d2d568d151b1918d7b84c2d02bacbd5", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/parport/procfs.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndev/parport: fix the array out-of-bounds risk\n\nFixed array out-of-bounds issues caused by sprintf\nby replacing it with snprintf for safer data copying,\nensuring the destination buffer is not overflowed.\n\nBelow is the stack trace I encountered during the actual issue:\n\n[ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector:\nKernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport]\n[ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm:\nQThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2\n[ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp\n[ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun\nPGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024\n[ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace:\n[ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0\n[ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20\n[ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c\n[ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc\n[ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38\n[ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:15:57.640Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/166a0bddcc27de41fe13f861c8348e8e53e988c8" }, { "url": "https://git.kernel.org/stable/c/47b3dce100778001cd76f7e9188944b5cb27a76d" }, { "url": "https://git.kernel.org/stable/c/a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0" }, { "url": "https://git.kernel.org/stable/c/c719b393374d3763e64900ee19aaed767d5a08d6" }, { "url": "https://git.kernel.org/stable/c/7f4da759092a1a6ce35fb085182d02de8cc4cc84" }, { "url": "https://git.kernel.org/stable/c/b579ea3516c371ecf59d073772bc45dfd28c8a0e" }, { "url": "https://git.kernel.org/stable/c/7789a1d6792af410aa9b39a1eb237ed24fa2170a" }, { "url": "https://git.kernel.org/stable/c/ab11dac93d2d568d151b1918d7b84c2d02bacbd5" } ], "title": "dev/parport: fix the array out-of-bounds risk", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42301", "datePublished": "2024-08-17T09:09:08.057Z", "dateReserved": "2024-07-30T07:40:12.271Z", "dateUpdated": "2024-12-19T09:15:57.640Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42318
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
landlock: Don't lose track of restrictions on cred_transfer
When a process' cred struct is replaced, this _almost_ always invokes
the cred_prepare LSM hook; but in one special case (when
KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the
cred_transfer LSM hook is used instead. Landlock only implements the
cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes
all information on Landlock restrictions to be lost.
This basically means that a process with the ability to use the fork()
and keyctl() syscalls can get rid of all Landlock restrictions on
itself.
Fix it by adding a cred_transfer hook that does the same thing as the
existing cred_prepare hook. (Implemented by having hook_cred_prepare()
call hook_cred_transfer() so that the two functions are less likely to
accidentally diverge in the future.)
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 Version: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 Version: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 Version: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 Version: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 |
||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-17T19:02:26.874Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "url": "http://www.openwall.com/lists/oss-security/2024/08/17/2" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-42318", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:35.795087Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-12T17:33:26.227Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "security/landlock/cred.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "916c648323fa53b89eedb34a0988ddaf01406117", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git" }, { "lessThan": "0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git" }, { "lessThan": "16896914bace82d7811c62f3b6d5320132384f49", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git" }, { "lessThan": "b14cc2cf313bd29056fadbc8ecd7f957cf5791ff", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git" }, { "lessThan": "39705a6c29f8a2b93cf5b99528a55366c50014d1", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "security/landlock/cred.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.13" }, { "lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Don\u0027t lose track of restrictions on cred_transfer\n\nWhen a process\u0027 cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent\u0027s credentials), the\ncred_transfer LSM hook is used instead. Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\n\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\n\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:16:17.845Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117" }, { "url": "https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c" }, { "url": "https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49" }, { "url": "https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff" }, { "url": "https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1" }, { "url": "https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/" }, { "url": "https://www.openwall.com/lists/oss-security/2024/08/17/2" }, { "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2566" } ], "title": "landlock: Don\u0027t lose track of restrictions on cred_transfer", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-42318", "datePublished": "2024-08-17T09:09:31.160Z", "dateReserved": "2024-07-30T07:40:12.278Z", "dateUpdated": "2024-12-19T09:16:17.845Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.