Action not permitted
Modal body text goes here.
Modal Title
Modal Body
wid-sec-w-2024-3509
Vulnerability from csaf_certbund
Published
2024-11-19 23:00
Modified
2025-01-19 23:00
Summary
Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Der Kernel stellt den Kern des Linux Betriebssystems dar.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3509 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3509.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3509 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3509"
},
{
"category": "external",
"summary": "Kernel CVE Announce Mailingliste",
"url": "https://lore.kernel.org/linux-cve-announce/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53079",
"url": "https://lore.kernel.org/linux-cve-announce/2024111901-CVE-2024-53079-7501@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53080",
"url": "https://lore.kernel.org/linux-cve-announce/2024111904-CVE-2024-53080-e1a8@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53081",
"url": "https://lore.kernel.org/linux-cve-announce/2024111904-CVE-2024-53081-72b5@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53082",
"url": "https://lore.kernel.org/linux-cve-announce/2024111904-CVE-2024-53082-30c0@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53083",
"url": "https://lore.kernel.org/linux-cve-announce/2024111905-CVE-2024-53083-6ed0@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53084",
"url": "https://lore.kernel.org/linux-cve-announce/2024111905-CVE-2024-53084-1021@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53085",
"url": "https://lore.kernel.org/linux-cve-announce/2024111905-CVE-2024-53085-9cf3@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53086",
"url": "https://lore.kernel.org/linux-cve-announce/2024111906-CVE-2024-53086-af24@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53087",
"url": "https://lore.kernel.org/linux-cve-announce/2024111906-CVE-2024-53087-6cd3@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53088",
"url": "https://lore.kernel.org/linux-cve-announce/2024111906-CVE-2024-53088-795c@gregkh/#u"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53073",
"url": "https://lore.kernel.org/linux-cve-announce/2024111924-CVE-2024-53073-16f8@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53074",
"url": "https://lore.kernel.org/linux-cve-announce/2024111924-CVE-2024-53074-e49b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53075",
"url": "https://lore.kernel.org/linux-cve-announce/2024111924-CVE-2024-53075-2e34@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53076",
"url": "https://lore.kernel.org/linux-cve-announce/2024111925-CVE-2024-53076-713e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53077",
"url": "https://lore.kernel.org/linux-cve-announce/2024111925-CVE-2024-53077-f48f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53078",
"url": "https://lore.kernel.org/linux-cve-announce/2024111925-CVE-2024-53078-f504@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53060",
"url": "https://lore.kernel.org/linux-cve-announce/2024111931-CVE-2024-53060-3b94@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53062",
"url": "https://lore.kernel.org/linux-cve-announce/2024111931-CVE-2024-53062-c9f7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53063",
"url": "https://lore.kernel.org/linux-cve-announce/2024111932-CVE-2024-53063-1ffa@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53064",
"url": "https://lore.kernel.org/linux-cve-announce/2024111932-CVE-2024-53064-119c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53065",
"url": "https://lore.kernel.org/linux-cve-announce/2024111932-CVE-2024-53065-3a63@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53066",
"url": "https://lore.kernel.org/linux-cve-announce/2024111932-CVE-2024-53066-abf7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53067",
"url": "https://lore.kernel.org/linux-cve-announce/2024111933-CVE-2024-53067-0c9e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53068",
"url": "https://lore.kernel.org/linux-cve-announce/2024111933-CVE-2024-53068-8c2a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53069",
"url": "https://lore.kernel.org/linux-cve-announce/2024111933-CVE-2024-53069-2786@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-50303",
"url": "https://lore.kernel.org/linux-cve-announce/2024111922-CVE-2024-50303-2bd7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-50304",
"url": "https://lore.kernel.org/linux-cve-announce/2024111924-CVE-2024-50304-da6d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53042",
"url": "https://lore.kernel.org/linux-cve-announce/2024111924-CVE-2024-53042-f7e1@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53043",
"url": "https://lore.kernel.org/linux-cve-announce/2024111925-CVE-2024-53043-f450@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53044",
"url": "https://lore.kernel.org/linux-cve-announce/2024111925-CVE-2024-53044-e0d1@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53045",
"url": "https://lore.kernel.org/linux-cve-announce/2024111925-CVE-2024-53045-e1dc@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53046",
"url": "https://lore.kernel.org/linux-cve-announce/2024111926-CVE-2024-53046-b36d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53047",
"url": "https://lore.kernel.org/linux-cve-announce/2024111926-CVE-2024-53047-8214@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53048",
"url": "https://lore.kernel.org/linux-cve-announce/2024111926-CVE-2024-53048-cdd4@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53049",
"url": "https://lore.kernel.org/linux-cve-announce/2024111926-CVE-2024-53049-fa45@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53050",
"url": "https://lore.kernel.org/linux-cve-announce/2024111927-CVE-2024-53050-b59c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53051",
"url": "https://lore.kernel.org/linux-cve-announce/2024111927-CVE-2024-53051-5184@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53052",
"url": "https://lore.kernel.org/linux-cve-announce/2024111927-CVE-2024-53052-3bd9@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53053",
"url": "https://lore.kernel.org/linux-cve-announce/2024111927-CVE-2024-53053-57bf@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53054",
"url": "https://lore.kernel.org/linux-cve-announce/2024111927-CVE-2024-53054-7da4@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53055",
"url": "https://lore.kernel.org/linux-cve-announce/2024111928-CVE-2024-53055-4a64@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53056",
"url": "https://lore.kernel.org/linux-cve-announce/2024111928-CVE-2024-53056-ae69@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53057",
"url": "https://lore.kernel.org/linux-cve-announce/2024111928-CVE-2024-53057-a3a5@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53058",
"url": "https://lore.kernel.org/linux-cve-announce/2024111928-CVE-2024-53058-7bd0@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53059",
"url": "https://lore.kernel.org/linux-cve-announce/2024111928-CVE-2024-53059-4f81@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53061",
"url": "https://lore.kernel.org/linux-cve-announce/2024111931-CVE-2024-53061-a7a1@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53070",
"url": "https://lore.kernel.org/linux-cve-announce/2024111933-CVE-2024-53070-6eea@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53071",
"url": "https://lore.kernel.org/linux-cve-announce/2024111934-CVE-2024-53071-ddbc@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53072",
"url": "https://lore.kernel.org/linux-cve-announce/2024111934-CVE-2024-53072-f307@gregkh/"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-5818 vom 2024-11-24",
"url": "https://lists.debian.org/debian-security-announce/2024/msg00233.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4318-1 vom 2024-12-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/019999.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4314-1 vom 2024-12-13",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SARXL66CQHD5VSFG5PUBNBVBPVFUN4KT/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4313-1 vom 2024-12-13",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PCO2TL4OCZ4YUXTF7OMLI6WH3WKDUC2G/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4315-1 vom 2024-12-13",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LQPWDP54GSTHYCV4CTCOE67D2ANVPPUW/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4317-1 vom 2024-12-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020000.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4316-1 vom 2024-12-13",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/S4I5Z6ALCJLHTP25U3HMJHEXN4DR2USM/"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7163-1 vom 2024-12-16",
"url": "https://ubuntu.com/security/notices/USN-7163-1"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2024-12884 vom 2024-12-17",
"url": "https://linux.oracle.com/errata/ELSA-2024-12884.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7169-1 vom 2024-12-17",
"url": "https://ubuntu.com/security/notices/USN-7169-1"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4346-1 vom 2024-12-17",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2FJJW5HEWYSYWAJBRWARBIZ4AQHAXLNG/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4345-1 vom 2024-12-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020018.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4364-1 vom 2024-12-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020019.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4367-1 vom 2024-12-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020025.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7167-1 vom 2024-12-17",
"url": "https://ubuntu.com/security/notices/USN-7167-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7170-1 vom 2024-12-17",
"url": "https://ubuntu.com/security/notices/USN-7170-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7173-1 vom 2024-12-17",
"url": "https://ubuntu.com/security/notices/USN-7173-1"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WFOJHFFEHK42VPQ6XLZWB77H5OEJ3FF4/"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2024-12887 vom 2024-12-18",
"url": "https://linux.oracle.com/errata/ELSA-2024-12887.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WFOJHFFEHK42VPQ6XLZWB77H5OEJ3FF4/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020028.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7169-2 vom 2024-12-18",
"url": "https://ubuntu.com/security/notices/USN-7169-2"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4387-1 vom 2024-12-19",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020032.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4388-1 vom 2024-12-19",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020034.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7179-1 vom 2024-12-20",
"url": "https://ubuntu.com/security/notices/USN-7179-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7173-2 vom 2024-12-20",
"url": "https://ubuntu.com/security/notices/USN-7173-2"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:4397-1 vom 2024-12-20",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-December/020041.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7184-1 vom 2025-01-06",
"url": "https://ubuntu.com/security/notices/USN-7184-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7186-1 vom 2025-01-06",
"url": "https://ubuntu.com/security/notices/USN-7186-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7179-2 vom 2025-01-06",
"url": "https://ubuntu.com/security/notices/USN-7179-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7183-1 vom 2025-01-06",
"url": "https://ubuntu.com/security/notices/USN-7183-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7167-2 vom 2025-01-07",
"url": "https://ubuntu.com/security/notices/USN-7167-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7169-3 vom 2025-01-07",
"url": "https://ubuntu.com/security/notices/USN-7169-3"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:0065 vom 2025-01-08",
"url": "https://access.redhat.com/errata/RHSA-2025:0065"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:0066 vom 2025-01-08",
"url": "https://access.redhat.com/errata/RHSA-2025:0066"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7179-3 vom 2025-01-07",
"url": "https://ubuntu.com/security/notices/USN-7179-3"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:0035-1 vom 2025-01-08",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020070.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7186-2 vom 2025-01-09",
"url": "https://ubuntu.com/security/notices/USN-7186-2"
},
{
"category": "external",
"summary": "Google Cloud Platform Security Bulletin GCP-2025-002 vom 2025-01-09",
"url": "https://cloud.google.com/support/bulletins#gcp-2025-002"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7169-4 vom 2025-01-09",
"url": "https://ubuntu.com/security/notices/USN-7169-4"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7196-1 vom 2025-01-09",
"url": "https://ubuntu.com/security/notices/USN-7196-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7195-1 vom 2025-01-09",
"url": "https://ubuntu.com/security/notices/USN-7195-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7185-2 vom 2025-01-09",
"url": "https://ubuntu.com/security/notices/USN-7185-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7169-5 vom 2025-01-10",
"url": "https://ubuntu.com/security/notices/USN-7169-5"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2025:0066 vom 2025-01-11",
"url": "https://errata.build.resf.org/RLSA-2025:0066"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2025:0065 vom 2025-01-11",
"url": "https://errata.build.resf.org/RLSA-2025:0065"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-0065 vom 2025-01-11",
"url": "http://linux.oracle.com/errata/ELSA-2025-0065.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-20018 vom 2025-01-13",
"url": "https://linux.oracle.com/errata/ELSA-2025-20018.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7195-2 vom 2025-01-14",
"url": "https://ubuntu.com/security/notices/USN-7195-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7173-3 vom 2025-01-15",
"url": "https://ubuntu.com/security/notices/USN-7173-3"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:0153-1 vom 2025-01-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020150.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:0154-1 vom 2025-01-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020151.html"
}
],
"source_lang": "en-US",
"title": "Linux Kernel: Mehrere Schwachstellen erm\u00f6glichen nicht spezifizierten Angriff",
"tracking": {
"current_release_date": "2025-01-19T23:00:00.000+00:00",
"generator": {
"date": "2025-01-20T09:18:47.755+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.10"
}
},
"id": "WID-SEC-W-2024-3509",
"initial_release_date": "2024-11-19T23:00:00.000+00:00",
"revision_history": [
{
"date": "2024-11-19T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2024-11-24T23:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-12-15T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-12-16T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Ubuntu und Oracle Linux aufgenommen"
},
{
"date": "2024-12-17T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Ubuntu und SUSE aufgenommen"
},
{
"date": "2024-12-18T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE, Oracle Linux und Ubuntu aufgenommen"
},
{
"date": "2024-12-19T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-12-22T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Ubuntu und SUSE aufgenommen"
},
{
"date": "2025-01-06T23:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2025-01-07T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Ubuntu und Red Hat aufgenommen"
},
{
"date": "2025-01-08T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-01-09T23:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Ubuntu und Google aufgenommen"
},
{
"date": "2025-01-12T23:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von Ubuntu, Rocky Enterprise Software Foundation und Oracle Linux aufgenommen"
},
{
"date": "2025-01-14T23:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2025-01-15T23:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2025-01-19T23:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von SUSE aufgenommen"
}
],
"status": "final",
"version": "16"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Google Container-Optimized OS",
"product": {
"name": "Google Container-Optimized OS",
"product_id": "1607324",
"product_identification_helper": {
"cpe": "cpe:/o:google:container-optimized_os:-"
}
}
}
],
"category": "vendor",
"name": "Google"
},
{
"branches": [
{
"category": "product_name",
"name": "Open Source Linux Kernel",
"product": {
"name": "Open Source Linux Kernel",
"product_id": "T039341",
"product_identification_helper": {
"cpe": "cpe:/o:linux:linux_kernel:-"
}
}
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T004914",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "RESF Rocky Linux",
"product": {
"name": "RESF Rocky Linux",
"product_id": "T032255",
"product_identification_helper": {
"cpe": "cpe:/o:resf:rocky_linux:-"
}
}
}
],
"category": "vendor",
"name": "RESF"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-50303",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-50303"
},
{
"cve": "CVE-2024-50304",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-50304"
},
{
"cve": "CVE-2024-53042",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53042"
},
{
"cve": "CVE-2024-53043",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53043"
},
{
"cve": "CVE-2024-53044",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53044"
},
{
"cve": "CVE-2024-53045",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53045"
},
{
"cve": "CVE-2024-53046",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53046"
},
{
"cve": "CVE-2024-53047",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53047"
},
{
"cve": "CVE-2024-53048",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53048"
},
{
"cve": "CVE-2024-53049",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53049"
},
{
"cve": "CVE-2024-53050",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53050"
},
{
"cve": "CVE-2024-53051",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53051"
},
{
"cve": "CVE-2024-53052",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53052"
},
{
"cve": "CVE-2024-53053",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53053"
},
{
"cve": "CVE-2024-53054",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53054"
},
{
"cve": "CVE-2024-53055",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53055"
},
{
"cve": "CVE-2024-53056",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53056"
},
{
"cve": "CVE-2024-53057",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53057"
},
{
"cve": "CVE-2024-53058",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53058"
},
{
"cve": "CVE-2024-53059",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53059"
},
{
"cve": "CVE-2024-53060",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53060"
},
{
"cve": "CVE-2024-53061",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53061"
},
{
"cve": "CVE-2024-53062",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53062"
},
{
"cve": "CVE-2024-53063",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53063"
},
{
"cve": "CVE-2024-53064",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53064"
},
{
"cve": "CVE-2024-53065",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53065"
},
{
"cve": "CVE-2024-53066",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53066"
},
{
"cve": "CVE-2024-53067",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53067"
},
{
"cve": "CVE-2024-53068",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53068"
},
{
"cve": "CVE-2024-53069",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53069"
},
{
"cve": "CVE-2024-53070",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53070"
},
{
"cve": "CVE-2024-53071",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53071"
},
{
"cve": "CVE-2024-53072",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53072"
},
{
"cve": "CVE-2024-53073",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53073"
},
{
"cve": "CVE-2024-53074",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53074"
},
{
"cve": "CVE-2024-53075",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53075"
},
{
"cve": "CVE-2024-53076",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53076"
},
{
"cve": "CVE-2024-53077",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53077"
},
{
"cve": "CVE-2024-53078",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53078"
},
{
"cve": "CVE-2024-53079",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53079"
},
{
"cve": "CVE-2024-53080",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53080"
},
{
"cve": "CVE-2024-53081",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53081"
},
{
"cve": "CVE-2024-53082",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53082"
},
{
"cve": "CVE-2024-53083",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53083"
},
{
"cve": "CVE-2024-53084",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53084"
},
{
"cve": "CVE-2024-53085",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53085"
},
{
"cve": "CVE-2024-53086",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53086"
},
{
"cve": "CVE-2024-53087",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53087"
},
{
"cve": "CVE-2024-53088",
"notes": [
{
"category": "description",
"text": "Im Linux-Kernel bestehen mehrere Schwachstellen, die auf verschiedene Speicherverwaltungs- und andere Implementierungsfehler zur\u00fcckzuf\u00fchren sind. Komponenten wie drm, virtio, USB und andere sind davon betroffen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand oder andere nicht spezifizierte Effekte zu verursachen."
}
],
"product_status": {
"known_affected": [
"T039341",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"1607324",
"T032255"
]
},
"release_date": "2024-11-19T23:00:00.000+00:00",
"title": "CVE-2024-53088"
}
]
}
cve-2024-53077
Vulnerability from cvelistv5
Published
2024-11-19 17:31
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rpcrdma: Always release the rpcrdma_device's xa_array
Dai pointed out that the xa_init_flags() in rpcrdma_add_one() needs
to have a matching xa_destroy() in rpcrdma_remove_one() to release
underlying memory that the xarray might have accrued during
operation.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/ib_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "36b7f5a4f300d038270324640ff7c1399245159d",
"status": "affected",
"version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
"versionType": "git"
},
{
"lessThan": "63a81588cd2025e75fbaf30b65930b76825c456f",
"status": "affected",
"version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/ib_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpcrdma: Always release the rpcrdma_device\u0027s xa_array\n\nDai pointed out that the xa_init_flags() in rpcrdma_add_one() needs\nto have a matching xa_destroy() in rpcrdma_remove_one() to release\nunderlying memory that the xarray might have accrued during\noperation."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:34.392Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/36b7f5a4f300d038270324640ff7c1399245159d"
},
{
"url": "https://git.kernel.org/stable/c/63a81588cd2025e75fbaf30b65930b76825c456f"
}
],
"title": "rpcrdma: Always release the rpcrdma_device\u0027s xa_array",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53077",
"datePublished": "2024-11-19T17:31:40.974Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:34.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53058
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data
In case the non-paged data of a SKB carries protocol header and protocol
payload to be transmitted on a certain platform that the DMA AXI address
width is configured to 40-bit/48-bit, or the size of the non-paged data
is bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI
address width is configured to 32-bit, then this SKB requires at least
two DMA transmit descriptors to serve it.
For example, three descriptors are allocated to split one DMA buffer
mapped from one piece of non-paged data:
dma_desc[N + 0],
dma_desc[N + 1],
dma_desc[N + 2].
Then three elements of tx_q->tx_skbuff_dma[] will be allocated to hold
extra information to be reused in stmmac_tx_clean():
tx_q->tx_skbuff_dma[N + 0],
tx_q->tx_skbuff_dma[N + 1],
tx_q->tx_skbuff_dma[N + 2].
Now we focus on tx_q->tx_skbuff_dma[entry].buf, which is the DMA buffer
address returned by DMA mapping call. stmmac_tx_clean() will try to
unmap the DMA buffer _ONLY_IF_ tx_q->tx_skbuff_dma[entry].buf
is a valid buffer address.
The expected behavior that saves DMA buffer address of this non-paged
data to tx_q->tx_skbuff_dma[entry].buf is:
tx_q->tx_skbuff_dma[N + 0].buf = NULL;
tx_q->tx_skbuff_dma[N + 1].buf = NULL;
tx_q->tx_skbuff_dma[N + 2].buf = dma_map_single();
Unfortunately, the current code misbehaves like this:
tx_q->tx_skbuff_dma[N + 0].buf = dma_map_single();
tx_q->tx_skbuff_dma[N + 1].buf = NULL;
tx_q->tx_skbuff_dma[N + 2].buf = NULL;
On the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the
DMA engine, tx_q->tx_skbuff_dma[N + 0].buf is a valid buffer address
obviously, then the DMA buffer will be unmapped immediately.
There may be a rare case that the DMA engine does not finish the
pending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go
horribly wrong, DMA is going to access a unmapped/unreferenced memory
region, corrupted data will be transmited or iommu fault will be
triggered :(
In contrast, the for-loop that maps SKB fragments behaves perfectly
as expected, and that is how the driver should do for both non-paged
data and paged frags actually.
This patch corrects DMA map/unmap sequences by fixing the array index
for tx_q->tx_skbuff_dma[entry].buf when assigning DMA buffer address.
Tested and verified on DWXGMAC CORE 3.20a
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: f748be531d7012c456b97f66091d86b3675c5fef Version: f748be531d7012c456b97f66091d86b3675c5fef Version: f748be531d7012c456b97f66091d86b3675c5fef Version: f748be531d7012c456b97f66091d86b3675c5fef Version: f748be531d7012c456b97f66091d86b3675c5fef |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ece593fc9c00741b682869d3f3dc584d37b7c9df",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
},
{
"lessThan": "a3ff23f7c3f0e13f718900803e090fd3997d6bc9",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
},
{
"lessThan": "07c9c26e37542486e34d767505e842f48f29c3f6",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
},
{
"lessThan": "58d23d835eb498336716cca55b5714191a309286",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
},
{
"lessThan": "66600fac7a984dea4ae095411f644770b2561ede",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.171",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data\n\nIn case the non-paged data of a SKB carries protocol header and protocol\npayload to be transmitted on a certain platform that the DMA AXI address\nwidth is configured to 40-bit/48-bit, or the size of the non-paged data\nis bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI\naddress width is configured to 32-bit, then this SKB requires at least\ntwo DMA transmit descriptors to serve it.\n\nFor example, three descriptors are allocated to split one DMA buffer\nmapped from one piece of non-paged data:\n dma_desc[N + 0],\n dma_desc[N + 1],\n dma_desc[N + 2].\nThen three elements of tx_q-\u003etx_skbuff_dma[] will be allocated to hold\nextra information to be reused in stmmac_tx_clean():\n tx_q-\u003etx_skbuff_dma[N + 0],\n tx_q-\u003etx_skbuff_dma[N + 1],\n tx_q-\u003etx_skbuff_dma[N + 2].\nNow we focus on tx_q-\u003etx_skbuff_dma[entry].buf, which is the DMA buffer\naddress returned by DMA mapping call. stmmac_tx_clean() will try to\nunmap the DMA buffer _ONLY_IF_ tx_q-\u003etx_skbuff_dma[entry].buf\nis a valid buffer address.\n\nThe expected behavior that saves DMA buffer address of this non-paged\ndata to tx_q-\u003etx_skbuff_dma[entry].buf is:\n tx_q-\u003etx_skbuff_dma[N + 0].buf = NULL;\n tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n tx_q-\u003etx_skbuff_dma[N + 2].buf = dma_map_single();\nUnfortunately, the current code misbehaves like this:\n tx_q-\u003etx_skbuff_dma[N + 0].buf = dma_map_single();\n tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n tx_q-\u003etx_skbuff_dma[N + 2].buf = NULL;\n\nOn the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the\nDMA engine, tx_q-\u003etx_skbuff_dma[N + 0].buf is a valid buffer address\nobviously, then the DMA buffer will be unmapped immediately.\nThere may be a rare case that the DMA engine does not finish the\npending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go\nhorribly wrong, DMA is going to access a unmapped/unreferenced memory\nregion, corrupted data will be transmited or iommu fault will be\ntriggered :(\n\nIn contrast, the for-loop that maps SKB fragments behaves perfectly\nas expected, and that is how the driver should do for both non-paged\ndata and paged frags actually.\n\nThis patch corrects DMA map/unmap sequences by fixing the array index\nfor tx_q-\u003etx_skbuff_dma[entry].buf when assigning DMA buffer address.\n\nTested and verified on DWXGMAC CORE 3.20a"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:10.578Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ece593fc9c00741b682869d3f3dc584d37b7c9df"
},
{
"url": "https://git.kernel.org/stable/c/a3ff23f7c3f0e13f718900803e090fd3997d6bc9"
},
{
"url": "https://git.kernel.org/stable/c/07c9c26e37542486e34d767505e842f48f29c3f6"
},
{
"url": "https://git.kernel.org/stable/c/58d23d835eb498336716cca55b5714191a309286"
},
{
"url": "https://git.kernel.org/stable/c/66600fac7a984dea4ae095411f644770b2561ede"
}
],
"title": "net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53058",
"datePublished": "2024-11-19T17:19:40.912Z",
"dateReserved": "2024-11-19T17:17:24.974Z",
"dateUpdated": "2024-12-19T09:38:10.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53059
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
1. The size of the response packet is not validated.
2. The response buffer is not freed.
Resolve these issues by switching to iwl_mvm_send_cmd_status(),
which handles both size validation and frees the buffer.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: f130bb75d8817c560b48c4d1a0e5279968a0859d Version: f130bb75d8817c560b48c4d1a0e5279968a0859d Version: f130bb75d8817c560b48c4d1a0e5279968a0859d Version: f130bb75d8817c560b48c4d1a0e5279968a0859d Version: f130bb75d8817c560b48c4d1a0e5279968a0859d Version: f130bb75d8817c560b48c4d1a0e5279968a0859d Version: f130bb75d8817c560b48c4d1a0e5279968a0859d |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c98ee7ea463a838235e7a0e35851b38476364f2",
"status": "affected",
"version": "f130bb75d8817c560b48c4d1a0e5279968a0859d",
"versionType": "git"
},
{
"lessThan": "45a628911d3c68e024eed337054a0452b064f450",
"status": "affected",
"version": "f130bb75d8817c560b48c4d1a0e5279968a0859d",
"versionType": "git"
},
{
"lessThan": "3f45d590ccbae6dfd6faef54efe74c30bd85d3da",
"status": "affected",
"version": "f130bb75d8817c560b48c4d1a0e5279968a0859d",
"versionType": "git"
},
{
"lessThan": "64d63557ded6ff3ce72b18ab87a6c4b1b652161c",
"status": "affected",
"version": "f130bb75d8817c560b48c4d1a0e5279968a0859d",
"versionType": "git"
},
{
"lessThan": "3eb986c64c6bfb721950f9666a3b723cf65d043f",
"status": "affected",
"version": "f130bb75d8817c560b48c4d1a0e5279968a0859d",
"versionType": "git"
},
{
"lessThan": "9480c3045f302f43f9910d2d556d6cf5a62c1822",
"status": "affected",
"version": "f130bb75d8817c560b48c4d1a0e5279968a0859d",
"versionType": "git"
},
{
"lessThan": "07a6e3b78a65f4b2796a8d0d4adb1a15a81edead",
"status": "affected",
"version": "f130bb75d8817c560b48c4d1a0e5279968a0859d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.285",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.171",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()\n\n1. The size of the response packet is not validated.\n2. The response buffer is not freed.\n\nResolve these issues by switching to iwl_mvm_send_cmd_status(),\nwhich handles both size validation and frees the buffer."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:11.947Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c98ee7ea463a838235e7a0e35851b38476364f2"
},
{
"url": "https://git.kernel.org/stable/c/45a628911d3c68e024eed337054a0452b064f450"
},
{
"url": "https://git.kernel.org/stable/c/3f45d590ccbae6dfd6faef54efe74c30bd85d3da"
},
{
"url": "https://git.kernel.org/stable/c/64d63557ded6ff3ce72b18ab87a6c4b1b652161c"
},
{
"url": "https://git.kernel.org/stable/c/3eb986c64c6bfb721950f9666a3b723cf65d043f"
},
{
"url": "https://git.kernel.org/stable/c/9480c3045f302f43f9910d2d556d6cf5a62c1822"
},
{
"url": "https://git.kernel.org/stable/c/07a6e3b78a65f4b2796a8d0d4adb1a15a81edead"
}
],
"title": "wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53059",
"datePublished": "2024-11-19T17:19:41.546Z",
"dateReserved": "2024-11-19T17:17:24.974Z",
"dateUpdated": "2024-12-19T09:38:11.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53088
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i40e: fix race condition by adding filter's intermediate sync state
Fix a race condition in the i40e driver that leads to MAC/VLAN filters
becoming corrupted and leaking. Address the issue that occurs under
heavy load when multiple threads are concurrently modifying MAC/VLAN
filters by setting mac and port VLAN.
1. Thread T0 allocates a filter in i40e_add_filter() within
i40e_ndo_set_vf_port_vlan().
2. Thread T1 concurrently frees the filter in __i40e_del_filter() within
i40e_ndo_set_vf_mac().
3. Subsequently, i40e_service_task() calls i40e_sync_vsi_filters(), which
refers to the already freed filter memory, causing corruption.
Reproduction steps:
1. Spawn multiple VFs.
2. Apply a concurrent heavy load by running parallel operations to change
MAC addresses on the VFs and change port VLANs on the host.
3. Observe errors in dmesg:
"Error I40E_AQ_RC_ENOSPC adding RX filters on VF XX,
please set promiscuous on manually for VF XX".
Exact code for stable reproduction Intel can't open-source now.
The fix involves implementing a new intermediate filter state,
I40E_FILTER_NEW_SYNC, for the time when a filter is on a tmp_add_list.
These filters cannot be deleted from the hash list directly but
must be removed using the full process.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 278e7d0b9d6864a9749b9473a273892aa1528621 Version: 278e7d0b9d6864a9749b9473a273892aa1528621 Version: 278e7d0b9d6864a9749b9473a273892aa1528621 Version: 278e7d0b9d6864a9749b9473a273892aa1528621 Version: 278e7d0b9d6864a9749b9473a273892aa1528621 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/i40e/i40e.h",
"drivers/net/ethernet/intel/i40e/i40e_debugfs.c",
"drivers/net/ethernet/intel/i40e/i40e_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "262dc6ea5f1eb18c4d08ad83d51222d0dd0dd42a",
"status": "affected",
"version": "278e7d0b9d6864a9749b9473a273892aa1528621",
"versionType": "git"
},
{
"lessThan": "7ad3fb3bfd43feb4e15c81dffd23ac4e55742791",
"status": "affected",
"version": "278e7d0b9d6864a9749b9473a273892aa1528621",
"versionType": "git"
},
{
"lessThan": "bf5f837d9fd27d32fb76df0a108babcaf4446ff1",
"status": "affected",
"version": "278e7d0b9d6864a9749b9473a273892aa1528621",
"versionType": "git"
},
{
"lessThan": "6e046f4937474bc1b9fa980c1ad8f3253fc638f6",
"status": "affected",
"version": "278e7d0b9d6864a9749b9473a273892aa1528621",
"versionType": "git"
},
{
"lessThan": "f30490e9695ef7da3d0899c6a0293cc7cd373567",
"status": "affected",
"version": "278e7d0b9d6864a9749b9473a273892aa1528621",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/i40e/i40e.h",
"drivers/net/ethernet/intel/i40e/i40e_debugfs.c",
"drivers/net/ethernet/intel/i40e/i40e_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.172",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix race condition by adding filter\u0027s intermediate sync state\n\nFix a race condition in the i40e driver that leads to MAC/VLAN filters\nbecoming corrupted and leaking. Address the issue that occurs under\nheavy load when multiple threads are concurrently modifying MAC/VLAN\nfilters by setting mac and port VLAN.\n\n1. Thread T0 allocates a filter in i40e_add_filter() within\n i40e_ndo_set_vf_port_vlan().\n2. Thread T1 concurrently frees the filter in __i40e_del_filter() within\n i40e_ndo_set_vf_mac().\n3. Subsequently, i40e_service_task() calls i40e_sync_vsi_filters(), which\n refers to the already freed filter memory, causing corruption.\n\nReproduction steps:\n1. Spawn multiple VFs.\n2. Apply a concurrent heavy load by running parallel operations to change\n MAC addresses on the VFs and change port VLANs on the host.\n3. Observe errors in dmesg:\n\"Error I40E_AQ_RC_ENOSPC adding RX filters on VF XX,\n\tplease set promiscuous on manually for VF XX\".\n\nExact code for stable reproduction Intel can\u0027t open-source now.\n\nThe fix involves implementing a new intermediate filter state,\nI40E_FILTER_NEW_SYNC, for the time when a filter is on a tmp_add_list.\nThese filters cannot be deleted from the hash list directly but\nmust be removed using the full process."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:53.466Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/262dc6ea5f1eb18c4d08ad83d51222d0dd0dd42a"
},
{
"url": "https://git.kernel.org/stable/c/7ad3fb3bfd43feb4e15c81dffd23ac4e55742791"
},
{
"url": "https://git.kernel.org/stable/c/bf5f837d9fd27d32fb76df0a108babcaf4446ff1"
},
{
"url": "https://git.kernel.org/stable/c/6e046f4937474bc1b9fa980c1ad8f3253fc638f6"
},
{
"url": "https://git.kernel.org/stable/c/f30490e9695ef7da3d0899c6a0293cc7cd373567"
}
],
"title": "i40e: fix race condition by adding filter\u0027s intermediate sync state",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53088",
"datePublished": "2024-11-19T17:45:16.169Z",
"dateReserved": "2024-11-19T17:17:24.980Z",
"dateUpdated": "2024-12-19T09:38:53.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53083
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier
If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and
txbuf_len are uninitialized. This commit stops to print uninitialized
value and misleading/false data.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "35925e2b7b404cad3db857434d3312b892b55432",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "74d8cee747b37cd9f5ca631f678e66e7f40f2b5f",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "029778a4fd2c90c2e76a902b797c2348a722f1b8",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier\n\nIf the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and\ntxbuf_len are uninitialized. This commit stops to print uninitialized\nvalue and misleading/false data."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:47.225Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/35925e2b7b404cad3db857434d3312b892b55432"
},
{
"url": "https://git.kernel.org/stable/c/74d8cee747b37cd9f5ca631f678e66e7f40f2b5f"
},
{
"url": "https://git.kernel.org/stable/c/029778a4fd2c90c2e76a902b797c2348a722f1b8"
}
],
"title": "usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53083",
"datePublished": "2024-11-19T17:45:12.884Z",
"dateReserved": "2024-11-19T17:17:24.979Z",
"dateUpdated": "2024-12-19T09:38:47.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53063
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: dvbdev: prevent the risk of out of memory access
The dvbdev contains a static variable used to store dvb minors.
The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set
or not. When not set, dvb_register_device() won't check for
boundaries, as it will rely that a previous call to
dvb_register_adapter() would already be enforcing it.
On a similar way, dvb_device_open() uses the assumption
that the register functions already did the needed checks.
This can be fragile if some device ends using different
calls. This also generate warnings on static check analysers
like Coverity.
So, add explicit guards to prevent potential risk of OOM issues.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 5dd3f3071070f5a306bdf8d474c80062f5691cba Version: 5dd3f3071070f5a306bdf8d474c80062f5691cba Version: 5dd3f3071070f5a306bdf8d474c80062f5691cba Version: 5dd3f3071070f5a306bdf8d474c80062f5691cba Version: 5dd3f3071070f5a306bdf8d474c80062f5691cba Version: 5dd3f3071070f5a306bdf8d474c80062f5691cba Version: 5dd3f3071070f5a306bdf8d474c80062f5691cba Version: 5dd3f3071070f5a306bdf8d474c80062f5691cba |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/dvb-core/dvbdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fedfde9deb83ac8d2f3d5f36f111023df34b1684",
"status": "affected",
"version": "5dd3f3071070f5a306bdf8d474c80062f5691cba",
"versionType": "git"
},
{
"lessThan": "3b88675e18b6517043a6f734eaa8ea6eb3bfa140",
"status": "affected",
"version": "5dd3f3071070f5a306bdf8d474c80062f5691cba",
"versionType": "git"
},
{
"lessThan": "a4a17210c03ade1c8d9a9f193a105654b7a05c11",
"status": "affected",
"version": "5dd3f3071070f5a306bdf8d474c80062f5691cba",
"versionType": "git"
},
{
"lessThan": "5f76f7df14861e3a560898fa41979ec92424b58f",
"status": "affected",
"version": "5dd3f3071070f5a306bdf8d474c80062f5691cba",
"versionType": "git"
},
{
"lessThan": "b751a96025275c17f04083cbfe856822f1658946",
"status": "affected",
"version": "5dd3f3071070f5a306bdf8d474c80062f5691cba",
"versionType": "git"
},
{
"lessThan": "1e461672616b726f29261ee81bb991528818537c",
"status": "affected",
"version": "5dd3f3071070f5a306bdf8d474c80062f5691cba",
"versionType": "git"
},
{
"lessThan": "9c17085fabbde2041c893d29599800f2d4992b23",
"status": "affected",
"version": "5dd3f3071070f5a306bdf8d474c80062f5691cba",
"versionType": "git"
},
{
"lessThan": "972e63e895abbe8aa1ccbdbb4e6362abda7cd457",
"status": "affected",
"version": "5dd3f3071070f5a306bdf8d474c80062f5691cba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/dvb-core/dvbdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.324",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.286",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.230",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.172",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvbdev: prevent the risk of out of memory access\n\nThe dvbdev contains a static variable used to store dvb minors.\n\nThe behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set\nor not. When not set, dvb_register_device() won\u0027t check for\nboundaries, as it will rely that a previous call to\ndvb_register_adapter() would already be enforcing it.\n\nOn a similar way, dvb_device_open() uses the assumption\nthat the register functions already did the needed checks.\n\nThis can be fragile if some device ends using different\ncalls. This also generate warnings on static check analysers\nlike Coverity.\n\nSo, add explicit guards to prevent potential risk of OOM issues."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:16.856Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fedfde9deb83ac8d2f3d5f36f111023df34b1684"
},
{
"url": "https://git.kernel.org/stable/c/3b88675e18b6517043a6f734eaa8ea6eb3bfa140"
},
{
"url": "https://git.kernel.org/stable/c/a4a17210c03ade1c8d9a9f193a105654b7a05c11"
},
{
"url": "https://git.kernel.org/stable/c/5f76f7df14861e3a560898fa41979ec92424b58f"
},
{
"url": "https://git.kernel.org/stable/c/b751a96025275c17f04083cbfe856822f1658946"
},
{
"url": "https://git.kernel.org/stable/c/1e461672616b726f29261ee81bb991528818537c"
},
{
"url": "https://git.kernel.org/stable/c/9c17085fabbde2041c893d29599800f2d4992b23"
},
{
"url": "https://git.kernel.org/stable/c/972e63e895abbe8aa1ccbdbb4e6362abda7cd457"
}
],
"title": "media: dvbdev: prevent the risk of out of memory access",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53063",
"datePublished": "2024-11-19T17:22:33.518Z",
"dateReserved": "2024-11-19T17:17:24.975Z",
"dateUpdated": "2024-12-19T09:38:16.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53050
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/hdcp: Add encoder check in hdcp2_get_capability
Add encoder check in intel_hdcp2_get_capability to avoid
null pointer error.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_dp_hdcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b89dcf23575eb5bb95ce8d672cbc2232c2eb096",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d34f4f058edf1235c103ca9c921dc54820d14d40",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_dp_hdcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: Add encoder check in hdcp2_get_capability\n\nAdd encoder check in intel_hdcp2_get_capability to avoid\nnull pointer error."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:01.582Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b89dcf23575eb5bb95ce8d672cbc2232c2eb096"
},
{
"url": "https://git.kernel.org/stable/c/d34f4f058edf1235c103ca9c921dc54820d14d40"
}
],
"title": "drm/i915/hdcp: Add encoder check in hdcp2_get_capability",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53050",
"datePublished": "2024-11-19T17:19:35.857Z",
"dateReserved": "2024-11-19T17:17:24.973Z",
"dateUpdated": "2024-12-19T09:38:01.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-50303
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:37
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
resource,kexec: walk_system_ram_res_rev must retain resource flags
walk_system_ram_res_rev() erroneously discards resource flags when passing
the information to the callback.
This causes systems with IORESOURCE_SYSRAM_DRIVER_MANAGED memory to have
these resources selected during kexec to store kexec buffers if that
memory happens to be at placed above normal system ram.
This leads to undefined behavior after reboot. If the kexec buffer is
never touched, nothing happens. If the kexec buffer is touched, it could
lead to a crash (like below) or undefined behavior.
Tested on a system with CXL memory expanders with driver managed memory,
TPM enabled, and CONFIG_IMA_KEXEC=y. Adding printk's showed the flags
were being discarded and as a result the check for
IORESOURCE_SYSRAM_DRIVER_MANAGED passes.
find_next_iomem_res: name(System RAM (kmem))
start(10000000000)
end(1034fffffff)
flags(83000200)
locate_mem_hole_top_down: start(10000000000) end(1034fffffff) flags(0)
[.] BUG: unable to handle page fault for address: ffff89834ffff000
[.] #PF: supervisor read access in kernel mode
[.] #PF: error_code(0x0000) - not-present page
[.] PGD c04c8bf067 P4D c04c8bf067 PUD c04c8be067 PMD 0
[.] Oops: 0000 [#1] SMP
[.] RIP: 0010:ima_restore_measurement_list+0x95/0x4b0
[.] RSP: 0018:ffffc900000d3a80 EFLAGS: 00010286
[.] RAX: 0000000000001000 RBX: 0000000000000000 RCX: ffff89834ffff000
[.] RDX: 0000000000000018 RSI: ffff89834ffff000 RDI: ffff89834ffff018
[.] RBP: ffffc900000d3ba0 R08: 0000000000000020 R09: ffff888132b8a900
[.] R10: 4000000000000000 R11: 000000003a616d69 R12: 0000000000000000
[.] R13: ffffffff8404ac28 R14: 0000000000000000 R15: ffff89834ffff000
[.] FS: 0000000000000000(0000) GS:ffff893d44640000(0000) knlGS:0000000000000000
[.] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[.] ata5: SATA link down (SStatus 0 SControl 300)
[.] CR2: ffff89834ffff000 CR3: 000001034d00f001 CR4: 0000000000770ef0
[.] PKRU: 55555554
[.] Call Trace:
[.] <TASK>
[.] ? __die+0x78/0xc0
[.] ? page_fault_oops+0x2a8/0x3a0
[.] ? exc_page_fault+0x84/0x130
[.] ? asm_exc_page_fault+0x22/0x30
[.] ? ima_restore_measurement_list+0x95/0x4b0
[.] ? template_desc_init_fields+0x317/0x410
[.] ? crypto_alloc_tfm_node+0x9c/0xc0
[.] ? init_ima_lsm+0x30/0x30
[.] ima_load_kexec_buffer+0x72/0xa0
[.] ima_init+0x44/0xa0
[.] __initstub__kmod_ima__373_1201_init_ima7+0x1e/0xb0
[.] ? init_ima_lsm+0x30/0x30
[.] do_one_initcall+0xad/0x200
[.] ? idr_alloc_cyclic+0xaa/0x110
[.] ? new_slab+0x12c/0x420
[.] ? new_slab+0x12c/0x420
[.] ? number+0x12a/0x430
[.] ? sysvec_apic_timer_interrupt+0xa/0x80
[.] ? asm_sysvec_apic_timer_interrupt+0x16/0x20
[.] ? parse_args+0xd4/0x380
[.] ? parse_args+0x14b/0x380
[.] kernel_init_freeable+0x1c1/0x2b0
[.] ? rest_init+0xb0/0xb0
[.] kernel_init+0x16/0x1a0
[.] ret_from_fork+0x2f/0x40
[.] ? rest_init+0xb0/0xb0
[.] ret_from_fork_asm+0x11/0x20
[.] </TASK>
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dc9031b7919bd346514ea9a720f433b8daf3970d",
"status": "affected",
"version": "7acf164b259d9007264d9d8501da1023f140a3b4",
"versionType": "git"
},
{
"lessThan": "b125a0def25a082ae944c9615208bf359abdb61c",
"status": "affected",
"version": "7acf164b259d9007264d9d8501da1023f140a3b4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nresource,kexec: walk_system_ram_res_rev must retain resource flags\n\nwalk_system_ram_res_rev() erroneously discards resource flags when passing\nthe information to the callback.\n\nThis causes systems with IORESOURCE_SYSRAM_DRIVER_MANAGED memory to have\nthese resources selected during kexec to store kexec buffers if that\nmemory happens to be at placed above normal system ram.\n\nThis leads to undefined behavior after reboot. If the kexec buffer is\nnever touched, nothing happens. If the kexec buffer is touched, it could\nlead to a crash (like below) or undefined behavior.\n\nTested on a system with CXL memory expanders with driver managed memory,\nTPM enabled, and CONFIG_IMA_KEXEC=y. Adding printk\u0027s showed the flags\nwere being discarded and as a result the check for\nIORESOURCE_SYSRAM_DRIVER_MANAGED passes.\n\nfind_next_iomem_res: name(System RAM (kmem))\n\t\t start(10000000000)\n\t\t end(1034fffffff)\n\t\t flags(83000200)\n\nlocate_mem_hole_top_down: start(10000000000) end(1034fffffff) flags(0)\n\n[.] BUG: unable to handle page fault for address: ffff89834ffff000\n[.] #PF: supervisor read access in kernel mode\n[.] #PF: error_code(0x0000) - not-present page\n[.] PGD c04c8bf067 P4D c04c8bf067 PUD c04c8be067 PMD 0\n[.] Oops: 0000 [#1] SMP\n[.] RIP: 0010:ima_restore_measurement_list+0x95/0x4b0\n[.] RSP: 0018:ffffc900000d3a80 EFLAGS: 00010286\n[.] RAX: 0000000000001000 RBX: 0000000000000000 RCX: ffff89834ffff000\n[.] RDX: 0000000000000018 RSI: ffff89834ffff000 RDI: ffff89834ffff018\n[.] RBP: ffffc900000d3ba0 R08: 0000000000000020 R09: ffff888132b8a900\n[.] R10: 4000000000000000 R11: 000000003a616d69 R12: 0000000000000000\n[.] R13: ffffffff8404ac28 R14: 0000000000000000 R15: ffff89834ffff000\n[.] FS: 0000000000000000(0000) GS:ffff893d44640000(0000) knlGS:0000000000000000\n[.] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[.] ata5: SATA link down (SStatus 0 SControl 300)\n[.] CR2: ffff89834ffff000 CR3: 000001034d00f001 CR4: 0000000000770ef0\n[.] PKRU: 55555554\n[.] Call Trace:\n[.] \u003cTASK\u003e\n[.] ? __die+0x78/0xc0\n[.] ? page_fault_oops+0x2a8/0x3a0\n[.] ? exc_page_fault+0x84/0x130\n[.] ? asm_exc_page_fault+0x22/0x30\n[.] ? ima_restore_measurement_list+0x95/0x4b0\n[.] ? template_desc_init_fields+0x317/0x410\n[.] ? crypto_alloc_tfm_node+0x9c/0xc0\n[.] ? init_ima_lsm+0x30/0x30\n[.] ima_load_kexec_buffer+0x72/0xa0\n[.] ima_init+0x44/0xa0\n[.] __initstub__kmod_ima__373_1201_init_ima7+0x1e/0xb0\n[.] ? init_ima_lsm+0x30/0x30\n[.] do_one_initcall+0xad/0x200\n[.] ? idr_alloc_cyclic+0xaa/0x110\n[.] ? new_slab+0x12c/0x420\n[.] ? new_slab+0x12c/0x420\n[.] ? number+0x12a/0x430\n[.] ? sysvec_apic_timer_interrupt+0xa/0x80\n[.] ? asm_sysvec_apic_timer_interrupt+0x16/0x20\n[.] ? parse_args+0xd4/0x380\n[.] ? parse_args+0x14b/0x380\n[.] kernel_init_freeable+0x1c1/0x2b0\n[.] ? rest_init+0xb0/0xb0\n[.] kernel_init+0x16/0x1a0\n[.] ret_from_fork+0x2f/0x40\n[.] ? rest_init+0xb0/0xb0\n[.] ret_from_fork_asm+0x11/0x20\n[.] \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:37:48.281Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dc9031b7919bd346514ea9a720f433b8daf3970d"
},
{
"url": "https://git.kernel.org/stable/c/b125a0def25a082ae944c9615208bf359abdb61c"
}
],
"title": "resource,kexec: walk_system_ram_res_rev must retain resource flags",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-50303",
"datePublished": "2024-11-19T17:19:29.585Z",
"dateReserved": "2024-10-21T19:36:19.987Z",
"dateUpdated": "2024-12-19T09:37:48.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53067
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Start the RTC update work later
The RTC update work involves runtime resuming the UFS controller. Hence,
only start the RTC update work after runtime power management in the UFS
driver has been fully initialized. This patch fixes the following kernel
crash:
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Workqueue: events ufshcd_rtc_work
Call trace:
_raw_spin_lock_irqsave+0x34/0x8c (P)
pm_runtime_get_if_active+0x24/0x9c (L)
pm_runtime_get_if_active+0x24/0x9c
ufshcd_rtc_work+0x138/0x1b4
process_one_work+0x148/0x288
worker_thread+0x2cc/0x3d4
kthread+0x110/0x114
ret_from_fork+0x10/0x20
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c25f784fba81227e0437337f962d34380d1c250",
"status": "affected",
"version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
"versionType": "git"
},
{
"lessThan": "54c814c8b23bc7617be3d46abdb896937695dbfa",
"status": "affected",
"version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Start the RTC update work later\n\nThe RTC update work involves runtime resuming the UFS controller. Hence,\nonly start the RTC update work after runtime power management in the UFS\ndriver has been fully initialized. This patch fixes the following kernel\ncrash:\n\nInternal error: Oops: 0000000096000006 [#1] PREEMPT SMP\nWorkqueue: events ufshcd_rtc_work\nCall trace:\n _raw_spin_lock_irqsave+0x34/0x8c (P)\n pm_runtime_get_if_active+0x24/0x9c (L)\n pm_runtime_get_if_active+0x24/0x9c\n ufshcd_rtc_work+0x138/0x1b4\n process_one_work+0x148/0x288\n worker_thread+0x2cc/0x3d4\n kthread+0x110/0x114\n ret_from_fork+0x10/0x20"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:21.872Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c25f784fba81227e0437337f962d34380d1c250"
},
{
"url": "https://git.kernel.org/stable/c/54c814c8b23bc7617be3d46abdb896937695dbfa"
}
],
"title": "scsi: ufs: core: Start the RTC update work later",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53067",
"datePublished": "2024-11-19T17:22:36.030Z",
"dateReserved": "2024-11-19T17:17:24.975Z",
"dateUpdated": "2024-12-19T09:38:21.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53068
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()
The scmi_dev->name is released prematurely in __scmi_device_destroy(),
which causes slab-use-after-free when accessing scmi_dev->name in
scmi_bus_notifier(). So move the release of scmi_dev->name to
scmi_device_release() to avoid slab-use-after-free.
| BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec
| Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1
|
| CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1
| Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)
| Call trace:
| dump_backtrace+0x94/0x114
| show_stack+0x18/0x24
| dump_stack_lvl+0x48/0x60
| print_report+0xf4/0x5b0
| kasan_report+0xa4/0xec
| __asan_report_load1_noabort+0x20/0x2c
| strncmp+0xe4/0xec
| scmi_bus_notifier+0x5c/0x54c
| notifier_call_chain+0xb4/0x31c
| blocking_notifier_call_chain+0x68/0x9c
| bus_notify+0x54/0x78
| device_del+0x1bc/0x840
| device_unregister+0x20/0xb4
| __scmi_device_destroy+0xac/0x280
| scmi_device_destroy+0x94/0xd0
| scmi_chan_setup+0x524/0x750
| scmi_probe+0x7fc/0x1508
| platform_probe+0xc4/0x19c
| really_probe+0x32c/0x99c
| __driver_probe_device+0x15c/0x3c4
| driver_probe_device+0x5c/0x170
| __driver_attach+0x1c8/0x440
| bus_for_each_dev+0xf4/0x178
| driver_attach+0x3c/0x58
| bus_add_driver+0x234/0x4d4
| driver_register+0xf4/0x3c0
| __platform_driver_register+0x60/0x88
| scmi_driver_init+0xb0/0x104
| do_one_initcall+0xb4/0x664
| kernel_init_freeable+0x3c8/0x894
| kernel_init+0x24/0x1e8
| ret_from_fork+0x10/0x20
|
| Allocated by task 1:
| kasan_save_stack+0x2c/0x54
| kasan_set_track+0x2c/0x40
| kasan_save_alloc_info+0x24/0x34
| __kasan_kmalloc+0xa0/0xb8
| __kmalloc_node_track_caller+0x6c/0x104
| kstrdup+0x48/0x84
| kstrdup_const+0x34/0x40
| __scmi_device_create.part.0+0x8c/0x408
| scmi_device_create+0x104/0x370
| scmi_chan_setup+0x2a0/0x750
| scmi_probe+0x7fc/0x1508
| platform_probe+0xc4/0x19c
| really_probe+0x32c/0x99c
| __driver_probe_device+0x15c/0x3c4
| driver_probe_device+0x5c/0x170
| __driver_attach+0x1c8/0x440
| bus_for_each_dev+0xf4/0x178
| driver_attach+0x3c/0x58
| bus_add_driver+0x234/0x4d4
| driver_register+0xf4/0x3c0
| __platform_driver_register+0x60/0x88
| scmi_driver_init+0xb0/0x104
| do_one_initcall+0xb4/0x664
| kernel_init_freeable+0x3c8/0x894
| kernel_init+0x24/0x1e8
| ret_from_fork+0x10/0x20
|
| Freed by task 1:
| kasan_save_stack+0x2c/0x54
| kasan_set_track+0x2c/0x40
| kasan_save_free_info+0x38/0x5c
| __kasan_slab_free+0xe8/0x164
| __kmem_cache_free+0x11c/0x230
| kfree+0x70/0x130
| kfree_const+0x20/0x40
| __scmi_device_destroy+0x70/0x280
| scmi_device_destroy+0x94/0xd0
| scmi_chan_setup+0x524/0x750
| scmi_probe+0x7fc/0x1508
| platform_probe+0xc4/0x19c
| really_probe+0x32c/0x99c
| __driver_probe_device+0x15c/0x3c4
| driver_probe_device+0x5c/0x170
| __driver_attach+0x1c8/0x440
| bus_for_each_dev+0xf4/0x178
| driver_attach+0x3c/0x58
| bus_add_driver+0x234/0x4d4
| driver_register+0xf4/0x3c0
| __platform_driver_register+0x60/0x88
| scmi_driver_init+0xb0/0x104
| do_one_initcall+0xb4/0x664
| kernel_init_freeable+0x3c8/0x894
| kernel_init+0x24/0x1e8
| ret_from_fork+0x10/0x20
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scmi/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15b17bbcea07d49c43d21aa700485cbd9f9d00d8",
"status": "affected",
"version": "ee7a9c9f67c59008b330deff2762bd8cf1407eec",
"versionType": "git"
},
{
"lessThan": "1e1f523b185a8ccdcba625b31ff0312d052900e2",
"status": "affected",
"version": "ee7a9c9f67c59008b330deff2762bd8cf1407eec",
"versionType": "git"
},
{
"lessThan": "295416091e44806760ccf753aeafdafc0ae268f3",
"status": "affected",
"version": "ee7a9c9f67c59008b330deff2762bd8cf1407eec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scmi/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()\n\nThe scmi_dev-\u003ename is released prematurely in __scmi_device_destroy(),\nwhich causes slab-use-after-free when accessing scmi_dev-\u003ename in\nscmi_bus_notifier(). So move the release of scmi_dev-\u003ename to\nscmi_device_release() to avoid slab-use-after-free.\n\n | BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec\n | Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1\n |\n | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1\n | Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)\n | Call trace:\n | dump_backtrace+0x94/0x114\n | show_stack+0x18/0x24\n | dump_stack_lvl+0x48/0x60\n | print_report+0xf4/0x5b0\n | kasan_report+0xa4/0xec\n | __asan_report_load1_noabort+0x20/0x2c\n | strncmp+0xe4/0xec\n | scmi_bus_notifier+0x5c/0x54c\n | notifier_call_chain+0xb4/0x31c\n | blocking_notifier_call_chain+0x68/0x9c\n | bus_notify+0x54/0x78\n | device_del+0x1bc/0x840\n | device_unregister+0x20/0xb4\n | __scmi_device_destroy+0xac/0x280\n | scmi_device_destroy+0x94/0xd0\n | scmi_chan_setup+0x524/0x750\n | scmi_probe+0x7fc/0x1508\n | platform_probe+0xc4/0x19c\n | really_probe+0x32c/0x99c\n | __driver_probe_device+0x15c/0x3c4\n | driver_probe_device+0x5c/0x170\n | __driver_attach+0x1c8/0x440\n | bus_for_each_dev+0xf4/0x178\n | driver_attach+0x3c/0x58\n | bus_add_driver+0x234/0x4d4\n | driver_register+0xf4/0x3c0\n | __platform_driver_register+0x60/0x88\n | scmi_driver_init+0xb0/0x104\n | do_one_initcall+0xb4/0x664\n | kernel_init_freeable+0x3c8/0x894\n | kernel_init+0x24/0x1e8\n | ret_from_fork+0x10/0x20\n |\n | Allocated by task 1:\n | kasan_save_stack+0x2c/0x54\n | kasan_set_track+0x2c/0x40\n | kasan_save_alloc_info+0x24/0x34\n | __kasan_kmalloc+0xa0/0xb8\n | __kmalloc_node_track_caller+0x6c/0x104\n | kstrdup+0x48/0x84\n | kstrdup_const+0x34/0x40\n | __scmi_device_create.part.0+0x8c/0x408\n | scmi_device_create+0x104/0x370\n | scmi_chan_setup+0x2a0/0x750\n | scmi_probe+0x7fc/0x1508\n | platform_probe+0xc4/0x19c\n | really_probe+0x32c/0x99c\n | __driver_probe_device+0x15c/0x3c4\n | driver_probe_device+0x5c/0x170\n | __driver_attach+0x1c8/0x440\n | bus_for_each_dev+0xf4/0x178\n | driver_attach+0x3c/0x58\n | bus_add_driver+0x234/0x4d4\n | driver_register+0xf4/0x3c0\n | __platform_driver_register+0x60/0x88\n | scmi_driver_init+0xb0/0x104\n | do_one_initcall+0xb4/0x664\n | kernel_init_freeable+0x3c8/0x894\n | kernel_init+0x24/0x1e8\n | ret_from_fork+0x10/0x20\n |\n | Freed by task 1:\n | kasan_save_stack+0x2c/0x54\n | kasan_set_track+0x2c/0x40\n | kasan_save_free_info+0x38/0x5c\n | __kasan_slab_free+0xe8/0x164\n | __kmem_cache_free+0x11c/0x230\n | kfree+0x70/0x130\n | kfree_const+0x20/0x40\n | __scmi_device_destroy+0x70/0x280\n | scmi_device_destroy+0x94/0xd0\n | scmi_chan_setup+0x524/0x750\n | scmi_probe+0x7fc/0x1508\n | platform_probe+0xc4/0x19c\n | really_probe+0x32c/0x99c\n | __driver_probe_device+0x15c/0x3c4\n | driver_probe_device+0x5c/0x170\n | __driver_attach+0x1c8/0x440\n | bus_for_each_dev+0xf4/0x178\n | driver_attach+0x3c/0x58\n | bus_add_driver+0x234/0x4d4\n | driver_register+0xf4/0x3c0\n | __platform_driver_register+0x60/0x88\n | scmi_driver_init+0xb0/0x104\n | do_one_initcall+0xb4/0x664\n | kernel_init_freeable+0x3c8/0x894\n | kernel_init+0x24/0x1e8\n | ret_from_fork+0x10/0x20"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:23.299Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15b17bbcea07d49c43d21aa700485cbd9f9d00d8"
},
{
"url": "https://git.kernel.org/stable/c/1e1f523b185a8ccdcba625b31ff0312d052900e2"
},
{
"url": "https://git.kernel.org/stable/c/295416091e44806760ccf753aeafdafc0ae268f3"
}
],
"title": "firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53068",
"datePublished": "2024-11-19T17:22:36.650Z",
"dateReserved": "2024-11-19T17:17:24.975Z",
"dateUpdated": "2024-12-19T09:38:23.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53062
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: mgb4: protect driver against spectre
Frequency range is set from sysfs via frequency_range_store(),
being vulnerable to spectre, as reported by smatch:
drivers/media/pci/mgb4/mgb4_cmt.c:231 mgb4_cmt_set_vin_freq_range() warn: potential spectre issue 'cmt_vals_in' [r]
drivers/media/pci/mgb4/mgb4_cmt.c:238 mgb4_cmt_set_vin_freq_range() warn: possible spectre second half. 'reg_set'
Fix it.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/mgb4/mgb4_cmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0bc90742bbd6eb9c63e6c22f8f6e10be7b1e225",
"status": "affected",
"version": "0ab13674a9bd10514486cf1670d71dbd8afec421",
"versionType": "git"
},
{
"lessThan": "2aee207e5b3c94ef859316008119ea06d6798d49",
"status": "affected",
"version": "0ab13674a9bd10514486cf1670d71dbd8afec421",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/mgb4/mgb4_cmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mgb4: protect driver against spectre\n\nFrequency range is set from sysfs via frequency_range_store(),\nbeing vulnerable to spectre, as reported by smatch:\n\n\tdrivers/media/pci/mgb4/mgb4_cmt.c:231 mgb4_cmt_set_vin_freq_range() warn: potential spectre issue \u0027cmt_vals_in\u0027 [r]\n\tdrivers/media/pci/mgb4/mgb4_cmt.c:238 mgb4_cmt_set_vin_freq_range() warn: possible spectre second half. \u0027reg_set\u0027\n\nFix it."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:15.654Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0bc90742bbd6eb9c63e6c22f8f6e10be7b1e225"
},
{
"url": "https://git.kernel.org/stable/c/2aee207e5b3c94ef859316008119ea06d6798d49"
}
],
"title": "media: mgb4: protect driver against spectre",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53062",
"datePublished": "2024-11-19T17:22:32.818Z",
"dateReserved": "2024-11-19T17:17:24.975Z",
"dateUpdated": "2024-12-19T09:38:15.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53080
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Lock XArray when getting entries for the VM
Similar to commit cac075706f29 ("drm/panthor: Fix race when converting
group handle to group object") we need to use the XArray's internal
locking when retrieving a vm pointer from there.
v2: Removed part of the patch that was trying to protect fetching
the heap pointer from XArray, as that operation is protected by
the @pool->lock.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3342f066a8e1020a6f7d1fbd6b23bfdeda473eb5",
"status": "affected",
"version": "647810ec247641eb5aec8caef818919a4518a0b1",
"versionType": "git"
},
{
"lessThan": "444fa5b100e5c90550d6bccfe4476efb0391b3ca",
"status": "affected",
"version": "647810ec247641eb5aec8caef818919a4518a0b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Lock XArray when getting entries for the VM\n\nSimilar to commit cac075706f29 (\"drm/panthor: Fix race when converting\ngroup handle to group object\") we need to use the XArray\u0027s internal\nlocking when retrieving a vm pointer from there.\n\nv2: Removed part of the patch that was trying to protect fetching\nthe heap pointer from XArray, as that operation is protected by\nthe @pool-\u003elock."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:43.315Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3342f066a8e1020a6f7d1fbd6b23bfdeda473eb5"
},
{
"url": "https://git.kernel.org/stable/c/444fa5b100e5c90550d6bccfe4476efb0391b3ca"
},
{
"url": "https://project-zero.issues.chromium.org/issues/377500597"
}
],
"title": "drm/panthor: Lock XArray when getting entries for the VM",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53080",
"datePublished": "2024-11-19T17:45:10.820Z",
"dateReserved": "2024-11-19T17:17:24.977Z",
"dateUpdated": "2024-12-19T09:38:43.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53075
Vulnerability from cvelistv5
Published
2024-11-19 17:31
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv: Prevent a bad reference count on CPU nodes
When populating cache leaves we previously fetched the CPU device node
at the very beginning. But when ACPI is enabled we go through a
specific branch which returns early and does not call 'of_node_put' for
the node that was acquired.
Since we are not using a CPU device node for the ACPI code anyways, we
can simply move the initialization of it just passed the ACPI block, and
we are guaranteed to have an 'of_node_put' call for the acquired node.
This prevents a bad reference count of the CPU device node.
Moreover, the previous function did not check for errors when acquiring
the device node, so a return -ENOENT has been added for that case.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/cacheinfo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "303846a3dc275e35fbb556d72f1e356ba669e4f8",
"status": "affected",
"version": "604f32ea6909b0ebb8ab0bf1ab7dc66ee3dc8955",
"versionType": "git"
},
{
"lessThan": "37233169a6ea912020c572f870075a63293b786a",
"status": "affected",
"version": "604f32ea6909b0ebb8ab0bf1ab7dc66ee3dc8955",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/cacheinfo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Prevent a bad reference count on CPU nodes\n\nWhen populating cache leaves we previously fetched the CPU device node\nat the very beginning. But when ACPI is enabled we go through a\nspecific branch which returns early and does not call \u0027of_node_put\u0027 for\nthe node that was acquired.\n\nSince we are not using a CPU device node for the ACPI code anyways, we\ncan simply move the initialization of it just passed the ACPI block, and\nwe are guaranteed to have an \u0027of_node_put\u0027 call for the acquired node.\nThis prevents a bad reference count of the CPU device node.\n\nMoreover, the previous function did not check for errors when acquiring\nthe device node, so a return -ENOENT has been added for that case."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:31.923Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/303846a3dc275e35fbb556d72f1e356ba669e4f8"
},
{
"url": "https://git.kernel.org/stable/c/37233169a6ea912020c572f870075a63293b786a"
}
],
"title": "riscv: Prevent a bad reference count on CPU nodes",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53075",
"datePublished": "2024-11-19T17:31:39.625Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:31.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53078
Vulnerability from cvelistv5
Published
2024-11-19 17:31
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/tegra: Fix NULL vs IS_ERR() check in probe()
The iommu_paging_domain_alloc() function doesn't return NULL pointers,
it returns error pointers. Update the check to match.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/tegra/drm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d6c005855b97b8caf6039c1774745ee74c91fa6",
"status": "affected",
"version": "45c690aea8ee5b7d012cd593bd288540a4bfdbf0",
"versionType": "git"
},
{
"lessThan": "a85df8c7b5ee2d3d4823befada42c5c41aff4cb0",
"status": "affected",
"version": "45c690aea8ee5b7d012cd593bd288540a4bfdbf0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/tegra/drm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tegra: Fix NULL vs IS_ERR() check in probe()\n\nThe iommu_paging_domain_alloc() function doesn\u0027t return NULL pointers,\nit returns error pointers. Update the check to match."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:40.626Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d6c005855b97b8caf6039c1774745ee74c91fa6"
},
{
"url": "https://git.kernel.org/stable/c/a85df8c7b5ee2d3d4823befada42c5c41aff4cb0"
}
],
"title": "drm/tegra: Fix NULL vs IS_ERR() check in probe()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53078",
"datePublished": "2024-11-19T17:31:41.703Z",
"dateReserved": "2024-11-19T17:17:24.977Z",
"dateUpdated": "2024-12-19T09:38:40.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53053
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix another deadlock during RTC update
If ufshcd_rtc_work calls ufshcd_rpm_put_sync() and the pm's usage_count
is 0, we will enter the runtime suspend callback. However, the runtime
suspend callback will wait to flush ufshcd_rtc_work, causing a deadlock.
Replace ufshcd_rpm_put_sync() with ufshcd_rpm_put() to avoid the
deadlock.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a128cfec44709ab1bd1f01d158569bcb2386f54f",
"status": "affected",
"version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
"versionType": "git"
},
{
"lessThan": "cb7e509c4e0197f63717fee54fb41c4990ba8d3a",
"status": "affected",
"version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix another deadlock during RTC update\n\nIf ufshcd_rtc_work calls ufshcd_rpm_put_sync() and the pm\u0027s usage_count\nis 0, we will enter the runtime suspend callback. However, the runtime\nsuspend callback will wait to flush ufshcd_rtc_work, causing a deadlock.\n\nReplace ufshcd_rpm_put_sync() with ufshcd_rpm_put() to avoid the\ndeadlock."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:05.378Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a128cfec44709ab1bd1f01d158569bcb2386f54f"
},
{
"url": "https://git.kernel.org/stable/c/cb7e509c4e0197f63717fee54fb41c4990ba8d3a"
}
],
"title": "scsi: ufs: core: Fix another deadlock during RTC update",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53053",
"datePublished": "2024-11-19T17:19:37.653Z",
"dateReserved": "2024-11-19T17:17:24.974Z",
"dateUpdated": "2024-12-19T09:38:05.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53073
Vulnerability from cvelistv5
Published
2024-11-19 17:31
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Never decrement pending_async_copies on error
The error flow in nfsd4_copy() calls cleanup_async_copy(), which
already decrements nn->pending_async_copies.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 9e52ff544e0bfa09ee339fd7b0937ee3c080c24e Version: 43e46ee5efc03990b223f7aa8b77aa9c3d3acfdf Version: 7ea9260874b779637aff6d24c344b8ef4ac862a0 Version: ae267989b7b7933dfedcd26468d0a88fc3a9da9e Version: 6a488ad7745b8f64625c6d3a24ce7e448e83f11b Version: aadc3bbea163b6caaaebfdd2b6c4667fbc726752 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed98d26021db0fe62c327aa9f5e57a90bff3fa94",
"status": "affected",
"version": "9e52ff544e0bfa09ee339fd7b0937ee3c080c24e",
"versionType": "git"
},
{
"lessThan": "9467c49437e948c541569007cd412d577942e635",
"status": "affected",
"version": "43e46ee5efc03990b223f7aa8b77aa9c3d3acfdf",
"versionType": "git"
},
{
"lessThan": "949ee5d44d1fd95119b29b3382a933cdc617bf9e",
"status": "affected",
"version": "7ea9260874b779637aff6d24c344b8ef4ac862a0",
"versionType": "git"
},
{
"lessThan": "fb79d68a36e21960341ccab07d1ac06d93830321",
"status": "affected",
"version": "ae267989b7b7933dfedcd26468d0a88fc3a9da9e",
"versionType": "git"
},
{
"lessThan": "1421883aa30c5d26bc3370e2d19cb350f0d5ca28",
"status": "affected",
"version": "6a488ad7745b8f64625c6d3a24ce7e448e83f11b",
"versionType": "git"
},
{
"lessThan": "8286f8b622990194207df9ab852e0f87c60d35e9",
"status": "affected",
"version": "aadc3bbea163b6caaaebfdd2b6c4667fbc726752",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.11.7",
"status": "affected",
"version": "6.11.3",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Never decrement pending_async_copies on error\n\nThe error flow in nfsd4_copy() calls cleanup_async_copy(), which\nalready decrements nn-\u003epending_async_copies."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:29.449Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed98d26021db0fe62c327aa9f5e57a90bff3fa94"
},
{
"url": "https://git.kernel.org/stable/c/9467c49437e948c541569007cd412d577942e635"
},
{
"url": "https://git.kernel.org/stable/c/949ee5d44d1fd95119b29b3382a933cdc617bf9e"
},
{
"url": "https://git.kernel.org/stable/c/fb79d68a36e21960341ccab07d1ac06d93830321"
},
{
"url": "https://git.kernel.org/stable/c/1421883aa30c5d26bc3370e2d19cb350f0d5ca28"
},
{
"url": "https://git.kernel.org/stable/c/8286f8b622990194207df9ab852e0f87c60d35e9"
}
],
"title": "NFSD: Never decrement pending_async_copies on error",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53073",
"datePublished": "2024-11-19T17:31:38.040Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:29.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53043
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:37
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mctp i2c: handle NULL header address
daddr can be NULL if there is no neighbour table entry present,
in that case the tx packet should be dropped.
saddr will usually be set by MCTP core, but check for NULL in case a
packet is transmitted by a different protocol.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/mctp/mctp-i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4707893315802a0917231b94cb20cbe50ccbfe03",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
},
{
"lessThan": "8e886e44397ba89f6e8da8471386112b4f5b67b7",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
},
{
"lessThan": "8c222adadc1612e4f097688875962a28e3f5ab44",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
},
{
"lessThan": "01e215975fd80af81b5b79f009d49ddd35976c13",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/mctp/mctp-i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmctp i2c: handle NULL header address\n\ndaddr can be NULL if there is no neighbour table entry present,\nin that case the tx packet should be dropped.\n\nsaddr will usually be set by MCTP core, but check for NULL in case a\npacket is transmitted by a different protocol."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:37:52.254Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4707893315802a0917231b94cb20cbe50ccbfe03"
},
{
"url": "https://git.kernel.org/stable/c/8e886e44397ba89f6e8da8471386112b4f5b67b7"
},
{
"url": "https://git.kernel.org/stable/c/8c222adadc1612e4f097688875962a28e3f5ab44"
},
{
"url": "https://git.kernel.org/stable/c/01e215975fd80af81b5b79f009d49ddd35976c13"
}
],
"title": "mctp i2c: handle NULL header address",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53043",
"datePublished": "2024-11-19T17:19:31.497Z",
"dateReserved": "2024-11-19T17:17:24.972Z",
"dateUpdated": "2024-12-19T09:37:52.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53066
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfs: Fix KMSAN warning in decode_getfattr_attrs()
Fix the following KMSAN warning:
CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
=====================================================
=====================================================
BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90
decode_getfattr_attrs+0x2d6d/0x2f90
decode_getfattr_generic+0x806/0xb00
nfs4_xdr_dec_getattr+0x1de/0x240
rpcauth_unwrap_resp_decode+0xab/0x100
rpcauth_unwrap_resp+0x95/0xc0
call_decode+0x4ff/0xb50
__rpc_execute+0x57b/0x19d0
rpc_execute+0x368/0x5e0
rpc_run_task+0xcfe/0xee0
nfs4_proc_getattr+0x5b5/0x990
__nfs_revalidate_inode+0x477/0xd00
nfs_access_get_cached+0x1021/0x1cc0
nfs_do_access+0x9f/0xae0
nfs_permission+0x1e4/0x8c0
inode_permission+0x356/0x6c0
link_path_walk+0x958/0x1330
path_lookupat+0xce/0x6b0
filename_lookup+0x23e/0x770
vfs_statx+0xe7/0x970
vfs_fstatat+0x1f2/0x2c0
__se_sys_newfstatat+0x67/0x880
__x64_sys_newfstatat+0xbd/0x120
x64_sys_call+0x1826/0x3cf0
do_syscall_64+0xd0/0x1b0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The KMSAN warning is triggered in decode_getfattr_attrs(), when calling
decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not
initialized.
Fix the issue by initializing fattr->mdsthreshold to NULL in
nfs_fattr_init().
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 88034c3d88c2c48b215f2cc5eb22e564aa817f9c Version: 88034c3d88c2c48b215f2cc5eb22e564aa817f9c Version: 88034c3d88c2c48b215f2cc5eb22e564aa817f9c Version: 88034c3d88c2c48b215f2cc5eb22e564aa817f9c Version: 88034c3d88c2c48b215f2cc5eb22e564aa817f9c Version: 88034c3d88c2c48b215f2cc5eb22e564aa817f9c Version: 88034c3d88c2c48b215f2cc5eb22e564aa817f9c Version: 88034c3d88c2c48b215f2cc5eb22e564aa817f9c |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25ffd294fef81a7f3cd9528adf21560c04d98747",
"status": "affected",
"version": "88034c3d88c2c48b215f2cc5eb22e564aa817f9c",
"versionType": "git"
},
{
"lessThan": "bbfcd261cc068fe1cd02a4e871275074a0daa4e2",
"status": "affected",
"version": "88034c3d88c2c48b215f2cc5eb22e564aa817f9c",
"versionType": "git"
},
{
"lessThan": "8fc5ea9231af9122d227c9c13f5e578fca48d2e3",
"status": "affected",
"version": "88034c3d88c2c48b215f2cc5eb22e564aa817f9c",
"versionType": "git"
},
{
"lessThan": "9b453e8b108a5a93a6e348cf2ba4c9c138314a00",
"status": "affected",
"version": "88034c3d88c2c48b215f2cc5eb22e564aa817f9c",
"versionType": "git"
},
{
"lessThan": "f6b2b2b981af8e7d7c62d34143acefa4e1edfe8b",
"status": "affected",
"version": "88034c3d88c2c48b215f2cc5eb22e564aa817f9c",
"versionType": "git"
},
{
"lessThan": "f749cb60a01f8391c760a1d6ecd938cadacf9549",
"status": "affected",
"version": "88034c3d88c2c48b215f2cc5eb22e564aa817f9c",
"versionType": "git"
},
{
"lessThan": "9be0a21ae52b3b822d0eec4d14e909ab394f8a92",
"status": "affected",
"version": "88034c3d88c2c48b215f2cc5eb22e564aa817f9c",
"versionType": "git"
},
{
"lessThan": "dc270d7159699ad6d11decadfce9633f0f71c1db",
"status": "affected",
"version": "88034c3d88c2c48b215f2cc5eb22e564aa817f9c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.324",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.286",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.230",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.172",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: Fix KMSAN warning in decode_getfattr_attrs()\n\nFix the following KMSAN warning:\n\nCPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B\nTainted: [B]=BAD_PAGE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009)\n=====================================================\n=====================================================\nBUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90\n decode_getfattr_attrs+0x2d6d/0x2f90\n decode_getfattr_generic+0x806/0xb00\n nfs4_xdr_dec_getattr+0x1de/0x240\n rpcauth_unwrap_resp_decode+0xab/0x100\n rpcauth_unwrap_resp+0x95/0xc0\n call_decode+0x4ff/0xb50\n __rpc_execute+0x57b/0x19d0\n rpc_execute+0x368/0x5e0\n rpc_run_task+0xcfe/0xee0\n nfs4_proc_getattr+0x5b5/0x990\n __nfs_revalidate_inode+0x477/0xd00\n nfs_access_get_cached+0x1021/0x1cc0\n nfs_do_access+0x9f/0xae0\n nfs_permission+0x1e4/0x8c0\n inode_permission+0x356/0x6c0\n link_path_walk+0x958/0x1330\n path_lookupat+0xce/0x6b0\n filename_lookup+0x23e/0x770\n vfs_statx+0xe7/0x970\n vfs_fstatat+0x1f2/0x2c0\n __se_sys_newfstatat+0x67/0x880\n __x64_sys_newfstatat+0xbd/0x120\n x64_sys_call+0x1826/0x3cf0\n do_syscall_64+0xd0/0x1b0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe KMSAN warning is triggered in decode_getfattr_attrs(), when calling\ndecode_attr_mdsthreshold(). It appears that fattr-\u003emdsthreshold is not\ninitialized.\n\nFix the issue by initializing fattr-\u003emdsthreshold to NULL in\nnfs_fattr_init()."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:20.644Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25ffd294fef81a7f3cd9528adf21560c04d98747"
},
{
"url": "https://git.kernel.org/stable/c/bbfcd261cc068fe1cd02a4e871275074a0daa4e2"
},
{
"url": "https://git.kernel.org/stable/c/8fc5ea9231af9122d227c9c13f5e578fca48d2e3"
},
{
"url": "https://git.kernel.org/stable/c/9b453e8b108a5a93a6e348cf2ba4c9c138314a00"
},
{
"url": "https://git.kernel.org/stable/c/f6b2b2b981af8e7d7c62d34143acefa4e1edfe8b"
},
{
"url": "https://git.kernel.org/stable/c/f749cb60a01f8391c760a1d6ecd938cadacf9549"
},
{
"url": "https://git.kernel.org/stable/c/9be0a21ae52b3b822d0eec4d14e909ab394f8a92"
},
{
"url": "https://git.kernel.org/stable/c/dc270d7159699ad6d11decadfce9633f0f71c1db"
}
],
"title": "nfs: Fix KMSAN warning in decode_getfattr_attrs()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53066",
"datePublished": "2024-11-19T17:22:35.389Z",
"dateReserved": "2024-11-19T17:17:24.975Z",
"dateUpdated": "2024-12-19T09:38:20.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53071
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Be stricter about IO mapping flags
The current panthor_device_mmap_io() implementation has two issues:
1. For mapping DRM_PANTHOR_USER_FLUSH_ID_MMIO_OFFSET,
panthor_device_mmap_io() bails if VM_WRITE is set, but does not clear
VM_MAYWRITE. That means userspace can use mprotect() to make the mapping
writable later on. This is a classic Linux driver gotcha.
I don't think this actually has any impact in practice:
When the GPU is powered, writes to the FLUSH_ID seem to be ignored; and
when the GPU is not powered, the dummy_latest_flush page provided by the
driver is deliberately designed to not do any flushes, so the only thing
writing to the dummy_latest_flush could achieve would be to make *more*
flushes happen.
2. panthor_device_mmap_io() does not block MAP_PRIVATE mappings (which are
mappings without the VM_SHARED flag).
MAP_PRIVATE in combination with VM_MAYWRITE indicates that the VMA has
copy-on-write semantics, which for VM_PFNMAP are semi-supported but
fairly cursed.
In particular, in such a mapping, the driver can only install PTEs
during mmap() by calling remap_pfn_range() (because remap_pfn_range()
wants to **store the physical address of the mapped physical memory into
the vm_pgoff of the VMA**); installing PTEs later on with a fault
handler (as panthor does) is not supported in private mappings, and so
if you try to fault in such a mapping, vmf_insert_pfn_prot() splats when
it hits a BUG() check.
Fix it by clearing the VM_MAYWRITE flag (userspace writing to the FLUSH_ID
doesn't make sense) and requiring VM_SHARED (copy-on-write semantics for
the FLUSH_ID don't make sense).
Reproducers for both scenarios are in the notes of my patch on the mailing
list; I tested that these bugs exist on a Rock 5B machine.
Note that I only compile-tested the patch, I haven't tested it; I don't
have a working kernel build setup for the test machine yet. Please test it
before applying it.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2604afd65043e8f9d4be036cb1242adf6b5723cf",
"status": "affected",
"version": "5fe909cae118a757a77afb37174b99436a36d2e2",
"versionType": "git"
},
{
"lessThan": "f432a1621f049bb207e78363d9d0e3c6fa2da5db",
"status": "affected",
"version": "5fe909cae118a757a77afb37174b99436a36d2e2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Be stricter about IO mapping flags\n\nThe current panthor_device_mmap_io() implementation has two issues:\n\n1. For mapping DRM_PANTHOR_USER_FLUSH_ID_MMIO_OFFSET,\n panthor_device_mmap_io() bails if VM_WRITE is set, but does not clear\n VM_MAYWRITE. That means userspace can use mprotect() to make the mapping\n writable later on. This is a classic Linux driver gotcha.\n I don\u0027t think this actually has any impact in practice:\n When the GPU is powered, writes to the FLUSH_ID seem to be ignored; and\n when the GPU is not powered, the dummy_latest_flush page provided by the\n driver is deliberately designed to not do any flushes, so the only thing\n writing to the dummy_latest_flush could achieve would be to make *more*\n flushes happen.\n\n2. panthor_device_mmap_io() does not block MAP_PRIVATE mappings (which are\n mappings without the VM_SHARED flag).\n MAP_PRIVATE in combination with VM_MAYWRITE indicates that the VMA has\n copy-on-write semantics, which for VM_PFNMAP are semi-supported but\n fairly cursed.\n In particular, in such a mapping, the driver can only install PTEs\n during mmap() by calling remap_pfn_range() (because remap_pfn_range()\n wants to **store the physical address of the mapped physical memory into\n the vm_pgoff of the VMA**); installing PTEs later on with a fault\n handler (as panthor does) is not supported in private mappings, and so\n if you try to fault in such a mapping, vmf_insert_pfn_prot() splats when\n it hits a BUG() check.\n\nFix it by clearing the VM_MAYWRITE flag (userspace writing to the FLUSH_ID\ndoesn\u0027t make sense) and requiring VM_SHARED (copy-on-write semantics for\nthe FLUSH_ID don\u0027t make sense).\n\nReproducers for both scenarios are in the notes of my patch on the mailing\nlist; I tested that these bugs exist on a Rock 5B machine.\n\nNote that I only compile-tested the patch, I haven\u0027t tested it; I don\u0027t\nhave a working kernel build setup for the test machine yet. Please test it\nbefore applying it."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:26.990Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2604afd65043e8f9d4be036cb1242adf6b5723cf"
},
{
"url": "https://git.kernel.org/stable/c/f432a1621f049bb207e78363d9d0e3c6fa2da5db"
}
],
"title": "drm/panthor: Be stricter about IO mapping flags",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53071",
"datePublished": "2024-11-19T17:22:38.327Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:26.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53082
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Add hash_key_length check
Add hash_key_length check in virtnet_probe() to avoid possible out of
bound errors when setting/reading the hash key.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3401e3c8d339ddb6ccb2e3d11ad634b7846a806",
"status": "affected",
"version": "c7114b1249fa3b5f3a434606ba4cc89c4a27d618",
"versionType": "git"
},
{
"lessThan": "af0aa8aecbe8985079232902894cc4cb62795691",
"status": "affected",
"version": "c7114b1249fa3b5f3a434606ba4cc89c4a27d618",
"versionType": "git"
},
{
"lessThan": "6a18a783b1fa590ad1ed785907263e4b86adcfe2",
"status": "affected",
"version": "c7114b1249fa3b5f3a434606ba4cc89c4a27d618",
"versionType": "git"
},
{
"lessThan": "3f7d9c1964fcd16d02a8a9d4fd6f6cb60c4cc530",
"status": "affected",
"version": "c7114b1249fa3b5f3a434606ba4cc89c4a27d618",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Add hash_key_length check\n\nAdd hash_key_length check in virtnet_probe() to avoid possible out of\nbound errors when setting/reading the hash key."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:45.968Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3401e3c8d339ddb6ccb2e3d11ad634b7846a806"
},
{
"url": "https://git.kernel.org/stable/c/af0aa8aecbe8985079232902894cc4cb62795691"
},
{
"url": "https://git.kernel.org/stable/c/6a18a783b1fa590ad1ed785907263e4b86adcfe2"
},
{
"url": "https://git.kernel.org/stable/c/3f7d9c1964fcd16d02a8a9d4fd6f6cb60c4cc530"
}
],
"title": "virtio_net: Add hash_key_length check",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53082",
"datePublished": "2024-11-19T17:45:12.233Z",
"dateReserved": "2024-11-19T17:17:24.979Z",
"dateUpdated": "2024-12-19T09:38:45.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53052
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
When io_uring starts a write, it'll call kiocb_start_write() to bump the
super block rwsem, preventing any freezes from happening while that
write is in-flight. The freeze side will grab that rwsem for writing,
excluding any new writers from happening and waiting for existing writes
to finish. But io_uring unconditionally uses kiocb_start_write(), which
will block if someone is currently attempting to freeze the mount point.
This causes a deadlock where freeze is waiting for previous writes to
complete, but the previous writes cannot complete, as the task that is
supposed to complete them is blocked waiting on starting a new write.
This results in the following stuck trace showing that dependency with
the write blocked starting a new write:
task:fio state:D stack:0 pid:886 tgid:886 ppid:876
Call trace:
__switch_to+0x1d8/0x348
__schedule+0x8e8/0x2248
schedule+0x110/0x3f0
percpu_rwsem_wait+0x1e8/0x3f8
__percpu_down_read+0xe8/0x500
io_write+0xbb8/0xff8
io_issue_sqe+0x10c/0x1020
io_submit_sqes+0x614/0x2110
__arm64_sys_io_uring_enter+0x524/0x1038
invoke_syscall+0x74/0x268
el0_svc_common.constprop.0+0x160/0x238
do_el0_svc+0x44/0x60
el0_svc+0x44/0xb0
el0t_64_sync_handler+0x118/0x128
el0t_64_sync+0x168/0x170
INFO: task fsfreeze:7364 blocked for more than 15 seconds.
Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963
with the attempting freezer stuck trying to grab the rwsem:
task:fsfreeze state:D stack:0 pid:7364 tgid:7364 ppid:995
Call trace:
__switch_to+0x1d8/0x348
__schedule+0x8e8/0x2248
schedule+0x110/0x3f0
percpu_down_write+0x2b0/0x680
freeze_super+0x248/0x8a8
do_vfs_ioctl+0x149c/0x1b18
__arm64_sys_ioctl+0xd0/0x1a0
invoke_syscall+0x74/0x268
el0_svc_common.constprop.0+0x160/0x238
do_el0_svc+0x44/0x60
el0_svc+0x44/0xb0
el0t_64_sync_handler+0x118/0x128
el0t_64_sync+0x168/0x170
Fix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a
blocking grab of the super block rwsem if it isn't set. For normal issue
where IOCB_NOWAIT would always be set, this returns -EAGAIN which will
have io_uring core issue a blocking attempt of the write. That will in
turn also get completions run, ensuring forward progress.
Since freezing requires CAP_SYS_ADMIN in the first place, this isn't
something that can be triggered by a regular user.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "485d9232112b17f389b29497ff41b97b3189546b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4e24041ba86d50aaa4c792ae2c88ed01b3d96243",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9e8debb8e51354b201db494689198078ec2c1e75",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "003d2996964c03dfd34860500428f4cdf1f5879e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "26b8c48f369b7591f5679e0b90612f4862a32929",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1d60d74e852647255bd8e76f5a22dc42531e4389",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.230",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.172",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rw: fix missing NOWAIT check for O_DIRECT start write\n\nWhen io_uring starts a write, it\u0027ll call kiocb_start_write() to bump the\nsuper block rwsem, preventing any freezes from happening while that\nwrite is in-flight. The freeze side will grab that rwsem for writing,\nexcluding any new writers from happening and waiting for existing writes\nto finish. But io_uring unconditionally uses kiocb_start_write(), which\nwill block if someone is currently attempting to freeze the mount point.\nThis causes a deadlock where freeze is waiting for previous writes to\ncomplete, but the previous writes cannot complete, as the task that is\nsupposed to complete them is blocked waiting on starting a new write.\nThis results in the following stuck trace showing that dependency with\nthe write blocked starting a new write:\n\ntask:fio state:D stack:0 pid:886 tgid:886 ppid:876\nCall trace:\n __switch_to+0x1d8/0x348\n __schedule+0x8e8/0x2248\n schedule+0x110/0x3f0\n percpu_rwsem_wait+0x1e8/0x3f8\n __percpu_down_read+0xe8/0x500\n io_write+0xbb8/0xff8\n io_issue_sqe+0x10c/0x1020\n io_submit_sqes+0x614/0x2110\n __arm64_sys_io_uring_enter+0x524/0x1038\n invoke_syscall+0x74/0x268\n el0_svc_common.constprop.0+0x160/0x238\n do_el0_svc+0x44/0x60\n el0_svc+0x44/0xb0\n el0t_64_sync_handler+0x118/0x128\n el0t_64_sync+0x168/0x170\nINFO: task fsfreeze:7364 blocked for more than 15 seconds.\n Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963\n\nwith the attempting freezer stuck trying to grab the rwsem:\n\ntask:fsfreeze state:D stack:0 pid:7364 tgid:7364 ppid:995\nCall trace:\n __switch_to+0x1d8/0x348\n __schedule+0x8e8/0x2248\n schedule+0x110/0x3f0\n percpu_down_write+0x2b0/0x680\n freeze_super+0x248/0x8a8\n do_vfs_ioctl+0x149c/0x1b18\n __arm64_sys_ioctl+0xd0/0x1a0\n invoke_syscall+0x74/0x268\n el0_svc_common.constprop.0+0x160/0x238\n do_el0_svc+0x44/0x60\n el0_svc+0x44/0xb0\n el0t_64_sync_handler+0x118/0x128\n el0t_64_sync+0x168/0x170\n\nFix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a\nblocking grab of the super block rwsem if it isn\u0027t set. For normal issue\nwhere IOCB_NOWAIT would always be set, this returns -EAGAIN which will\nhave io_uring core issue a blocking attempt of the write. That will in\nturn also get completions run, ensuring forward progress.\n\nSince freezing requires CAP_SYS_ADMIN in the first place, this isn\u0027t\nsomething that can be triggered by a regular user."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:04.193Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/485d9232112b17f389b29497ff41b97b3189546b"
},
{
"url": "https://git.kernel.org/stable/c/4e24041ba86d50aaa4c792ae2c88ed01b3d96243"
},
{
"url": "https://git.kernel.org/stable/c/9e8debb8e51354b201db494689198078ec2c1e75"
},
{
"url": "https://git.kernel.org/stable/c/003d2996964c03dfd34860500428f4cdf1f5879e"
},
{
"url": "https://git.kernel.org/stable/c/26b8c48f369b7591f5679e0b90612f4862a32929"
},
{
"url": "https://git.kernel.org/stable/c/1d60d74e852647255bd8e76f5a22dc42531e4389"
}
],
"title": "io_uring/rw: fix missing NOWAIT check for O_DIRECT start write",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53052",
"datePublished": "2024-11-19T17:19:37.067Z",
"dateReserved": "2024-11-19T17:17:24.973Z",
"dateUpdated": "2024-12-19T09:38:04.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53079
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/thp: fix deferred split unqueue naming and locking
Recent changes are putting more pressure on THP deferred split queues:
under load revealing long-standing races, causing list_del corruptions,
"Bad page state"s and worse (I keep BUGs in both of those, so usually
don't get to see how badly they end up without). The relevant recent
changes being 6.8's mTHP, 6.10's mTHP swapout, and 6.12's mTHP swapin,
improved swap allocation, and underused THP splitting.
Before fixing locking: rename misleading folio_undo_large_rmappable(),
which does not undo large_rmappable, to folio_unqueue_deferred_split(),
which is what it does. But that and its out-of-line __callee are mm
internals of very limited usability: add comment and WARN_ON_ONCEs to
check usage; and return a bool to say if a deferred split was unqueued,
which can then be used in WARN_ON_ONCEs around safety checks (sparing
callers the arcane conditionals in __folio_unqueue_deferred_split()).
Just omit the folio_unqueue_deferred_split() from free_unref_folios(), all
of whose callers now call it beforehand (and if any forget then bad_page()
will tell) - except for its caller put_pages_list(), which itself no
longer has any callers (and will be deleted separately).
Swapout: mem_cgroup_swapout() has been resetting folio->memcg_data 0
without checking and unqueueing a THP folio from deferred split list;
which is unfortunate, since the split_queue_lock depends on the memcg
(when memcg is enabled); so swapout has been unqueueing such THPs later,
when freeing the folio, using the pgdat's lock instead: potentially
corrupting the memcg's list. __remove_mapping() has frozen refcount to 0
here, so no problem with calling folio_unqueue_deferred_split() before
resetting memcg_data.
That goes back to 5.4 commit 87eaceb3faa5 ("mm: thp: make deferred split
shrinker memcg aware"): which included a check on swapcache before adding
to deferred queue, but no check on deferred queue before adding THP to
swapcache. That worked fine with the usual sequence of events in reclaim
(though there were a couple of rare ways in which a THP on deferred queue
could have been swapped out), but 6.12 commit dafff3f4c850 ("mm: split
underused THPs") avoids splitting underused THPs in reclaim, which makes
swapcache THPs on deferred queue commonplace.
Keep the check on swapcache before adding to deferred queue? Yes: it is
no longer essential, but preserves the existing behaviour, and is likely
to be a worthwhile optimization (vmstat showed much more traffic on the
queue under swapping load if the check was removed); update its comment.
Memcg-v1 move (deprecated): mem_cgroup_move_account() has been changing
folio->memcg_data without checking and unqueueing a THP folio from the
deferred list, sometimes corrupting "from" memcg's list, like swapout.
Refcount is non-zero here, so folio_unqueue_deferred_split() can only be
used in a WARN_ON_ONCE to validate the fix, which must be done earlier:
mem_cgroup_move_charge_pte_range() first try to split the THP (splitting
of course unqueues), or skip it if that fails. Not ideal, but moving
charge has been requested, and khugepaged should repair the THP later:
nobody wants new custom unqueueing code just for this deprecated case.
The 87eaceb3faa5 commit did have the code to move from one deferred list
to another (but was not conscious of its unsafety while refcount non-0);
but that was removed by 5.6 commit fac0516b5534 ("mm: thp: don't need care
deferred split queue in memcg charge move path"), which argued that the
existence of a PMD mapping guarantees that the THP cannot be on a deferred
list. As above, false in rare cases, and now commonly false.
Backport to 6.11 should be straightforward. Earlier backports must take
care that other _deferred_list fixes and dependencies are included. There
is not a strong case for backports, but they can fix cornercases.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c",
"mm/internal.h",
"mm/memcontrol-v1.c",
"mm/memcontrol.c",
"mm/migrate.c",
"mm/page_alloc.c",
"mm/swap.c",
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fc4951c3e3358dd82ea508e893695b916c813f17",
"status": "affected",
"version": "87eaceb3faa59b9b4d940ec9554ce251325d83fe",
"versionType": "git"
},
{
"lessThan": "afb1352d06b1b6b2cfd1f901c766a430c87078b3",
"status": "affected",
"version": "87eaceb3faa59b9b4d940ec9554ce251325d83fe",
"versionType": "git"
},
{
"lessThan": "f8f931bba0f92052cf842b7e30917b1afcc77d5a",
"status": "affected",
"version": "87eaceb3faa59b9b4d940ec9554ce251325d83fe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c",
"mm/internal.h",
"mm/memcontrol-v1.c",
"mm/memcontrol.c",
"mm/migrate.c",
"mm/page_alloc.c",
"mm/swap.c",
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.62",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/thp: fix deferred split unqueue naming and locking\n\nRecent changes are putting more pressure on THP deferred split queues:\nunder load revealing long-standing races, causing list_del corruptions,\n\"Bad page state\"s and worse (I keep BUGs in both of those, so usually\ndon\u0027t get to see how badly they end up without). The relevant recent\nchanges being 6.8\u0027s mTHP, 6.10\u0027s mTHP swapout, and 6.12\u0027s mTHP swapin,\nimproved swap allocation, and underused THP splitting.\n\nBefore fixing locking: rename misleading folio_undo_large_rmappable(),\nwhich does not undo large_rmappable, to folio_unqueue_deferred_split(),\nwhich is what it does. But that and its out-of-line __callee are mm\ninternals of very limited usability: add comment and WARN_ON_ONCEs to\ncheck usage; and return a bool to say if a deferred split was unqueued,\nwhich can then be used in WARN_ON_ONCEs around safety checks (sparing\ncallers the arcane conditionals in __folio_unqueue_deferred_split()).\n\nJust omit the folio_unqueue_deferred_split() from free_unref_folios(), all\nof whose callers now call it beforehand (and if any forget then bad_page()\nwill tell) - except for its caller put_pages_list(), which itself no\nlonger has any callers (and will be deleted separately).\n\nSwapout: mem_cgroup_swapout() has been resetting folio-\u003ememcg_data 0\nwithout checking and unqueueing a THP folio from deferred split list;\nwhich is unfortunate, since the split_queue_lock depends on the memcg\n(when memcg is enabled); so swapout has been unqueueing such THPs later,\nwhen freeing the folio, using the pgdat\u0027s lock instead: potentially\ncorrupting the memcg\u0027s list. __remove_mapping() has frozen refcount to 0\nhere, so no problem with calling folio_unqueue_deferred_split() before\nresetting memcg_data.\n\nThat goes back to 5.4 commit 87eaceb3faa5 (\"mm: thp: make deferred split\nshrinker memcg aware\"): which included a check on swapcache before adding\nto deferred queue, but no check on deferred queue before adding THP to\nswapcache. That worked fine with the usual sequence of events in reclaim\n(though there were a couple of rare ways in which a THP on deferred queue\ncould have been swapped out), but 6.12 commit dafff3f4c850 (\"mm: split\nunderused THPs\") avoids splitting underused THPs in reclaim, which makes\nswapcache THPs on deferred queue commonplace.\n\nKeep the check on swapcache before adding to deferred queue? Yes: it is\nno longer essential, but preserves the existing behaviour, and is likely\nto be a worthwhile optimization (vmstat showed much more traffic on the\nqueue under swapping load if the check was removed); update its comment.\n\nMemcg-v1 move (deprecated): mem_cgroup_move_account() has been changing\nfolio-\u003ememcg_data without checking and unqueueing a THP folio from the\ndeferred list, sometimes corrupting \"from\" memcg\u0027s list, like swapout. \nRefcount is non-zero here, so folio_unqueue_deferred_split() can only be\nused in a WARN_ON_ONCE to validate the fix, which must be done earlier:\nmem_cgroup_move_charge_pte_range() first try to split the THP (splitting\nof course unqueues), or skip it if that fails. Not ideal, but moving\ncharge has been requested, and khugepaged should repair the THP later:\nnobody wants new custom unqueueing code just for this deprecated case.\n\nThe 87eaceb3faa5 commit did have the code to move from one deferred list\nto another (but was not conscious of its unsafety while refcount non-0);\nbut that was removed by 5.6 commit fac0516b5534 (\"mm: thp: don\u0027t need care\ndeferred split queue in memcg charge move path\"), which argued that the\nexistence of a PMD mapping guarantees that the THP cannot be on a deferred\nlist. As above, false in rare cases, and now commonly false.\n\nBackport to 6.11 should be straightforward. Earlier backports must take\ncare that other _deferred_list fixes and dependencies are included. There\nis not a strong case for backports, but they can fix cornercases."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:42.012Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fc4951c3e3358dd82ea508e893695b916c813f17"
},
{
"url": "https://git.kernel.org/stable/c/afb1352d06b1b6b2cfd1f901c766a430c87078b3"
},
{
"url": "https://git.kernel.org/stable/c/f8f931bba0f92052cf842b7e30917b1afcc77d5a"
}
],
"title": "mm/thp: fix deferred split unqueue naming and locking",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53079",
"datePublished": "2024-11-19T17:45:09.914Z",
"dateReserved": "2024-11-19T17:17:24.977Z",
"dateUpdated": "2024-12-19T09:38:42.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53081
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: ar0521: don't overflow when checking PLL values
The PLL checks are comparing 64 bit integers with 32 bit
ones, as reported by Coverity. Depending on the values of
the variables, this may underflow.
Fix it ensuring that both sides of the expression are u64.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/ar0521.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5e1523076acf95b4ea68d19b6f27e6891267cc24",
"status": "affected",
"version": "852b50aeed153b513c0b36298559114fab0fab80",
"versionType": "git"
},
{
"lessThan": "a244b82d0ae60326901f2b50c15e3118298b7ecd",
"status": "affected",
"version": "852b50aeed153b513c0b36298559114fab0fab80",
"versionType": "git"
},
{
"lessThan": "97ed0c0332d5525653668b31acf62ff1e6b50784",
"status": "affected",
"version": "852b50aeed153b513c0b36298559114fab0fab80",
"versionType": "git"
},
{
"lessThan": "438d3085ba5b8b5bfa5290faa594e577f6ac9aa7",
"status": "affected",
"version": "852b50aeed153b513c0b36298559114fab0fab80",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/ar0521.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ar0521: don\u0027t overflow when checking PLL values\n\nThe PLL checks are comparing 64 bit integers with 32 bit\nones, as reported by Coverity. Depending on the values of\nthe variables, this may underflow.\n\nFix it ensuring that both sides of the expression are u64."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:44.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5e1523076acf95b4ea68d19b6f27e6891267cc24"
},
{
"url": "https://git.kernel.org/stable/c/a244b82d0ae60326901f2b50c15e3118298b7ecd"
},
{
"url": "https://git.kernel.org/stable/c/97ed0c0332d5525653668b31acf62ff1e6b50784"
},
{
"url": "https://git.kernel.org/stable/c/438d3085ba5b8b5bfa5290faa594e577f6ac9aa7"
}
],
"title": "media: ar0521: don\u0027t overflow when checking PLL values",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53081",
"datePublished": "2024-11-19T17:45:11.594Z",
"dateReserved": "2024-11-19T17:17:24.978Z",
"dateUpdated": "2024-12-19T09:38:44.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53057
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed
to be either root or ingress. This assumption is bogus since it's valid
to create egress qdiscs with major handle ffff:
Budimir Markovic found that for qdiscs like DRR that maintain an active
class list, it will cause a UAF with a dangling class pointer.
In 066a3b5b2346, the concern was to avoid iterating over the ingress
qdisc since its parent is itself. The proper fix is to stop when parent
TC_H_ROOT is reached because the only way to retrieve ingress is when a
hierarchy which does not contain a ffff: major handle call into
qdisc_lookup with TC_H_MAJ(TC_H_ROOT).
In the scenario where major ffff: is an egress qdisc in any of the tree
levels, the updates will also propagate to TC_H_ROOT, which then the
iteration must stop.
net/sched/sch_api.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 066a3b5b2346febf9a655b444567b7138e3bb939 Version: 066a3b5b2346febf9a655b444567b7138e3bb939 Version: 066a3b5b2346febf9a655b444567b7138e3bb939 Version: 066a3b5b2346febf9a655b444567b7138e3bb939 Version: 066a3b5b2346febf9a655b444567b7138e3bb939 Version: 066a3b5b2346febf9a655b444567b7138e3bb939 Version: 066a3b5b2346febf9a655b444567b7138e3bb939 Version: 066a3b5b2346febf9a655b444567b7138e3bb939 |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-53057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-11T14:25:23.594430Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-11T14:58:31.650Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7f9a6f97eb067599a74f3bcb6761976b0ed303e",
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"versionType": "git"
},
{
"lessThan": "dbe778b08b5101df9e89bc06e0a3a7ecd2f4ef20",
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"versionType": "git"
},
{
"lessThan": "ce691c814bc7a3c30c220ffb5b7422715458fd9b",
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"versionType": "git"
},
{
"lessThan": "05df1b1dff8f197f1c275b57ccb2ca33021df552",
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"versionType": "git"
},
{
"lessThan": "580b3189c1972aff0f993837567d36392e9d981b",
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"versionType": "git"
},
{
"lessThan": "597cf9748c3477bf61bc35f0634129f56764ad24",
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"versionType": "git"
},
{
"lessThan": "9995909615c3431a5304c1210face5f268d24dba",
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"versionType": "git"
},
{
"lessThan": "2e95c4384438adeaa772caa560244b1a2efef816",
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.323",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.285",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.171",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT\n\nIn qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed\nto be either root or ingress. This assumption is bogus since it\u0027s valid\nto create egress qdiscs with major handle ffff:\nBudimir Markovic found that for qdiscs like DRR that maintain an active\nclass list, it will cause a UAF with a dangling class pointer.\n\nIn 066a3b5b2346, the concern was to avoid iterating over the ingress\nqdisc since its parent is itself. The proper fix is to stop when parent\nTC_H_ROOT is reached because the only way to retrieve ingress is when a\nhierarchy which does not contain a ffff: major handle call into\nqdisc_lookup with TC_H_MAJ(TC_H_ROOT).\n\nIn the scenario where major ffff: is an egress qdisc in any of the tree\nlevels, the updates will also propagate to TC_H_ROOT, which then the\niteration must stop.\n\n\n net/sched/sch_api.c | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:09.155Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7f9a6f97eb067599a74f3bcb6761976b0ed303e"
},
{
"url": "https://git.kernel.org/stable/c/dbe778b08b5101df9e89bc06e0a3a7ecd2f4ef20"
},
{
"url": "https://git.kernel.org/stable/c/ce691c814bc7a3c30c220ffb5b7422715458fd9b"
},
{
"url": "https://git.kernel.org/stable/c/05df1b1dff8f197f1c275b57ccb2ca33021df552"
},
{
"url": "https://git.kernel.org/stable/c/580b3189c1972aff0f993837567d36392e9d981b"
},
{
"url": "https://git.kernel.org/stable/c/597cf9748c3477bf61bc35f0634129f56764ad24"
},
{
"url": "https://git.kernel.org/stable/c/9995909615c3431a5304c1210face5f268d24dba"
},
{
"url": "https://git.kernel.org/stable/c/2e95c4384438adeaa772caa560244b1a2efef816"
}
],
"title": "net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53057",
"datePublished": "2024-11-19T17:19:40.284Z",
"dateReserved": "2024-11-19T17:17:24.974Z",
"dateUpdated": "2024-12-19T09:38:09.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53087
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix possible exec queue leak in exec IOCTL
In a couple of places after an exec queue is looked up the exec IOCTL
returns on input errors without dropping the exec queue ref. Fix this
ensuring the exec queue ref is dropped on input error.
(cherry picked from commit 07064a200b40ac2195cb6b7b779897d9377e5e6f)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_exec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f92b77a8ce043fbda2664d9be4b66bdc57f67b7",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "af797b831d8975cb4610f396dcb7f03f4b9908e7",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_exec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix possible exec queue leak in exec IOCTL\n\nIn a couple of places after an exec queue is looked up the exec IOCTL\nreturns on input errors without dropping the exec queue ref. Fix this\nensuring the exec queue ref is dropped on input error.\n\n(cherry picked from commit 07064a200b40ac2195cb6b7b779897d9377e5e6f)"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:52.257Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f92b77a8ce043fbda2664d9be4b66bdc57f67b7"
},
{
"url": "https://git.kernel.org/stable/c/af797b831d8975cb4610f396dcb7f03f4b9908e7"
}
],
"title": "drm/xe: Fix possible exec queue leak in exec IOCTL",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53087",
"datePublished": "2024-11-19T17:45:15.510Z",
"dateReserved": "2024-11-19T17:17:24.980Z",
"dateUpdated": "2024-12-19T09:38:52.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-50304
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2025-02-02 10:15
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
The per-netns IP tunnel hash table is protected by the RTNL mutex and
ip_tunnel_find() is only called from the control path where the mutex is
taken.
Add a lockdep expression to hlist_for_each_entry_rcu() in
ip_tunnel_find() in order to validate that the mutex is held and to
silence the suspicious RCU usage warning [1].
[1]
WARNING: suspicious RCU usage
6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted
-----------------------------
net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/362:
#0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60
stack backtrace:
CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl+0xba/0x110
lockdep_rcu_suspicious.cold+0x4f/0xd6
ip_tunnel_find+0x435/0x4d0
ip_tunnel_newlink+0x517/0x7a0
ipgre_newlink+0x14c/0x170
__rtnl_newlink+0x1173/0x19c0
rtnl_newlink+0x6c/0xa0
rtnetlink_rcv_msg+0x3cc/0xf60
netlink_rcv_skb+0x171/0x450
netlink_unicast+0x539/0x7f0
netlink_sendmsg+0x8c1/0xd80
____sys_sendmsg+0x8f9/0xc20
___sys_sendmsg+0x197/0x1e0
__sys_sendmsg+0x122/0x1f0
do_syscall_64+0xbb/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: c54419321455631079c7d6e60bc732dd0c5914c5 Version: c54419321455631079c7d6e60bc732dd0c5914c5 Version: c54419321455631079c7d6e60bc732dd0c5914c5 Version: c54419321455631079c7d6e60bc732dd0c5914c5 Version: c54419321455631079c7d6e60bc732dd0c5914c5 Version: c54419321455631079c7d6e60bc732dd0c5914c5 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "31bd7378c6fe100a8af0e996ea0b5dafd3579df6",
"status": "affected",
"version": "c54419321455631079c7d6e60bc732dd0c5914c5",
"versionType": "git"
},
{
"lessThan": "6ac5dfa575136da8dd8a9e7c1437c41f3a593993",
"status": "affected",
"version": "c54419321455631079c7d6e60bc732dd0c5914c5",
"versionType": "git"
},
{
"lessThan": "ce11424026cbf87d5861b09e5e33565ff7f2ec8d",
"status": "affected",
"version": "c54419321455631079c7d6e60bc732dd0c5914c5",
"versionType": "git"
},
{
"lessThan": "e0500e4373cd3d5eace1f1712444ab830b82c114",
"status": "affected",
"version": "c54419321455631079c7d6e60bc732dd0c5914c5",
"versionType": "git"
},
{
"lessThan": "f20fe2cfe06ca1b008b09da4f2b4e0c5547ccef6",
"status": "affected",
"version": "c54419321455631079c7d6e60bc732dd0c5914c5",
"versionType": "git"
},
{
"lessThan": "90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12",
"status": "affected",
"version": "c54419321455631079c7d6e60bc732dd0c5914c5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.234",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()\n\nThe per-netns IP tunnel hash table is protected by the RTNL mutex and\nip_tunnel_find() is only called from the control path where the mutex is\ntaken.\n\nAdd a lockdep expression to hlist_for_each_entry_rcu() in\nip_tunnel_find() in order to validate that the mutex is held and to\nsilence the suspicious RCU usage warning [1].\n\n[1]\nWARNING: suspicious RCU usage\n6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted\n-----------------------------\nnet/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n1 lock held by ip/362:\n #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60\n\nstack backtrace:\nCPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139\nHardware name: Bochs Bochs, BIOS Bochs 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xba/0x110\n lockdep_rcu_suspicious.cold+0x4f/0xd6\n ip_tunnel_find+0x435/0x4d0\n ip_tunnel_newlink+0x517/0x7a0\n ipgre_newlink+0x14c/0x170\n __rtnl_newlink+0x1173/0x19c0\n rtnl_newlink+0x6c/0xa0\n rtnetlink_rcv_msg+0x3cc/0xf60\n netlink_rcv_skb+0x171/0x450\n netlink_unicast+0x539/0x7f0\n netlink_sendmsg+0x8c1/0xd80\n ____sys_sendmsg+0x8f9/0xc20\n ___sys_sendmsg+0x197/0x1e0\n __sys_sendmsg+0x122/0x1f0\n do_syscall_64+0xbb/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f"
}
],
"providerMetadata": {
"dateUpdated": "2025-02-02T10:15:05.537Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/31bd7378c6fe100a8af0e996ea0b5dafd3579df6"
},
{
"url": "https://git.kernel.org/stable/c/6ac5dfa575136da8dd8a9e7c1437c41f3a593993"
},
{
"url": "https://git.kernel.org/stable/c/ce11424026cbf87d5861b09e5e33565ff7f2ec8d"
},
{
"url": "https://git.kernel.org/stable/c/e0500e4373cd3d5eace1f1712444ab830b82c114"
},
{
"url": "https://git.kernel.org/stable/c/f20fe2cfe06ca1b008b09da4f2b4e0c5547ccef6"
},
{
"url": "https://git.kernel.org/stable/c/90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12"
}
],
"title": "ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-50304",
"datePublished": "2024-11-19T17:19:30.242Z",
"dateReserved": "2024-10-21T19:36:19.987Z",
"dateUpdated": "2025-02-02T10:15:05.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53064
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix idpf_vc_core_init error path
In an event where the platform running the device control plane
is rebooted, reset is detected on the driver. It releases
all the resources and waits for the reset to complete. Once the
reset is done, it tries to build the resources back. At this
time if the device control plane is not yet started, then
the driver timeouts on the virtchnl message and retries to
establish the mailbox again.
In the retry flow, mailbox is deinitialized but the mailbox
workqueue is still alive and polling for the mailbox message.
This results in accessing the released control queue leading to
null-ptr-deref. Fix it by unrolling the work queue cancellation
and mailbox deinitialization in the reverse order which they got
initialized.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_lib.c",
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "683fcd90ba22507ebeb1921a26dfe77efff8c266",
"status": "affected",
"version": "4930fbf419a72d7477426fd883bfc37e20a61a6e",
"versionType": "git"
},
{
"lessThan": "9b58031ff96b84a38d7b73b23c7ecfb2e0557f43",
"status": "affected",
"version": "4930fbf419a72d7477426fd883bfc37e20a61a6e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_lib.c",
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix idpf_vc_core_init error path\n\nIn an event where the platform running the device control plane\nis rebooted, reset is detected on the driver. It releases\nall the resources and waits for the reset to complete. Once the\nreset is done, it tries to build the resources back. At this\ntime if the device control plane is not yet started, then\nthe driver timeouts on the virtchnl message and retries to\nestablish the mailbox again.\n\nIn the retry flow, mailbox is deinitialized but the mailbox\nworkqueue is still alive and polling for the mailbox message.\nThis results in accessing the released control queue leading to\nnull-ptr-deref. Fix it by unrolling the work queue cancellation\nand mailbox deinitialization in the reverse order which they got\ninitialized."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:18.115Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/683fcd90ba22507ebeb1921a26dfe77efff8c266"
},
{
"url": "https://git.kernel.org/stable/c/9b58031ff96b84a38d7b73b23c7ecfb2e0557f43"
}
],
"title": "idpf: fix idpf_vc_core_init error path",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53064",
"datePublished": "2024-11-19T17:22:34.143Z",
"dateReserved": "2024-11-19T17:17:24.975Z",
"dateUpdated": "2024-12-19T09:38:18.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53065
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/slab: fix warning caused by duplicate kmem_cache creation in kmem_buckets_create
Commit b035f5a6d852 ("mm: slab: reduce the kmalloc() minimum alignment
if DMA bouncing possible") reduced ARCH_KMALLOC_MINALIGN to 8 on arm64.
However, with KASAN_HW_TAGS enabled, arch_slab_minalign() becomes 16.
This causes kmalloc_caches[*][8] to be aliased to kmalloc_caches[*][16],
resulting in kmem_buckets_create() attempting to create a kmem_cache for
size 16 twice. This duplication triggers warnings on boot:
[ 2.325108] ------------[ cut here ]------------
[ 2.325135] kmem_cache of name 'memdup_user-16' already exists
[ 2.325783] WARNING: CPU: 0 PID: 1 at mm/slab_common.c:107 __kmem_cache_create_args+0xb8/0x3b0
[ 2.327957] Modules linked in:
[ 2.328550] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5mm-unstable-arm64+ #12
[ 2.328683] Hardware name: QEMU QEMU Virtual Machine, BIOS 2024.02-2 03/11/2024
[ 2.328790] pstate: 61000009 (nZCv daif -PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 2.328911] pc : __kmem_cache_create_args+0xb8/0x3b0
[ 2.328930] lr : __kmem_cache_create_args+0xb8/0x3b0
[ 2.328942] sp : ffff800083d6fc50
[ 2.328961] x29: ffff800083d6fc50 x28: f2ff0000c1674410 x27: ffff8000820b0598
[ 2.329061] x26: 000000007fffffff x25: 0000000000000010 x24: 0000000000002000
[ 2.329101] x23: ffff800083d6fce8 x22: ffff8000832222e8 x21: ffff800083222388
[ 2.329118] x20: f2ff0000c1674410 x19: f5ff0000c16364c0 x18: ffff800083d80030
[ 2.329135] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[ 2.329152] x14: 0000000000000000 x13: 0a73747369786520 x12: 79646165726c6120
[ 2.329169] x11: 656820747563205b x10: 2d2d2d2d2d2d2d2d x9 : 0000000000000000
[ 2.329194] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
[ 2.329210] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
[ 2.329226] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
[ 2.329291] Call trace:
[ 2.329407] __kmem_cache_create_args+0xb8/0x3b0
[ 2.329499] kmem_buckets_create+0xfc/0x320
[ 2.329526] init_user_buckets+0x34/0x78
[ 2.329540] do_one_initcall+0x64/0x3c8
[ 2.329550] kernel_init_freeable+0x26c/0x578
[ 2.329562] kernel_init+0x3c/0x258
[ 2.329574] ret_from_fork+0x10/0x20
[ 2.329698] ---[ end trace 0000000000000000 ]---
[ 2.403704] ------------[ cut here ]------------
[ 2.404716] kmem_cache of name 'msg_msg-16' already exists
[ 2.404801] WARNING: CPU: 2 PID: 1 at mm/slab_common.c:107 __kmem_cache_create_args+0xb8/0x3b0
[ 2.404842] Modules linked in:
[ 2.404971] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.0-rc5mm-unstable-arm64+ #12
[ 2.405026] Tainted: [W]=WARN
[ 2.405043] Hardware name: QEMU QEMU Virtual Machine, BIOS 2024.02-2 03/11/2024
[ 2.405057] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 2.405079] pc : __kmem_cache_create_args+0xb8/0x3b0
[ 2.405100] lr : __kmem_cache_create_args+0xb8/0x3b0
[ 2.405111] sp : ffff800083d6fc50
[ 2.405115] x29: ffff800083d6fc50 x28: fbff0000c1674410 x27: ffff8000820b0598
[ 2.405135] x26: 000000000000ffd0 x25: 0000000000000010 x24: 0000000000006000
[ 2.405153] x23: ffff800083d6fce8 x22: ffff8000832222e8 x21: ffff800083222388
[ 2.405169] x20: fbff0000c1674410 x19: fdff0000c163d6c0 x18: ffff800083d80030
[ 2.405185] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[ 2.405201] x14: 0000000000000000 x13: 0a73747369786520 x12: 79646165726c6120
[ 2.405217] x11: 656820747563205b x10: 2d2d2d2d2d2d2d2d x9 : 0000000000000000
[ 2.405233] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
[ 2.405248] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
[ 2.405271] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
[ 2.405287] Call trace:
[ 2
---truncated---
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/slab_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1b47f9febf48641d3530ec877f4d0995c58e6b73",
"status": "affected",
"version": "b32801d1255be1da62ea8134df3ed9f3331fba12",
"versionType": "git"
},
{
"lessThan": "9c9201afebea1efc7ea4b8f721ee18a05bb8aca1",
"status": "affected",
"version": "b32801d1255be1da62ea8134df3ed9f3331fba12",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/slab_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: fix warning caused by duplicate kmem_cache creation in kmem_buckets_create\n\nCommit b035f5a6d852 (\"mm: slab: reduce the kmalloc() minimum alignment\nif DMA bouncing possible\") reduced ARCH_KMALLOC_MINALIGN to 8 on arm64.\nHowever, with KASAN_HW_TAGS enabled, arch_slab_minalign() becomes 16.\nThis causes kmalloc_caches[*][8] to be aliased to kmalloc_caches[*][16],\nresulting in kmem_buckets_create() attempting to create a kmem_cache for\nsize 16 twice. This duplication triggers warnings on boot:\n\n[ 2.325108] ------------[ cut here ]------------\n[ 2.325135] kmem_cache of name \u0027memdup_user-16\u0027 already exists\n[ 2.325783] WARNING: CPU: 0 PID: 1 at mm/slab_common.c:107 __kmem_cache_create_args+0xb8/0x3b0\n[ 2.327957] Modules linked in:\n[ 2.328550] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5mm-unstable-arm64+ #12\n[ 2.328683] Hardware name: QEMU QEMU Virtual Machine, BIOS 2024.02-2 03/11/2024\n[ 2.328790] pstate: 61000009 (nZCv daif -PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 2.328911] pc : __kmem_cache_create_args+0xb8/0x3b0\n[ 2.328930] lr : __kmem_cache_create_args+0xb8/0x3b0\n[ 2.328942] sp : ffff800083d6fc50\n[ 2.328961] x29: ffff800083d6fc50 x28: f2ff0000c1674410 x27: ffff8000820b0598\n[ 2.329061] x26: 000000007fffffff x25: 0000000000000010 x24: 0000000000002000\n[ 2.329101] x23: ffff800083d6fce8 x22: ffff8000832222e8 x21: ffff800083222388\n[ 2.329118] x20: f2ff0000c1674410 x19: f5ff0000c16364c0 x18: ffff800083d80030\n[ 2.329135] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[ 2.329152] x14: 0000000000000000 x13: 0a73747369786520 x12: 79646165726c6120\n[ 2.329169] x11: 656820747563205b x10: 2d2d2d2d2d2d2d2d x9 : 0000000000000000\n[ 2.329194] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000\n[ 2.329210] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\n[ 2.329226] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000\n[ 2.329291] Call trace:\n[ 2.329407] __kmem_cache_create_args+0xb8/0x3b0\n[ 2.329499] kmem_buckets_create+0xfc/0x320\n[ 2.329526] init_user_buckets+0x34/0x78\n[ 2.329540] do_one_initcall+0x64/0x3c8\n[ 2.329550] kernel_init_freeable+0x26c/0x578\n[ 2.329562] kernel_init+0x3c/0x258\n[ 2.329574] ret_from_fork+0x10/0x20\n[ 2.329698] ---[ end trace 0000000000000000 ]---\n\n[ 2.403704] ------------[ cut here ]------------\n[ 2.404716] kmem_cache of name \u0027msg_msg-16\u0027 already exists\n[ 2.404801] WARNING: CPU: 2 PID: 1 at mm/slab_common.c:107 __kmem_cache_create_args+0xb8/0x3b0\n[ 2.404842] Modules linked in:\n[ 2.404971] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.0-rc5mm-unstable-arm64+ #12\n[ 2.405026] Tainted: [W]=WARN\n[ 2.405043] Hardware name: QEMU QEMU Virtual Machine, BIOS 2024.02-2 03/11/2024\n[ 2.405057] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 2.405079] pc : __kmem_cache_create_args+0xb8/0x3b0\n[ 2.405100] lr : __kmem_cache_create_args+0xb8/0x3b0\n[ 2.405111] sp : ffff800083d6fc50\n[ 2.405115] x29: ffff800083d6fc50 x28: fbff0000c1674410 x27: ffff8000820b0598\n[ 2.405135] x26: 000000000000ffd0 x25: 0000000000000010 x24: 0000000000006000\n[ 2.405153] x23: ffff800083d6fce8 x22: ffff8000832222e8 x21: ffff800083222388\n[ 2.405169] x20: fbff0000c1674410 x19: fdff0000c163d6c0 x18: ffff800083d80030\n[ 2.405185] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[ 2.405201] x14: 0000000000000000 x13: 0a73747369786520 x12: 79646165726c6120\n[ 2.405217] x11: 656820747563205b x10: 2d2d2d2d2d2d2d2d x9 : 0000000000000000\n[ 2.405233] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000\n[ 2.405248] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\n[ 2.405271] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000\n[ 2.405287] Call trace:\n[ 2\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:19.421Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b47f9febf48641d3530ec877f4d0995c58e6b73"
},
{
"url": "https://git.kernel.org/stable/c/9c9201afebea1efc7ea4b8f721ee18a05bb8aca1"
}
],
"title": "mm/slab: fix warning caused by duplicate kmem_cache creation in kmem_buckets_create",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53065",
"datePublished": "2024-11-19T17:22:34.763Z",
"dateReserved": "2024-11-19T17:17:24.975Z",
"dateUpdated": "2024-12-19T09:38:19.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53069
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: qcom: scm: fix a NULL-pointer dereference
Some SCM calls can be invoked with __scm being NULL (the driver may not
have been and will not be probed as there's no SCM entry in device-tree).
Make sure we don't dereference a NULL pointer.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/qcom/qcom_scm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d36e2b1d803f0d1cc674115d295a8f20ddb9268",
"status": "affected",
"version": "449d0d84bcd8246b508d07995326d13c54488b8c",
"versionType": "git"
},
{
"lessThan": "ca61d6836e6f4442a77762e1074d2706a2a6e578",
"status": "affected",
"version": "449d0d84bcd8246b508d07995326d13c54488b8c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/qcom/qcom_scm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: scm: fix a NULL-pointer dereference\n\nSome SCM calls can be invoked with __scm being NULL (the driver may not\nhave been and will not be probed as there\u0027s no SCM entry in device-tree).\nMake sure we don\u0027t dereference a NULL pointer."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:24.550Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d36e2b1d803f0d1cc674115d295a8f20ddb9268"
},
{
"url": "https://git.kernel.org/stable/c/ca61d6836e6f4442a77762e1074d2706a2a6e578"
}
],
"title": "firmware: qcom: scm: fix a NULL-pointer dereference",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53069",
"datePublished": "2024-11-19T17:22:37.192Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:24.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53055
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix 6 GHz scan construction
If more than 255 colocated APs exist for the set of all
APs found during 2.4/5 GHz scanning, then the 6 GHz scan
construction will loop forever since the loop variable
has type u8, which can never reach the number found when
that's bigger than 255, and is stored in a u32 variable.
Also move it into the loops to have a smaller scope.
Using a u32 there is fine, we limit the number of APs in
the scan list and each has a limit on the number of RNR
entries due to the frame size. With a limit of 1000 scan
results, a frame size upper bound of 4096 (really it's
more like ~2300) and a TBTT entry size of at least 11,
we get an upper bound for the number of ~372k, well in
the bounds of a u32.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: eae94cf82d7456b57fa9fd55c1edb8a726dcc19c Version: eae94cf82d7456b57fa9fd55c1edb8a726dcc19c Version: eae94cf82d7456b57fa9fd55c1edb8a726dcc19c Version: eae94cf82d7456b57fa9fd55c1edb8a726dcc19c Version: eae94cf82d7456b57fa9fd55c1edb8a726dcc19c |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ac15e5a8f42fed5d90ed9e1197600913678c50f",
"status": "affected",
"version": "eae94cf82d7456b57fa9fd55c1edb8a726dcc19c",
"versionType": "git"
},
{
"lessThan": "cde8a7eb5c6762264ff0f4433358e0a0d250c875",
"status": "affected",
"version": "eae94cf82d7456b57fa9fd55c1edb8a726dcc19c",
"versionType": "git"
},
{
"lessThan": "fc621e7a043de346c33bd7ae7e2e0c651d6152ef",
"status": "affected",
"version": "eae94cf82d7456b57fa9fd55c1edb8a726dcc19c",
"versionType": "git"
},
{
"lessThan": "2ccd5badadab2d586e91546bf5af3deda07fef1f",
"status": "affected",
"version": "eae94cf82d7456b57fa9fd55c1edb8a726dcc19c",
"versionType": "git"
},
{
"lessThan": "7245012f0f496162dd95d888ed2ceb5a35170f1a",
"status": "affected",
"version": "eae94cf82d7456b57fa9fd55c1edb8a726dcc19c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.171",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix 6 GHz scan construction\n\nIf more than 255 colocated APs exist for the set of all\nAPs found during 2.4/5 GHz scanning, then the 6 GHz scan\nconstruction will loop forever since the loop variable\nhas type u8, which can never reach the number found when\nthat\u0027s bigger than 255, and is stored in a u32 variable.\nAlso move it into the loops to have a smaller scope.\n\nUsing a u32 there is fine, we limit the number of APs in\nthe scan list and each has a limit on the number of RNR\nentries due to the frame size. With a limit of 1000 scan\nresults, a frame size upper bound of 4096 (really it\u0027s\nmore like ~2300) and a TBTT entry size of at least 11,\nwe get an upper bound for the number of ~372k, well in\nthe bounds of a u32."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:06.611Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ac15e5a8f42fed5d90ed9e1197600913678c50f"
},
{
"url": "https://git.kernel.org/stable/c/cde8a7eb5c6762264ff0f4433358e0a0d250c875"
},
{
"url": "https://git.kernel.org/stable/c/fc621e7a043de346c33bd7ae7e2e0c651d6152ef"
},
{
"url": "https://git.kernel.org/stable/c/2ccd5badadab2d586e91546bf5af3deda07fef1f"
},
{
"url": "https://git.kernel.org/stable/c/7245012f0f496162dd95d888ed2ceb5a35170f1a"
}
],
"title": "wifi: iwlwifi: mvm: fix 6 GHz scan construction",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53055",
"datePublished": "2024-11-19T17:19:39.037Z",
"dateReserved": "2024-11-19T17:17:24.974Z",
"dateUpdated": "2024-12-19T09:38:06.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53044
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:37
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()
This command:
$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact
Error: block dev insert failed: -EBUSY.
fails because user space requests the same block index to be set for
both ingress and egress.
[ side note, I don't think it even failed prior to commit 913b47d3424e
("net/sched: Introduce tc block netdev tracking infra"), because this
is a command from an old set of notes of mine which used to work, but
alas, I did not scientifically bisect this ]
The problem is not that it fails, but rather, that the second time
around, it fails differently (and irrecoverably):
$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact
Error: dsa_core: Flow block cb is busy.
[ another note: the extack is added by me for illustration purposes.
the context of the problem is that clsact_init() obtains the same
&q->ingress_block pointer as &q->egress_block, and since we call
tcf_block_get_ext() on both of them, "dev" will be added to the
block->ports xarray twice, thus failing the operation: once through
the ingress block pointer, and once again through the egress block
pointer. the problem itself is that when xa_insert() fails, we have
emitted a FLOW_BLOCK_BIND command through ndo_setup_tc(), but the
offload never sees a corresponding FLOW_BLOCK_UNBIND. ]
Even correcting the bad user input, we still cannot recover:
$ tc qdisc replace dev swp3 ingress_block 1 egress_block 2 clsact
Error: dsa_core: Flow block cb is busy.
Basically the only way to recover is to reboot the system, or unbind and
rebind the net device driver.
To fix the bug, we need to fill the correct error teardown path which
was missed during code movement, and call tcf_block_offload_unbind()
when xa_insert() fails.
[ last note, fundamentally I blame the label naming convention in
tcf_block_get_ext() for the bug. The labels should be named after what
they do, not after the error path that jumps to them. This way, it is
obviously wrong that two labels pointing to the same code mean
something is wrong, and checking the code correctness at the goto site
is also easier ]
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8966eb69a143b1c032365fe84f2815f3c46f2590",
"status": "affected",
"version": "94e2557d086ad831027c54bc9c2130d337c72814",
"versionType": "git"
},
{
"lessThan": "a13e690191eafc154b3f60afe9ce35aa9b9128b4",
"status": "affected",
"version": "94e2557d086ad831027c54bc9c2130d337c72814",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()\n\nThis command:\n\n$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact\nError: block dev insert failed: -EBUSY.\n\nfails because user space requests the same block index to be set for\nboth ingress and egress.\n\n[ side note, I don\u0027t think it even failed prior to commit 913b47d3424e\n (\"net/sched: Introduce tc block netdev tracking infra\"), because this\n is a command from an old set of notes of mine which used to work, but\n alas, I did not scientifically bisect this ]\n\nThe problem is not that it fails, but rather, that the second time\naround, it fails differently (and irrecoverably):\n\n$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact\nError: dsa_core: Flow block cb is busy.\n\n[ another note: the extack is added by me for illustration purposes.\n the context of the problem is that clsact_init() obtains the same\n \u0026q-\u003eingress_block pointer as \u0026q-\u003eegress_block, and since we call\n tcf_block_get_ext() on both of them, \"dev\" will be added to the\n block-\u003eports xarray twice, thus failing the operation: once through\n the ingress block pointer, and once again through the egress block\n pointer. the problem itself is that when xa_insert() fails, we have\n emitted a FLOW_BLOCK_BIND command through ndo_setup_tc(), but the\n offload never sees a corresponding FLOW_BLOCK_UNBIND. ]\n\nEven correcting the bad user input, we still cannot recover:\n\n$ tc qdisc replace dev swp3 ingress_block 1 egress_block 2 clsact\nError: dsa_core: Flow block cb is busy.\n\nBasically the only way to recover is to reboot the system, or unbind and\nrebind the net device driver.\n\nTo fix the bug, we need to fill the correct error teardown path which\nwas missed during code movement, and call tcf_block_offload_unbind()\nwhen xa_insert() fails.\n\n[ last note, fundamentally I blame the label naming convention in\n tcf_block_get_ext() for the bug. The labels should be named after what\n they do, not after the error path that jumps to them. This way, it is\n obviously wrong that two labels pointing to the same code mean\n something is wrong, and checking the code correctness at the goto site\n is also easier ]"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:37:53.505Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8966eb69a143b1c032365fe84f2815f3c46f2590"
},
{
"url": "https://git.kernel.org/stable/c/a13e690191eafc154b3f60afe9ce35aa9b9128b4"
}
],
"title": "net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53044",
"datePublished": "2024-11-19T17:19:32.095Z",
"dateReserved": "2024-11-19T17:17:24.972Z",
"dateUpdated": "2024-12-19T09:37:53.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53061
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2025-02-18 16:06
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: s5p-jpeg: prevent buffer overflows
The current logic allows word to be less than 2. If this happens,
there will be buffer overflows, as reported by smatch. Add extra
checks to prevent it.
While here, remove an unused word = 0 assignment.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-53061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T16:03:48.389379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-53061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T16:06:14.591807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T16:06:55.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c5f6fefcda8fac8f082b6c5bf416567f4e100c51",
"status": "affected",
"version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
"versionType": "git"
},
{
"lessThan": "e5117f6e7adcf9fd7546cdd0edc9abe4474bc98b",
"status": "affected",
"version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
"versionType": "git"
},
{
"lessThan": "f54e8e1e39dacccebcfb9a9a36f0552a0a97e2ef",
"status": "affected",
"version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
"versionType": "git"
},
{
"lessThan": "a930cddfd153b5d4401df0c01effa14c831ff21e",
"status": "affected",
"version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
"versionType": "git"
},
{
"lessThan": "c85db2d4432de4ff9d97006691ce2dcb5bda660e",
"status": "affected",
"version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
"versionType": "git"
},
{
"lessThan": "784bc785a453eb2f8433dd62075befdfa1b2d6fd",
"status": "affected",
"version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
"versionType": "git"
},
{
"lessThan": "c951a0859fdacf49a2298b5551a7e52b95ff6f51",
"status": "affected",
"version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
"versionType": "git"
},
{
"lessThan": "14a22762c3daeac59a5a534e124acbb4d7a79b3a",
"status": "affected",
"version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.324",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.286",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.230",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.172",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: s5p-jpeg: prevent buffer overflows\n\nThe current logic allows word to be less than 2. If this happens,\nthere will be buffer overflows, as reported by smatch. Add extra\nchecks to prevent it.\n\nWhile here, remove an unused word = 0 assignment."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:14.431Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c5f6fefcda8fac8f082b6c5bf416567f4e100c51"
},
{
"url": "https://git.kernel.org/stable/c/e5117f6e7adcf9fd7546cdd0edc9abe4474bc98b"
},
{
"url": "https://git.kernel.org/stable/c/f54e8e1e39dacccebcfb9a9a36f0552a0a97e2ef"
},
{
"url": "https://git.kernel.org/stable/c/a930cddfd153b5d4401df0c01effa14c831ff21e"
},
{
"url": "https://git.kernel.org/stable/c/c85db2d4432de4ff9d97006691ce2dcb5bda660e"
},
{
"url": "https://git.kernel.org/stable/c/784bc785a453eb2f8433dd62075befdfa1b2d6fd"
},
{
"url": "https://git.kernel.org/stable/c/c951a0859fdacf49a2298b5551a7e52b95ff6f51"
},
{
"url": "https://git.kernel.org/stable/c/14a22762c3daeac59a5a534e124acbb4d7a79b3a"
}
],
"title": "media: s5p-jpeg: prevent buffer overflows",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53061",
"datePublished": "2024-11-19T17:22:32.189Z",
"dateReserved": "2024-11-19T17:17:24.975Z",
"dateUpdated": "2025-02-18T16:06:55.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53049
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
slub/kunit: fix a WARNING due to unwrapped __kmalloc_cache_noprof
'modprobe slub_kunit' will have a warning as shown below. The root cause
is that __kmalloc_cache_noprof was directly used, which resulted in no
alloc_tag being allocated. This caused current->alloc_tag to be null,
leading to a warning in alloc_tag_add_check.
Let's add an alloc_hook layer to __kmalloc_cache_noprof specifically
within lib/slub_kunit.c, which is the only user of this internal slub
function outside kmalloc implementation itself.
[58162.947016] WARNING: CPU: 2 PID: 6210 at
./include/linux/alloc_tag.h:125 alloc_tagging_slab_alloc_hook+0x268/0x27c
[58162.957721] Call trace:
[58162.957919] alloc_tagging_slab_alloc_hook+0x268/0x27c
[58162.958286] __kmalloc_cache_noprof+0x14c/0x344
[58162.958615] test_kmalloc_redzone_access+0x50/0x10c [slub_kunit]
[58162.959045] kunit_try_run_case+0x74/0x184 [kunit]
[58162.959401] kunit_generic_run_threadfn_adapter+0x2c/0x4c [kunit]
[58162.959841] kthread+0x10c/0x118
[58162.960093] ret_from_fork+0x10/0x20
[58162.960363] ---[ end trace 0000000000000000 ]---
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"lib/slub_kunit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "79aea7dfd98fbbf282d1408fc21849fc9a677768",
"status": "affected",
"version": "a0a44d9175b349df2462089140fb7f292100bd7c",
"versionType": "git"
},
{
"lessThan": "2b059d0d1e624adc6e69a754bc48057f8bf459dc",
"status": "affected",
"version": "a0a44d9175b349df2462089140fb7f292100bd7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"lib/slub_kunit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslub/kunit: fix a WARNING due to unwrapped __kmalloc_cache_noprof\n\n\u0027modprobe slub_kunit\u0027 will have a warning as shown below. The root cause\nis that __kmalloc_cache_noprof was directly used, which resulted in no\nalloc_tag being allocated. This caused current-\u003ealloc_tag to be null,\nleading to a warning in alloc_tag_add_check.\n\nLet\u0027s add an alloc_hook layer to __kmalloc_cache_noprof specifically\nwithin lib/slub_kunit.c, which is the only user of this internal slub\nfunction outside kmalloc implementation itself.\n\n[58162.947016] WARNING: CPU: 2 PID: 6210 at\n./include/linux/alloc_tag.h:125 alloc_tagging_slab_alloc_hook+0x268/0x27c\n[58162.957721] Call trace:\n[58162.957919] alloc_tagging_slab_alloc_hook+0x268/0x27c\n[58162.958286] __kmalloc_cache_noprof+0x14c/0x344\n[58162.958615] test_kmalloc_redzone_access+0x50/0x10c [slub_kunit]\n[58162.959045] kunit_try_run_case+0x74/0x184 [kunit]\n[58162.959401] kunit_generic_run_threadfn_adapter+0x2c/0x4c [kunit]\n[58162.959841] kthread+0x10c/0x118\n[58162.960093] ret_from_fork+0x10/0x20\n[58162.960363] ---[ end trace 0000000000000000 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:00.353Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/79aea7dfd98fbbf282d1408fc21849fc9a677768"
},
{
"url": "https://git.kernel.org/stable/c/2b059d0d1e624adc6e69a754bc48057f8bf459dc"
}
],
"title": "slub/kunit: fix a WARNING due to unwrapped __kmalloc_cache_noprof",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53049",
"datePublished": "2024-11-19T17:19:35.260Z",
"dateReserved": "2024-11-19T17:17:24.973Z",
"dateUpdated": "2024-12-19T09:38:00.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53060
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-20 10:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
acpi_evaluate_object() may return AE_NOT_FOUND (failure), which
would result in dereferencing buffer.pointer (obj) while being NULL.
Although this case may be unrealistic for the current code, it is
still better to protect against possible bugs.
Bail out also when status is AE_NOT_FOUND.
This fixes 1 FORWARD_NULL issue reported by Coverity
Report: CID 1600951: Null pointer dereferences (FORWARD_NULL)
(cherry picked from commit 91c9e221fe2553edf2db71627d8453f083de87a1)
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 58556dcbd5606a5daccaee73b2130bc16b48e025 Version: 43b4fa6e0e238c6e2662f4fb61d9f51c2785fb1d Version: 234682910971732cd4da96fd95946e296e486b38 Version: 6032287747f874b52dc8b9d7490e2799736e035f Version: cd67af3c1762de4c2483ae4dbdd98f9ea8fa56e3 Version: 975ede2a7bec52b5da1428829b3439667c8a234b Version: 1d7175f9c57b1abf9ecfbdfd53ea760761f52ffe Version: bf58f03931fdcf7b3c45cb76ac13244477a60f44 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce8a00a00e36f61f5a1e47734332420b68784c43",
"status": "affected",
"version": "58556dcbd5606a5daccaee73b2130bc16b48e025",
"versionType": "git"
},
{
"lessThan": "8d7a28eca7553d35d4ce192fa1f390f2357df41b",
"status": "affected",
"version": "43b4fa6e0e238c6e2662f4fb61d9f51c2785fb1d",
"versionType": "git"
},
{
"lessThan": "2ac7f253deada4d449559b65a1c1cd0a6f6f19b7",
"status": "affected",
"version": "234682910971732cd4da96fd95946e296e486b38",
"versionType": "git"
},
{
"lessThan": "27fc29b5376998c126c85cf9b15d9dfc2afc9cbe",
"status": "affected",
"version": "6032287747f874b52dc8b9d7490e2799736e035f",
"versionType": "git"
},
{
"lessThan": "1a9f55ed5b512f510ccd21ad527d532e60550e80",
"status": "affected",
"version": "cd67af3c1762de4c2483ae4dbdd98f9ea8fa56e3",
"versionType": "git"
},
{
"lessThan": "a613a392417532ca5aaf3deac6e3277aa7aaef2b",
"status": "affected",
"version": "975ede2a7bec52b5da1428829b3439667c8a234b",
"versionType": "git"
},
{
"lessThan": "b9d9881237afeb52eddd70077b7174bf17e2fa30",
"status": "affected",
"version": "1d7175f9c57b1abf9ecfbdfd53ea760761f52ffe",
"versionType": "git"
},
{
"lessThan": "a6dd15981c03f2cdc9a351a278f09b5479d53d2e",
"status": "affected",
"version": "bf58f03931fdcf7b3c45cb76ac13244477a60f44",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4.19.324",
"status": "affected",
"version": "4.19.323",
"versionType": "semver"
},
{
"lessThan": "5.4.286",
"status": "affected",
"version": "5.4.285",
"versionType": "semver"
},
{
"lessThan": "5.10.230",
"status": "affected",
"version": "5.10.229",
"versionType": "semver"
},
{
"lessThan": "5.15.172",
"status": "affected",
"version": "5.15.170",
"versionType": "semver"
},
{
"lessThan": "6.1.117",
"status": "affected",
"version": "6.1.115",
"versionType": "semver"
},
{
"lessThan": "6.6.61",
"status": "affected",
"version": "6.6.59",
"versionType": "semver"
},
{
"lessThan": "6.11.8",
"status": "affected",
"version": "6.11.6",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: prevent NULL pointer dereference if ATIF is not supported\n\nacpi_evaluate_object() may return AE_NOT_FOUND (failure), which\nwould result in dereferencing buffer.pointer (obj) while being NULL.\n\nAlthough this case may be unrealistic for the current code, it is\nstill better to protect against possible bugs.\n\nBail out also when status is AE_NOT_FOUND.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity\nReport: CID 1600951: Null pointer dereferences (FORWARD_NULL)\n\n(cherry picked from commit 91c9e221fe2553edf2db71627d8453f083de87a1)"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-20T10:28:43.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce8a00a00e36f61f5a1e47734332420b68784c43"
},
{
"url": "https://git.kernel.org/stable/c/8d7a28eca7553d35d4ce192fa1f390f2357df41b"
},
{
"url": "https://git.kernel.org/stable/c/2ac7f253deada4d449559b65a1c1cd0a6f6f19b7"
},
{
"url": "https://git.kernel.org/stable/c/27fc29b5376998c126c85cf9b15d9dfc2afc9cbe"
},
{
"url": "https://git.kernel.org/stable/c/1a9f55ed5b512f510ccd21ad527d532e60550e80"
},
{
"url": "https://git.kernel.org/stable/c/a613a392417532ca5aaf3deac6e3277aa7aaef2b"
},
{
"url": "https://git.kernel.org/stable/c/b9d9881237afeb52eddd70077b7174bf17e2fa30"
},
{
"url": "https://git.kernel.org/stable/c/a6dd15981c03f2cdc9a351a278f09b5479d53d2e"
}
],
"title": "drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53060",
"datePublished": "2024-11-19T17:22:31.502Z",
"dateReserved": "2024-11-19T17:17:24.974Z",
"dateUpdated": "2024-12-20T10:28:43.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53084
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/imagination: Break an object reference loop
When remaining resources are being cleaned up on driver close,
outstanding VM mappings may result in resources being leaked, due
to an object reference loop, as shown below, with each object (or
set of objects) referencing the object below it:
PVR GEM Object
GPU scheduler "finished" fence
GPU scheduler “scheduled” fence
PVR driver “done” fence
PVR Context
PVR VM Context
PVR VM Mappings
PVR GEM Object
The reference that the PVR VM Context has on the VM mappings is a
soft one, in the sense that the freeing of outstanding VM mappings
is done as part of VM context destruction; no reference counts are
involved, as is the case for all the other references in the loop.
To break the reference loop during cleanup, free the outstanding
VM mappings before destroying the PVR Context associated with the
VM context.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/imagination/pvr_context.c",
"drivers/gpu/drm/imagination/pvr_context.h",
"drivers/gpu/drm/imagination/pvr_vm.c",
"drivers/gpu/drm/imagination/pvr_vm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb86db12b290ed07d05df00d99fa150bb123e80e",
"status": "affected",
"version": "4babef0708656c54e67ee0ee3994ee98898f51d1",
"versionType": "git"
},
{
"lessThan": "b04ce1e718bd55302b52d05d6873e233cb3ec7a1",
"status": "affected",
"version": "4babef0708656c54e67ee0ee3994ee98898f51d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/imagination/pvr_context.c",
"drivers/gpu/drm/imagination/pvr_context.h",
"drivers/gpu/drm/imagination/pvr_vm.c",
"drivers/gpu/drm/imagination/pvr_vm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Break an object reference loop\n\nWhen remaining resources are being cleaned up on driver close,\noutstanding VM mappings may result in resources being leaked, due\nto an object reference loop, as shown below, with each object (or\nset of objects) referencing the object below it:\n\n PVR GEM Object\n GPU scheduler \"finished\" fence\n GPU scheduler \u201cscheduled\u201d fence\n PVR driver \u201cdone\u201d fence\n PVR Context\n PVR VM Context\n PVR VM Mappings\n PVR GEM Object\n\nThe reference that the PVR VM Context has on the VM mappings is a\nsoft one, in the sense that the freeing of outstanding VM mappings\nis done as part of VM context destruction; no reference counts are\ninvolved, as is the case for all the other references in the loop.\n\nTo break the reference loop during cleanup, free the outstanding\nVM mappings before destroying the PVR Context associated with the\nVM context."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:48.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb86db12b290ed07d05df00d99fa150bb123e80e"
},
{
"url": "https://git.kernel.org/stable/c/b04ce1e718bd55302b52d05d6873e233cb3ec7a1"
}
],
"title": "drm/imagination: Break an object reference loop",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53084",
"datePublished": "2024-11-19T17:45:13.530Z",
"dateReserved": "2024-11-19T17:17:24.979Z",
"dateUpdated": "2024-12-19T09:38:48.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53072
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86/amd/pmc: Detect when STB is not available
Loading the amd_pmc module as:
amd_pmc enable_stb=1
...can result in the following messages in the kernel ring buffer:
amd_pmc AMDI0009:00: SMU cmd failed. err: 0xff
ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff
WARNING: CPU: 10 PID: 2151 at arch/x86/mm/ioremap.c:217 __ioremap_caller+0x2cd/0x340
Further debugging reveals that this occurs when the requests for
S2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH return a value of 0,
indicating that the STB is inaccessible. To prevent the ioremap
warning and provide clarity to the user, handle the invalid address
and display an error message.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/amd/pmc/pmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a50863dd1f92d43c975ab2ecc3476617fe98a66e",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
},
{
"lessThan": "7a3ed3f125292bc3398e04d10108124250892e3f",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
},
{
"lessThan": "67ff30e24a0466bdd5be1d0b84385ec3c85fdacd",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
},
{
"lessThan": "bceec87a73804bb4c33b9a6c96e2d27cd893a801",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/amd/pmc/pmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd/pmc: Detect when STB is not available\n\nLoading the amd_pmc module as:\n\n amd_pmc enable_stb=1\n\n...can result in the following messages in the kernel ring buffer:\n\n amd_pmc AMDI0009:00: SMU cmd failed. err: 0xff\n ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff\n WARNING: CPU: 10 PID: 2151 at arch/x86/mm/ioremap.c:217 __ioremap_caller+0x2cd/0x340\n\nFurther debugging reveals that this occurs when the requests for\nS2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH return a value of 0,\nindicating that the STB is inaccessible. To prevent the ioremap\nwarning and provide clarity to the user, handle the invalid address\nand display an error message."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:28.224Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a50863dd1f92d43c975ab2ecc3476617fe98a66e"
},
{
"url": "https://git.kernel.org/stable/c/7a3ed3f125292bc3398e04d10108124250892e3f"
},
{
"url": "https://git.kernel.org/stable/c/67ff30e24a0466bdd5be1d0b84385ec3c85fdacd"
},
{
"url": "https://git.kernel.org/stable/c/bceec87a73804bb4c33b9a6c96e2d27cd893a801"
}
],
"title": "platform/x86/amd/pmc: Detect when STB is not available",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53072",
"datePublished": "2024-11-19T17:22:38.861Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:28.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53048
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:37
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: fix crash on probe for DPLL enabled E810 LOM
The E810 Lan On Motherboard (LOM) design is vendor specific. Intel
provides the reference design, but it is up to vendor on the final
product design. For some cases, like Linux DPLL support, the static
values defined in the driver does not reflect the actual LOM design.
Current implementation of dpll pins is causing the crash on probe
of the ice driver for such DPLL enabled E810 LOM designs:
WARNING: (...) at drivers/dpll/dpll_core.c:495 dpll_pin_get+0x2c4/0x330
...
Call Trace:
<TASK>
? __warn+0x83/0x130
? dpll_pin_get+0x2c4/0x330
? report_bug+0x1b7/0x1d0
? handle_bug+0x42/0x70
? exc_invalid_op+0x18/0x70
? asm_exc_invalid_op+0x1a/0x20
? dpll_pin_get+0x117/0x330
? dpll_pin_get+0x2c4/0x330
? dpll_pin_get+0x117/0x330
ice_dpll_get_pins.isra.0+0x52/0xe0 [ice]
...
The number of dpll pins enabled by LOM vendor is greater than expected
and defined in the driver for Intel designed NICs, which causes the crash.
Prevent the crash and allow generic pin initialization within Linux DPLL
subsystem for DPLL enabled E810 LOM designs.
Newly designed solution for described issue will be based on "per HW
design" pin initialization. It requires pin information dynamically
acquired from the firmware and is already in progress, planned for
next-tree only.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_dpll.c",
"drivers/net/ethernet/intel/ice/ice_ptp_hw.c",
"drivers/net/ethernet/intel/ice/ice_ptp_hw.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "82b107a27bab29146e159b6b9f21146c97c45a53",
"status": "affected",
"version": "d7999f5ea64bb10d2857b8cbfe973be373bac7c9",
"versionType": "git"
},
{
"lessThan": "6e58c33106220c6c0c8fbee9ab63eae76ad8f260",
"status": "affected",
"version": "d7999f5ea64bb10d2857b8cbfe973be373bac7c9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_dpll.c",
"drivers/net/ethernet/intel/ice/ice_ptp_hw.c",
"drivers/net/ethernet/intel/ice/ice_ptp_hw.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix crash on probe for DPLL enabled E810 LOM\n\nThe E810 Lan On Motherboard (LOM) design is vendor specific. Intel\nprovides the reference design, but it is up to vendor on the final\nproduct design. For some cases, like Linux DPLL support, the static\nvalues defined in the driver does not reflect the actual LOM design.\nCurrent implementation of dpll pins is causing the crash on probe\nof the ice driver for such DPLL enabled E810 LOM designs:\n\nWARNING: (...) at drivers/dpll/dpll_core.c:495 dpll_pin_get+0x2c4/0x330\n...\nCall Trace:\n \u003cTASK\u003e\n ? __warn+0x83/0x130\n ? dpll_pin_get+0x2c4/0x330\n ? report_bug+0x1b7/0x1d0\n ? handle_bug+0x42/0x70\n ? exc_invalid_op+0x18/0x70\n ? asm_exc_invalid_op+0x1a/0x20\n ? dpll_pin_get+0x117/0x330\n ? dpll_pin_get+0x2c4/0x330\n ? dpll_pin_get+0x117/0x330\n ice_dpll_get_pins.isra.0+0x52/0xe0 [ice]\n...\n\nThe number of dpll pins enabled by LOM vendor is greater than expected\nand defined in the driver for Intel designed NICs, which causes the crash.\n\nPrevent the crash and allow generic pin initialization within Linux DPLL\nsubsystem for DPLL enabled E810 LOM designs.\n\nNewly designed solution for described issue will be based on \"per HW\ndesign\" pin initialization. It requires pin information dynamically\nacquired from the firmware and is already in progress, planned for\nnext-tree only."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:37:58.871Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/82b107a27bab29146e159b6b9f21146c97c45a53"
},
{
"url": "https://git.kernel.org/stable/c/6e58c33106220c6c0c8fbee9ab63eae76ad8f260"
}
],
"title": "ice: fix crash on probe for DPLL enabled E810 LOM",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53048",
"datePublished": "2024-11-19T17:19:34.654Z",
"dateReserved": "2024-11-19T17:17:24.973Z",
"dateUpdated": "2024-12-19T09:37:58.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53076
Vulnerability from cvelistv5
Published
2024-11-19 17:31
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()
If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loop
of iio_gts_build_avail_scale_table(), the err_free_out will fail to call
kfree() each time when i is reduced to 0, so all the per_time_scales[0]
and per_time_gains[0] will not be freed, which will cause memory leaks.
Fix it by checking if i >= 0.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/industrialio-gts-helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62c11896683129790b8f5ab6eb7e695818b0b723",
"status": "affected",
"version": "38416c28e16890b52fdd5eb73479299ec3f062f3",
"versionType": "git"
},
{
"lessThan": "b304362ce836968b803e5d4c5f84dcb51a7bf0f2",
"status": "affected",
"version": "38416c28e16890b52fdd5eb73479299ec3f062f3",
"versionType": "git"
},
{
"lessThan": "369f05688911b05216cfcd6ca74473bec87948d7",
"status": "affected",
"version": "38416c28e16890b52fdd5eb73479299ec3f062f3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/industrialio-gts-helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()\n\nIf per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loop\nof iio_gts_build_avail_scale_table(), the err_free_out will fail to call\nkfree() each time when i is reduced to 0, so all the per_time_scales[0]\nand per_time_gains[0] will not be freed, which will cause memory leaks.\n\nFix it by checking if i \u003e= 0."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:33.186Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62c11896683129790b8f5ab6eb7e695818b0b723"
},
{
"url": "https://git.kernel.org/stable/c/b304362ce836968b803e5d4c5f84dcb51a7bf0f2"
},
{
"url": "https://git.kernel.org/stable/c/369f05688911b05216cfcd6ca74473bec87948d7"
}
],
"title": "iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53076",
"datePublished": "2024-11-19T17:31:40.349Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:33.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53074
Vulnerability from cvelistv5
Published
2024-11-19 17:31
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't leak a link on AP removal
Release the link mapping resource in AP removal. This impacted devices
that do not support the MLD API (9260 and down).
On those devices, we couldn't start the AP again after the AP has been
already started and stopped.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "70ddf9ce1894c48dbbf10b0de51a95e4fb3dd376",
"status": "affected",
"version": "a8b5d4809b503da668966a8187b9872e6c85291c",
"versionType": "git"
},
{
"lessThan": "3ed092997a004d68a3a5b0eeb94e71b69839d0f7",
"status": "affected",
"version": "a8b5d4809b503da668966a8187b9872e6c85291c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: don\u0027t leak a link on AP removal\n\nRelease the link mapping resource in AP removal. This impacted devices\nthat do not support the MLD API (9260 and down).\nOn those devices, we couldn\u0027t start the AP again after the AP has been\nalready started and stopped."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:30.723Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/70ddf9ce1894c48dbbf10b0de51a95e4fb3dd376"
},
{
"url": "https://git.kernel.org/stable/c/3ed092997a004d68a3a5b0eeb94e71b69839d0f7"
}
],
"title": "wifi: iwlwifi: mvm: don\u0027t leak a link on AP removal",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53074",
"datePublished": "2024-11-19T17:31:39.010Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:30.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53085
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tpm: Lock TPM chip in tpm_pm_suspend() first
Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy
according, as this leaves window for tpm_hwrng_read() to be called while
the operation is in progress. The recent bug report gives also evidence of
this behaviour.
Aadress this by locking the TPM chip before checking any chip->flags both
in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED
check inside tpm_get_random() so that it will be always checked only when
the lock is reserved.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm-chip.c",
"drivers/char/tpm/tpm-interface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"status": "affected",
"version": "99d46450625590d410f86fe4660a5eff7d3b8343",
"versionType": "git"
},
{
"lessThan": "bc203fe416abdd1c29da594565a7c3c4e979488e",
"status": "affected",
"version": "99d46450625590d410f86fe4660a5eff7d3b8343",
"versionType": "git"
},
{
"lessThan": "9265fed6db601ee2ec47577815387458ef4f047a",
"status": "affected",
"version": "99d46450625590d410f86fe4660a5eff7d3b8343",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm-chip.c",
"drivers/char/tpm/tpm-interface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Lock TPM chip in tpm_pm_suspend() first\n\nSetting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy\naccording, as this leaves window for tpm_hwrng_read() to be called while\nthe operation is in progress. The recent bug report gives also evidence of\nthis behaviour.\n\nAadress this by locking the TPM chip before checking any chip-\u003eflags both\nin tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED\ncheck inside tpm_get_random() so that it will be always checked only when\nthe lock is reserved."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:49.816Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfaf83501a0cbb104499c5b0892ee5ebde4e967f"
},
{
"url": "https://git.kernel.org/stable/c/bc203fe416abdd1c29da594565a7c3c4e979488e"
},
{
"url": "https://git.kernel.org/stable/c/9265fed6db601ee2ec47577815387458ef4f047a"
}
],
"title": "tpm: Lock TPM chip in tpm_pm_suspend() first",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53085",
"datePublished": "2024-11-19T17:45:14.209Z",
"dateReserved": "2024-11-19T17:17:24.979Z",
"dateUpdated": "2024-12-19T09:38:49.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53051
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
Sometimes during hotplug scenario or suspend/resume scenario encoder is
not always initialized when intel_hdcp_get_capability add
a check to avoid kernel null pointer dereference.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_hdcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4912e8fb3c37fb2dedf48d9c18bbbecd70e720f8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "31b42af516afa1e184d1a9f9dd4096c54044269a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_hdcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: Add encoder check in intel_hdcp_get_capability\n\nSometimes during hotplug scenario or suspend/resume scenario encoder is\nnot always initialized when intel_hdcp_get_capability add\na check to avoid kernel null pointer dereference."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:02.932Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4912e8fb3c37fb2dedf48d9c18bbbecd70e720f8"
},
{
"url": "https://git.kernel.org/stable/c/31b42af516afa1e184d1a9f9dd4096c54044269a"
}
],
"title": "drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53051",
"datePublished": "2024-11-19T17:19:36.456Z",
"dateReserved": "2024-11-19T17:17:24.973Z",
"dateUpdated": "2024-12-19T09:38:02.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53054
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2024-11-28T16:51:11.255Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53054",
"datePublished": "2024-11-19T17:19:38.311Z",
"dateRejected": "2024-11-28T16:51:11.255Z",
"dateReserved": "2024-11-19T17:17:24.974Z",
"dateUpdated": "2024-11-28T16:51:11.255Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53047
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:37
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: init: protect sched with rcu_read_lock
Enabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT
creates this splat when an MPTCP socket is created:
=============================
WARNING: suspicious RCU usage
6.12.0-rc2+ #11 Not tainted
-----------------------------
net/mptcp/sched.c:44 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
no locks held by mptcp_connect/176.
stack backtrace:
CPU: 0 UID: 0 PID: 176 Comm: mptcp_connect Not tainted 6.12.0-rc2+ #11
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:123)
lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822)
mptcp_sched_find (net/mptcp/sched.c:44 (discriminator 7))
mptcp_init_sock (net/mptcp/protocol.c:2867 (discriminator 1))
? sock_init_data_uid (arch/x86/include/asm/atomic.h:28)
inet_create.part.0.constprop.0 (net/ipv4/af_inet.c:386)
? __sock_create (include/linux/rcupdate.h:347 (discriminator 1))
__sock_create (net/socket.c:1576)
__sys_socket (net/socket.c:1671)
? __pfx___sys_socket (net/socket.c:1712)
? do_user_addr_fault (arch/x86/mm/fault.c:1419 (discriminator 1))
__x64_sys_socket (net/socket.c:1728)
do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1))
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
That's because when the socket is initialised, rcu_read_lock() is not
used despite the explicit comment written above the declaration of
mptcp_sched_find() in sched.c. Adding the missing lock/unlock avoids the
warning.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb8b81ad3e893a6d18dcdd3754cc2ea2a42c0136",
"status": "affected",
"version": "1730b2b2c5a5a886007b247366aebe0976dc8881",
"versionType": "git"
},
{
"lessThan": "494eb22f9a7bd03783e60595a57611c209175f1a",
"status": "affected",
"version": "1730b2b2c5a5a886007b247366aebe0976dc8881",
"versionType": "git"
},
{
"lessThan": "3deb12c788c385e17142ce6ec50f769852fcec65",
"status": "affected",
"version": "1730b2b2c5a5a886007b247366aebe0976dc8881",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: init: protect sched with rcu_read_lock\n\nEnabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT\ncreates this splat when an MPTCP socket is created:\n\n =============================\n WARNING: suspicious RCU usage\n 6.12.0-rc2+ #11 Not tainted\n -----------------------------\n net/mptcp/sched.c:44 RCU-list traversed in non-reader section!!\n\n other info that might help us debug this:\n\n rcu_scheduler_active = 2, debug_locks = 1\n no locks held by mptcp_connect/176.\n\n stack backtrace:\n CPU: 0 UID: 0 PID: 176 Comm: mptcp_connect Not tainted 6.12.0-rc2+ #11\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:123)\n lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822)\n mptcp_sched_find (net/mptcp/sched.c:44 (discriminator 7))\n mptcp_init_sock (net/mptcp/protocol.c:2867 (discriminator 1))\n ? sock_init_data_uid (arch/x86/include/asm/atomic.h:28)\n inet_create.part.0.constprop.0 (net/ipv4/af_inet.c:386)\n ? __sock_create (include/linux/rcupdate.h:347 (discriminator 1))\n __sock_create (net/socket.c:1576)\n __sys_socket (net/socket.c:1671)\n ? __pfx___sys_socket (net/socket.c:1712)\n ? do_user_addr_fault (arch/x86/mm/fault.c:1419 (discriminator 1))\n __x64_sys_socket (net/socket.c:1728)\n do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1))\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nThat\u0027s because when the socket is initialised, rcu_read_lock() is not\nused despite the explicit comment written above the declaration of\nmptcp_sched_find() in sched.c. Adding the missing lock/unlock avoids the\nwarning."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:37:57.623Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb8b81ad3e893a6d18dcdd3754cc2ea2a42c0136"
},
{
"url": "https://git.kernel.org/stable/c/494eb22f9a7bd03783e60595a57611c209175f1a"
},
{
"url": "https://git.kernel.org/stable/c/3deb12c788c385e17142ce6ec50f769852fcec65"
}
],
"title": "mptcp: init: protect sched with rcu_read_lock",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53047",
"datePublished": "2024-11-19T17:19:34.036Z",
"dateReserved": "2024-11-19T17:17:24.973Z",
"dateUpdated": "2024-12-19T09:37:57.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53086
Vulnerability from cvelistv5
Published
2024-11-19 17:45
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL
Upon failure all locks need to be dropped before returning to the user.
(cherry picked from commit 7d1a4258e602ffdce529f56686925034c1b3b095)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_exec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96397b1e25dda8389dea63ec914038a170bf953d",
"status": "affected",
"version": "58480c1c912ff8146d067301a0d04cca318b4a66",
"versionType": "git"
},
{
"lessThan": "64a2b6ed4bfd890a0e91955dd8ef8422a3944ed9",
"status": "affected",
"version": "58480c1c912ff8146d067301a0d04cca318b4a66",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_exec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL\n\nUpon failure all locks need to be dropped before returning to the user.\n\n(cherry picked from commit 7d1a4258e602ffdce529f56686925034c1b3b095)"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:51.012Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96397b1e25dda8389dea63ec914038a170bf953d"
},
{
"url": "https://git.kernel.org/stable/c/64a2b6ed4bfd890a0e91955dd8ef8422a3944ed9"
}
],
"title": "drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53086",
"datePublished": "2024-11-19T17:45:14.846Z",
"dateReserved": "2024-11-19T17:17:24.980Z",
"dateUpdated": "2024-12-19T09:38:51.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53046
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:37
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: dts: imx8ulp: correct the flexspi compatible string
The flexspi on imx8ulp only has 16 LUTs, and imx8mm flexspi has
32 LUTs, so correct the compatible string here, otherwise will
meet below error:
[ 1.119072] ------------[ cut here ]------------
[ 1.123926] WARNING: CPU: 0 PID: 1 at drivers/spi/spi-nxp-fspi.c:855 nxp_fspi_exec_op+0xb04/0xb64
[ 1.133239] Modules linked in:
[ 1.136448] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-rc6-next-20240902-00001-g131bf9439dd9 #69
[ 1.146821] Hardware name: NXP i.MX8ULP EVK (DT)
[ 1.151647] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1.158931] pc : nxp_fspi_exec_op+0xb04/0xb64
[ 1.163496] lr : nxp_fspi_exec_op+0xa34/0xb64
[ 1.168060] sp : ffff80008002b2a0
[ 1.171526] x29: ffff80008002b2d0 x28: 0000000000000000 x27: 0000000000000000
[ 1.179002] x26: ffff2eb645542580 x25: ffff800080610014 x24: ffff800080610000
[ 1.186480] x23: ffff2eb645548080 x22: 0000000000000006 x21: ffff2eb6455425e0
[ 1.193956] x20: 0000000000000000 x19: ffff80008002b5e0 x18: ffffffffffffffff
[ 1.201432] x17: ffff2eb644467508 x16: 0000000000000138 x15: 0000000000000002
[ 1.208907] x14: 0000000000000000 x13: ffff2eb6400d8080 x12: 00000000ffffff00
[ 1.216378] x11: 0000000000000000 x10: ffff2eb6400d8080 x9 : ffff2eb697adca80
[ 1.223850] x8 : ffff2eb697ad3cc0 x7 : 0000000100000000 x6 : 0000000000000001
[ 1.231324] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000007a6
[ 1.238795] x2 : 0000000000000000 x1 : 00000000000001ce x0 : 00000000ffffff92
[ 1.246267] Call trace:
[ 1.248824] nxp_fspi_exec_op+0xb04/0xb64
[ 1.253031] spi_mem_exec_op+0x3a0/0x430
[ 1.257139] spi_nor_read_id+0x80/0xcc
[ 1.261065] spi_nor_scan+0x1ec/0xf10
[ 1.264901] spi_nor_probe+0x108/0x2fc
[ 1.268828] spi_mem_probe+0x6c/0xbc
[ 1.272574] spi_probe+0x84/0xe4
[ 1.275958] really_probe+0xbc/0x29c
[ 1.279713] __driver_probe_device+0x78/0x12c
[ 1.284277] driver_probe_device+0xd8/0x15c
[ 1.288660] __device_attach_driver+0xb8/0x134
[ 1.293316] bus_for_each_drv+0x88/0xe8
[ 1.297337] __device_attach+0xa0/0x190
[ 1.301353] device_initial_probe+0x14/0x20
[ 1.305734] bus_probe_device+0xac/0xb0
[ 1.309752] device_add+0x5d0/0x790
[ 1.313408] __spi_add_device+0x134/0x204
[ 1.317606] of_register_spi_device+0x3b4/0x590
[ 1.322348] spi_register_controller+0x47c/0x754
[ 1.327181] devm_spi_register_controller+0x4c/0xa4
[ 1.332289] nxp_fspi_probe+0x1cc/0x2b0
[ 1.336307] platform_probe+0x68/0xc4
[ 1.340145] really_probe+0xbc/0x29c
[ 1.343893] __driver_probe_device+0x78/0x12c
[ 1.348457] driver_probe_device+0xd8/0x15c
[ 1.352838] __driver_attach+0x90/0x19c
[ 1.356857] bus_for_each_dev+0x7c/0xdc
[ 1.360877] driver_attach+0x24/0x30
[ 1.364624] bus_add_driver+0xe4/0x208
[ 1.368552] driver_register+0x5c/0x124
[ 1.372573] __platform_driver_register+0x28/0x34
[ 1.377497] nxp_fspi_driver_init+0x1c/0x28
[ 1.381888] do_one_initcall+0x80/0x1c8
[ 1.385908] kernel_init_freeable+0x1c4/0x28c
[ 1.390472] kernel_init+0x20/0x1d8
[ 1.394138] ret_from_fork+0x10/0x20
[ 1.397885] ---[ end trace 0000000000000000 ]---
[ 1.407908] ------------[ cut here ]------------
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/boot/dts/freescale/imx8ulp.dtsi"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e3fb0e6afcc399660770428a35162b4880e2e14e",
"status": "affected",
"version": "ef89fd56bdfcf5d8039bb64c76d2f8c9ac908ca7",
"versionType": "git"
},
{
"lessThan": "c3c02fa6a560b3af7999a067cd387970f4b3f1fa",
"status": "affected",
"version": "ef89fd56bdfcf5d8039bb64c76d2f8c9ac908ca7",
"versionType": "git"
},
{
"lessThan": "409dc5196d5b6eb67468a06bf4d2d07d7225a67b",
"status": "affected",
"version": "ef89fd56bdfcf5d8039bb64c76d2f8c9ac908ca7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/boot/dts/freescale/imx8ulp.dtsi"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: imx8ulp: correct the flexspi compatible string\n\nThe flexspi on imx8ulp only has 16 LUTs, and imx8mm flexspi has\n32 LUTs, so correct the compatible string here, otherwise will\nmeet below error:\n\n[ 1.119072] ------------[ cut here ]------------\n[ 1.123926] WARNING: CPU: 0 PID: 1 at drivers/spi/spi-nxp-fspi.c:855 nxp_fspi_exec_op+0xb04/0xb64\n[ 1.133239] Modules linked in:\n[ 1.136448] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-rc6-next-20240902-00001-g131bf9439dd9 #69\n[ 1.146821] Hardware name: NXP i.MX8ULP EVK (DT)\n[ 1.151647] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 1.158931] pc : nxp_fspi_exec_op+0xb04/0xb64\n[ 1.163496] lr : nxp_fspi_exec_op+0xa34/0xb64\n[ 1.168060] sp : ffff80008002b2a0\n[ 1.171526] x29: ffff80008002b2d0 x28: 0000000000000000 x27: 0000000000000000\n[ 1.179002] x26: ffff2eb645542580 x25: ffff800080610014 x24: ffff800080610000\n[ 1.186480] x23: ffff2eb645548080 x22: 0000000000000006 x21: ffff2eb6455425e0\n[ 1.193956] x20: 0000000000000000 x19: ffff80008002b5e0 x18: ffffffffffffffff\n[ 1.201432] x17: ffff2eb644467508 x16: 0000000000000138 x15: 0000000000000002\n[ 1.208907] x14: 0000000000000000 x13: ffff2eb6400d8080 x12: 00000000ffffff00\n[ 1.216378] x11: 0000000000000000 x10: ffff2eb6400d8080 x9 : ffff2eb697adca80\n[ 1.223850] x8 : ffff2eb697ad3cc0 x7 : 0000000100000000 x6 : 0000000000000001\n[ 1.231324] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000007a6\n[ 1.238795] x2 : 0000000000000000 x1 : 00000000000001ce x0 : 00000000ffffff92\n[ 1.246267] Call trace:\n[ 1.248824] nxp_fspi_exec_op+0xb04/0xb64\n[ 1.253031] spi_mem_exec_op+0x3a0/0x430\n[ 1.257139] spi_nor_read_id+0x80/0xcc\n[ 1.261065] spi_nor_scan+0x1ec/0xf10\n[ 1.264901] spi_nor_probe+0x108/0x2fc\n[ 1.268828] spi_mem_probe+0x6c/0xbc\n[ 1.272574] spi_probe+0x84/0xe4\n[ 1.275958] really_probe+0xbc/0x29c\n[ 1.279713] __driver_probe_device+0x78/0x12c\n[ 1.284277] driver_probe_device+0xd8/0x15c\n[ 1.288660] __device_attach_driver+0xb8/0x134\n[ 1.293316] bus_for_each_drv+0x88/0xe8\n[ 1.297337] __device_attach+0xa0/0x190\n[ 1.301353] device_initial_probe+0x14/0x20\n[ 1.305734] bus_probe_device+0xac/0xb0\n[ 1.309752] device_add+0x5d0/0x790\n[ 1.313408] __spi_add_device+0x134/0x204\n[ 1.317606] of_register_spi_device+0x3b4/0x590\n[ 1.322348] spi_register_controller+0x47c/0x754\n[ 1.327181] devm_spi_register_controller+0x4c/0xa4\n[ 1.332289] nxp_fspi_probe+0x1cc/0x2b0\n[ 1.336307] platform_probe+0x68/0xc4\n[ 1.340145] really_probe+0xbc/0x29c\n[ 1.343893] __driver_probe_device+0x78/0x12c\n[ 1.348457] driver_probe_device+0xd8/0x15c\n[ 1.352838] __driver_attach+0x90/0x19c\n[ 1.356857] bus_for_each_dev+0x7c/0xdc\n[ 1.360877] driver_attach+0x24/0x30\n[ 1.364624] bus_add_driver+0xe4/0x208\n[ 1.368552] driver_register+0x5c/0x124\n[ 1.372573] __platform_driver_register+0x28/0x34\n[ 1.377497] nxp_fspi_driver_init+0x1c/0x28\n[ 1.381888] do_one_initcall+0x80/0x1c8\n[ 1.385908] kernel_init_freeable+0x1c4/0x28c\n[ 1.390472] kernel_init+0x20/0x1d8\n[ 1.394138] ret_from_fork+0x10/0x20\n[ 1.397885] ---[ end trace 0000000000000000 ]---\n[ 1.407908] ------------[ cut here ]------------"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:37:56.335Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e3fb0e6afcc399660770428a35162b4880e2e14e"
},
{
"url": "https://git.kernel.org/stable/c/c3c02fa6a560b3af7999a067cd387970f4b3f1fa"
},
{
"url": "https://git.kernel.org/stable/c/409dc5196d5b6eb67468a06bf4d2d07d7225a67b"
}
],
"title": "arm64: dts: imx8ulp: correct the flexspi compatible string",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53046",
"datePublished": "2024-11-19T17:19:33.348Z",
"dateReserved": "2024-11-19T17:17:24.972Z",
"dateUpdated": "2024-12-19T09:37:56.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53070
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: fix fault at system suspend if device was already runtime suspended
If the device was already runtime suspended then during system suspend
we cannot access the device registers else it will crash.
Also we cannot access any registers after dwc3_core_exit() on some
platforms so move the dwc3_enable_susphy() call to the top.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 073530898ebf44a9418434e899cfa9ca86945333 Version: 85ca88f93162acb94dbcb26d0ee2b145864d14a1 Version: 4fad7370086797afe6471493e3a5f36add8c48a7 Version: a690a9e38e6ba819789074388de7cff06425ef5b Version: 705e3ce37bccdf2ed6f848356ff355f480d51a91 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d9e65d461a9de037e7c9d584776d025cfce6d86d",
"status": "affected",
"version": "073530898ebf44a9418434e899cfa9ca86945333",
"versionType": "git"
},
{
"lessThan": "562804b1561cc248cc37746a1c96c83cab1d7209",
"status": "affected",
"version": "85ca88f93162acb94dbcb26d0ee2b145864d14a1",
"versionType": "git"
},
{
"lessThan": "4abc5ee334fe4aba50461c45fdaaa4c5e5c57789",
"status": "affected",
"version": "4fad7370086797afe6471493e3a5f36add8c48a7",
"versionType": "git"
},
{
"lessThan": "06b98197b69e2f2af9cb1991ee0b1c876edf7b86",
"status": "affected",
"version": "a690a9e38e6ba819789074388de7cff06425ef5b",
"versionType": "git"
},
{
"lessThan": "9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b",
"status": "affected",
"version": "705e3ce37bccdf2ed6f848356ff355f480d51a91",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5.15.172",
"status": "affected",
"version": "5.15.170",
"versionType": "semver"
},
{
"lessThan": "6.1.117",
"status": "affected",
"version": "6.1.115",
"versionType": "semver"
},
{
"lessThan": "6.6.61",
"status": "affected",
"version": "6.6.59",
"versionType": "semver"
},
{
"lessThan": "6.11.8",
"status": "affected",
"version": "6.11.5",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: fix fault at system suspend if device was already runtime suspended\n\nIf the device was already runtime suspended then during system suspend\nwe cannot access the device registers else it will crash.\n\nAlso we cannot access any registers after dwc3_core_exit() on some\nplatforms so move the dwc3_enable_susphy() call to the top."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:25.820Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d9e65d461a9de037e7c9d584776d025cfce6d86d"
},
{
"url": "https://git.kernel.org/stable/c/562804b1561cc248cc37746a1c96c83cab1d7209"
},
{
"url": "https://git.kernel.org/stable/c/4abc5ee334fe4aba50461c45fdaaa4c5e5c57789"
},
{
"url": "https://git.kernel.org/stable/c/06b98197b69e2f2af9cb1991ee0b1c876edf7b86"
},
{
"url": "https://git.kernel.org/stable/c/9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b"
}
],
"title": "usb: dwc3: fix fault at system suspend if device was already runtime suspended",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53070",
"datePublished": "2024-11-19T17:22:37.706Z",
"dateReserved": "2024-11-19T17:17:24.976Z",
"dateUpdated": "2024-12-19T09:38:25.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53045
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:37
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: dapm: fix bounds checker error in dapm_widget_list_create
The widgets array in the snd_soc_dapm_widget_list has a __counted_by
attribute attached to it, which points to the num_widgets variable. This
attribute is used in bounds checking, and if it is not set before the
array is filled, then the bounds sanitizer will issue a warning or a
kernel panic if CONFIG_UBSAN_TRAP is set.
This patch sets the size of the widgets list calculated with
list_for_each as the initial value for num_widgets as it is used for
allocating memory for the array. It is updated with the actual number of
added elements after the array is filled.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/soc-dapm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c549cb66e8de0ba1936fc97a59f0156741d3492a",
"status": "affected",
"version": "80e698e2df5ba2124bdeca37f1e589de58a4d514",
"versionType": "git"
},
{
"lessThan": "2ef9439f7a19fd3d43b288d38b1c6e55b668a4fe",
"status": "affected",
"version": "80e698e2df5ba2124bdeca37f1e589de58a4d514",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/soc-dapm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: dapm: fix bounds checker error in dapm_widget_list_create\n\nThe widgets array in the snd_soc_dapm_widget_list has a __counted_by\nattribute attached to it, which points to the num_widgets variable. This\nattribute is used in bounds checking, and if it is not set before the\narray is filled, then the bounds sanitizer will issue a warning or a\nkernel panic if CONFIG_UBSAN_TRAP is set.\n\nThis patch sets the size of the widgets list calculated with\nlist_for_each as the initial value for num_widgets as it is used for\nallocating memory for the array. It is updated with the actual number of\nadded elements after the array is filled."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:37:54.901Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c549cb66e8de0ba1936fc97a59f0156741d3492a"
},
{
"url": "https://git.kernel.org/stable/c/2ef9439f7a19fd3d43b288d38b1c6e55b668a4fe"
}
],
"title": "ASoC: dapm: fix bounds checker error in dapm_widget_list_create",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53045",
"datePublished": "2024-11-19T17:19:32.718Z",
"dateReserved": "2024-11-19T17:17:24.972Z",
"dateUpdated": "2024-12-19T09:37:54.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53042
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:37
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()
There are code paths from which the function is called without holding
the RCU read lock, resulting in a suspicious RCU usage warning [1].
Fix by using l3mdev_master_upper_ifindex_by_index() which will acquire
the RCU read lock before calling
l3mdev_master_upper_ifindex_by_index_rcu().
[1]
WARNING: suspicious RCU usage
6.12.0-rc3-custom-gac8f72681cf2 #141 Not tainted
-----------------------------
net/core/dev.c:876 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/361:
#0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60
stack backtrace:
CPU: 3 UID: 0 PID: 361 Comm: ip Not tainted 6.12.0-rc3-custom-gac8f72681cf2 #141
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl+0xba/0x110
lockdep_rcu_suspicious.cold+0x4f/0xd6
dev_get_by_index_rcu+0x1d3/0x210
l3mdev_master_upper_ifindex_by_index_rcu+0x2b/0xf0
ip_tunnel_bind_dev+0x72f/0xa00
ip_tunnel_newlink+0x368/0x7a0
ipgre_newlink+0x14c/0x170
__rtnl_newlink+0x1173/0x19c0
rtnl_newlink+0x6c/0xa0
rtnetlink_rcv_msg+0x3cc/0xf60
netlink_rcv_skb+0x171/0x450
netlink_unicast+0x539/0x7f0
netlink_sendmsg+0x8c1/0xd80
____sys_sendmsg+0x8f9/0xc20
___sys_sendmsg+0x197/0x1e0
__sys_sendmsg+0x122/0x1f0
do_syscall_64+0xbb/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: ab6c9463b137163ba53fc050bf2c72bed2c997b8 Version: 760852df570747e500a9632d34cbbf4faef30855 Version: db53cd3d88dc328dea2e968c9c8d3b4294a8a674 Version: db53cd3d88dc328dea2e968c9c8d3b4294a8a674 Version: db53cd3d88dc328dea2e968c9c8d3b4294a8a674 Version: db53cd3d88dc328dea2e968c9c8d3b4294a8a674 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip_tunnels.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e2742758c9c85c84e077ede5f916479f724e11c2",
"status": "affected",
"version": "ab6c9463b137163ba53fc050bf2c72bed2c997b8",
"versionType": "git"
},
{
"lessThan": "5edcb3fdb12c3d46a6e79eeeec27d925b80fc168",
"status": "affected",
"version": "760852df570747e500a9632d34cbbf4faef30855",
"versionType": "git"
},
{
"lessThan": "72c0f482e39c87317ebf67661e28c8d86c93e870",
"status": "affected",
"version": "db53cd3d88dc328dea2e968c9c8d3b4294a8a674",
"versionType": "git"
},
{
"lessThan": "699b48fc31727792edf2cab3829586ae6ba649e2",
"status": "affected",
"version": "db53cd3d88dc328dea2e968c9c8d3b4294a8a674",
"versionType": "git"
},
{
"lessThan": "6dfaa458fe923211c766238a224e0a3c0522935c",
"status": "affected",
"version": "db53cd3d88dc328dea2e968c9c8d3b4294a8a674",
"versionType": "git"
},
{
"lessThan": "ad4a3ca6a8e886f6491910a3ae5d53595e40597d",
"status": "affected",
"version": "db53cd3d88dc328dea2e968c9c8d3b4294a8a674",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip_tunnels.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.171",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()\n\nThere are code paths from which the function is called without holding\nthe RCU read lock, resulting in a suspicious RCU usage warning [1].\n\nFix by using l3mdev_master_upper_ifindex_by_index() which will acquire\nthe RCU read lock before calling\nl3mdev_master_upper_ifindex_by_index_rcu().\n\n[1]\nWARNING: suspicious RCU usage\n6.12.0-rc3-custom-gac8f72681cf2 #141 Not tainted\n-----------------------------\nnet/core/dev.c:876 RCU-list traversed in non-reader section!!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n1 lock held by ip/361:\n #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60\n\nstack backtrace:\nCPU: 3 UID: 0 PID: 361 Comm: ip Not tainted 6.12.0-rc3-custom-gac8f72681cf2 #141\nHardware name: Bochs Bochs, BIOS Bochs 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xba/0x110\n lockdep_rcu_suspicious.cold+0x4f/0xd6\n dev_get_by_index_rcu+0x1d3/0x210\n l3mdev_master_upper_ifindex_by_index_rcu+0x2b/0xf0\n ip_tunnel_bind_dev+0x72f/0xa00\n ip_tunnel_newlink+0x368/0x7a0\n ipgre_newlink+0x14c/0x170\n __rtnl_newlink+0x1173/0x19c0\n rtnl_newlink+0x6c/0xa0\n rtnetlink_rcv_msg+0x3cc/0xf60\n netlink_rcv_skb+0x171/0x450\n netlink_unicast+0x539/0x7f0\n netlink_sendmsg+0x8c1/0xd80\n ____sys_sendmsg+0x8f9/0xc20\n ___sys_sendmsg+0x197/0x1e0\n __sys_sendmsg+0x122/0x1f0\n do_syscall_64+0xbb/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f"
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:37:51.006Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e2742758c9c85c84e077ede5f916479f724e11c2"
},
{
"url": "https://git.kernel.org/stable/c/5edcb3fdb12c3d46a6e79eeeec27d925b80fc168"
},
{
"url": "https://git.kernel.org/stable/c/72c0f482e39c87317ebf67661e28c8d86c93e870"
},
{
"url": "https://git.kernel.org/stable/c/699b48fc31727792edf2cab3829586ae6ba649e2"
},
{
"url": "https://git.kernel.org/stable/c/6dfaa458fe923211c766238a224e0a3c0522935c"
},
{
"url": "https://git.kernel.org/stable/c/ad4a3ca6a8e886f6491910a3ae5d53595e40597d"
}
],
"title": "ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53042",
"datePublished": "2024-11-19T17:19:30.854Z",
"dateReserved": "2024-11-19T17:17:24.971Z",
"dateUpdated": "2024-12-19T09:37:51.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53056
Vulnerability from cvelistv5
Published
2024-11-19 17:19
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()
In mtk_crtc_create(), if the call to mbox_request_channel() fails then we
set the "mtk_crtc->cmdq_client.chan" pointer to NULL. In that situation,
we do not call cmdq_pkt_create().
During the cleanup, we need to check if the "mtk_crtc->cmdq_client.chan"
is NULL first before calling cmdq_pkt_destroy(). Calling
cmdq_pkt_destroy() is unnecessary if we didn't call cmdq_pkt_create() and
it will result in a NULL pointer dereference.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/mediatek/mtk_crtc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c60583a87cb4a85b69d1f448f0be5eb6ec62cbb2",
"status": "affected",
"version": "7627122fd1c06800a1fe624e9fb3c269796115e8",
"versionType": "git"
},
{
"lessThan": "4018651ba5c409034149f297d3dd3328b91561fd",
"status": "affected",
"version": "7627122fd1c06800a1fe624e9fb3c269796115e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/mediatek/mtk_crtc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()\n\nIn mtk_crtc_create(), if the call to mbox_request_channel() fails then we\nset the \"mtk_crtc-\u003ecmdq_client.chan\" pointer to NULL. In that situation,\nwe do not call cmdq_pkt_create().\n\nDuring the cleanup, we need to check if the \"mtk_crtc-\u003ecmdq_client.chan\"\nis NULL first before calling cmdq_pkt_destroy(). Calling\ncmdq_pkt_destroy() is unnecessary if we didn\u0027t call cmdq_pkt_create() and\nit will result in a NULL pointer dereference."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:07.819Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c60583a87cb4a85b69d1f448f0be5eb6ec62cbb2"
},
{
"url": "https://git.kernel.org/stable/c/4018651ba5c409034149f297d3dd3328b91561fd"
}
],
"title": "drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53056",
"datePublished": "2024-11-19T17:19:39.646Z",
"dateReserved": "2024-11-19T17:17:24.974Z",
"dateUpdated": "2024-12-19T09:38:07.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.