Action not permitted
Modal body text goes here.
Modal Title
Modal Body
wid-sec-w-2024-3756
Vulnerability from csaf_certbund
Published
2024-12-26 23:00
Modified
2025-01-19 23:00
Summary
Linux Kernel: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Zustand herbeizuführen, Daten zu manipulieren oder nicht näher spezifizierte Auswirkungen zu erzielen.
Betroffene Betriebssysteme
- Linux
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Der Kernel stellt den Kern des Linux Betriebssystems dar.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3756 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3756.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3756 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3756"
},
{
"category": "external",
"summary": "Kernel CVE Announce Mailingliste",
"url": "https://lore.kernel.org/linux-cve-announce/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53145",
"url": "https://lore.kernel.org/linux-cve-announce/2024122424-CVE-2024-53145-1a25@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53146",
"url": "https://lore.kernel.org/linux-cve-announce/2024122426-CVE-2024-53146-c503@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53147",
"url": "https://lore.kernel.org/linux-cve-announce/2024122426-CVE-2024-53147-bea5@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53148",
"url": "https://lore.kernel.org/linux-cve-announce/2024122426-CVE-2024-53148-2c24@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53149",
"url": "https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53149-8fe0@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53150",
"url": "https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53151",
"url": "https://lore.kernel.org/linux-cve-announce/2024122428-CVE-2024-53151-0e74@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53152",
"url": "https://lore.kernel.org/linux-cve-announce/2024122428-CVE-2024-53152-ada9@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53153",
"url": "https://lore.kernel.org/linux-cve-announce/2024122428-CVE-2024-53153-8c3a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53154",
"url": "https://lore.kernel.org/linux-cve-announce/2024122429-CVE-2024-53154-504f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53155",
"url": "https://lore.kernel.org/linux-cve-announce/2024122429-CVE-2024-53155-df38@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53156",
"url": "https://lore.kernel.org/linux-cve-announce/2024122429-CVE-2024-53156-732e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53157",
"url": "https://lore.kernel.org/linux-cve-announce/2024122430-CVE-2024-53157-6c40@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53158",
"url": "https://lore.kernel.org/linux-cve-announce/2024122430-CVE-2024-53158-9e9f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53159",
"url": "https://lore.kernel.org/linux-cve-announce/2024122430-CVE-2024-53159-f910@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53160",
"url": "https://lore.kernel.org/linux-cve-announce/2024122431-CVE-2024-53160-692f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53161",
"url": "https://lore.kernel.org/linux-cve-announce/2024122431-CVE-2024-53161-50f6@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53162",
"url": "https://lore.kernel.org/linux-cve-announce/2024122431-CVE-2024-53162-25cd@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2024-53163",
"url": "https://lore.kernel.org/linux-cve-announce/2024122432-CVE-2024-53163-05eb@gregkh/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:0117-1 vom 2025-01-15",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020131.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:0152-1 vom 2025-01-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020152.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:0154-1 vom 2025-01-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020151.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:0153-1 vom 2025-01-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020150.html"
}
],
"source_lang": "en-US",
"title": "Linux Kernel: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-01-19T23:00:00.000+00:00",
"generator": {
"date": "2025-01-20T09:18:26.045+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.10"
}
},
"id": "WID-SEC-W-2024-3756",
"initial_release_date": "2024-12-26T23:00:00.000+00:00",
"revision_history": [
{
"date": "2024-12-26T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-01-15T23:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-01-19T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von SUSE aufgenommen"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Open Source Linux Kernel",
"product": {
"name": "Open Source Linux Kernel",
"product_id": "T008144",
"product_identification_helper": {
"cpe": "cpe:/a:linux:linux_kernel:-"
}
}
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-53145",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53145"
},
{
"cve": "CVE-2024-53146",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53146"
},
{
"cve": "CVE-2024-53147",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53147"
},
{
"cve": "CVE-2024-53148",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53148"
},
{
"cve": "CVE-2024-53149",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53149"
},
{
"cve": "CVE-2024-53150",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53150"
},
{
"cve": "CVE-2024-53151",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53151"
},
{
"cve": "CVE-2024-53152",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53152"
},
{
"cve": "CVE-2024-53153",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53153"
},
{
"cve": "CVE-2024-53154",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53154"
},
{
"cve": "CVE-2024-53155",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53155"
},
{
"cve": "CVE-2024-53156",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53156"
},
{
"cve": "CVE-2024-53157",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53157"
},
{
"cve": "CVE-2024-53158",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53158"
},
{
"cve": "CVE-2024-53159",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53159"
},
{
"cve": "CVE-2024-53160",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53160"
},
{
"cve": "CVE-2024-53161",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53161"
},
{
"cve": "CVE-2024-53162",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53162"
},
{
"cve": "CVE-2024-53163",
"notes": [
{
"category": "description",
"text": "Im Linux Kernel existieren mehrere Schwachstellen. Zu den Ursachen geh\u00f6ren zahlreiche Fehler in der Speicherverwaltung wie z.B. Buffer Overflows, sowie fehlende Pr\u00fcfungen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Daten zu manipulieren oder nicht n\u00e4her spezifizierte Auswirkungen zu erzielen."
}
],
"product_status": {
"known_affected": [
"T002207",
"T008144"
]
},
"release_date": "2024-12-26T23:00:00.000+00:00",
"title": "CVE-2024-53163"
}
]
}
cve-2024-53156
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:20
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
I found the following bug in my fuzzer:
UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51
index 255 is out of range for type 'htc_endpoint [22]'
CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: events request_firmware_work_func
Call Trace:
<TASK>
dump_stack_lvl+0x180/0x1b0
__ubsan_handle_out_of_bounds+0xd4/0x130
htc_issue_send.constprop.0+0x20c/0x230
? _raw_spin_unlock_irqrestore+0x3c/0x70
ath9k_wmi_cmd+0x41d/0x610
? mark_held_locks+0x9f/0xe0
...
Since this bug has been confirmed to be caused by insufficient verification
of conn_rsp_epid, I think it would be appropriate to add a range check for
conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: fb9987d0f748c983bb795a86f47522313f701a08 Version: fb9987d0f748c983bb795a86f47522313f701a08 Version: fb9987d0f748c983bb795a86f47522313f701a08 Version: fb9987d0f748c983bb795a86f47522313f701a08 Version: fb9987d0f748c983bb795a86f47522313f701a08 Version: fb9987d0f748c983bb795a86f47522313f701a08 Version: fb9987d0f748c983bb795a86f47522313f701a08 Version: fb9987d0f748c983bb795a86f47522313f701a08 Version: fb9987d0f748c983bb795a86f47522313f701a08 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath9k/htc_hst.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5f177fb9d01355ac183e65ad8909ea8ef734e0cf",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
},
{
"lessThan": "cb480ae80fd4d0f1ac9e107ce799183beee5124b",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
},
{
"lessThan": "c941af142200d975dd3be632aeb490f4cb91dae4",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
},
{
"lessThan": "8965db7fe2e913ee0802b05fc94c6d6aa74e0596",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
},
{
"lessThan": "70eae50d2156cb6e078d0d78809b49bf2f4c7540",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
},
{
"lessThan": "b6551479daf2bfa80bfd5d9016b02a810e508bfb",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
},
{
"lessThan": "3fe99b9690b99606d3743c9961ebee865cfa1ab8",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
},
{
"lessThan": "bc981179ab5d1a2715f35e3db4e4bb822bacc849",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
},
{
"lessThan": "8619593634cbdf5abf43f5714df49b04e4ef09ab",
"status": "affected",
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath9k/htc_hst.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()\n\nI found the following bug in my fuzzer:\n\n UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51\n index 255 is out of range for type \u0027htc_endpoint [22]\u0027\n CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Workqueue: events request_firmware_work_func\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x180/0x1b0\n __ubsan_handle_out_of_bounds+0xd4/0x130\n htc_issue_send.constprop.0+0x20c/0x230\n ? _raw_spin_unlock_irqrestore+0x3c/0x70\n ath9k_wmi_cmd+0x41d/0x610\n ? mark_held_locks+0x9f/0xe0\n ...\n\nSince this bug has been confirmed to be caused by insufficient verification\nof conn_rsp_epid, I think it would be appropriate to add a range check for\nconn_rsp_epid to htc_connect_service() to prevent the bug from occurring."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:20:00.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5f177fb9d01355ac183e65ad8909ea8ef734e0cf"
},
{
"url": "https://git.kernel.org/stable/c/cb480ae80fd4d0f1ac9e107ce799183beee5124b"
},
{
"url": "https://git.kernel.org/stable/c/c941af142200d975dd3be632aeb490f4cb91dae4"
},
{
"url": "https://git.kernel.org/stable/c/8965db7fe2e913ee0802b05fc94c6d6aa74e0596"
},
{
"url": "https://git.kernel.org/stable/c/70eae50d2156cb6e078d0d78809b49bf2f4c7540"
},
{
"url": "https://git.kernel.org/stable/c/b6551479daf2bfa80bfd5d9016b02a810e508bfb"
},
{
"url": "https://git.kernel.org/stable/c/3fe99b9690b99606d3743c9961ebee865cfa1ab8"
},
{
"url": "https://git.kernel.org/stable/c/bc981179ab5d1a2715f35e3db4e4bb822bacc849"
},
{
"url": "https://git.kernel.org/stable/c/8619593634cbdf5abf43f5714df49b04e4ef09ab"
}
],
"title": "wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53156",
"datePublished": "2024-12-24T11:28:55.275Z",
"dateReserved": "2024-11-19T17:17:25.001Z",
"dateUpdated": "2025-01-20T06:20:00.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53161
Vulnerability from cvelistv5
Published
2024-12-24 11:29
Modified
2025-01-20 06:20
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
EDAC/bluefield: Fix potential integer overflow
The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx
left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as
32-bits wide the left-shift operation truncates the upper 16 bits of
information during the calculation of the SMC argument.
The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any
potential integer overflow, i.e. loss of data from upper 16 bits.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 82413e562ea6eadfb6de946dcc6f74af31d64e7f Version: 82413e562ea6eadfb6de946dcc6f74af31d64e7f Version: 82413e562ea6eadfb6de946dcc6f74af31d64e7f Version: 82413e562ea6eadfb6de946dcc6f74af31d64e7f Version: 82413e562ea6eadfb6de946dcc6f74af31d64e7f Version: 82413e562ea6eadfb6de946dcc6f74af31d64e7f Version: 82413e562ea6eadfb6de946dcc6f74af31d64e7f Version: 82413e562ea6eadfb6de946dcc6f74af31d64e7f |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/edac/bluefield_edac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8cc31cfa36ff37aff399b72faa2ded58110112ae",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "e0269ea7a628fdeddd65b92fe29c09655dbb80b9",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "4ad7033de109d0fec99086f352f58a3412e378b8",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "578ca89b04680145d41011e7cec8806fefbb59e7",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "ac6ebb9edcdb7077e841862c402697c4c48a7c0a",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "fdb90006184aa84c7b4e09144ed0936d4e1891a7",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "000930193fe5eb79ce5563ee2e9ddb0c6e4e1bb5",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "1fe774a93b46bb029b8f6fa9d1f25affa53f06c6",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/edac/bluefield_edac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/bluefield: Fix potential integer overflow\n\nThe 64-bit argument for the \"get DIMM info\" SMC call consists of mem_ctrl_idx\nleft-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as\n32-bits wide the left-shift operation truncates the upper 16 bits of\ninformation during the calculation of the SMC argument.\n\nThe mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any\npotential integer overflow, i.e. loss of data from upper 16 bits."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:20:05.345Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8cc31cfa36ff37aff399b72faa2ded58110112ae"
},
{
"url": "https://git.kernel.org/stable/c/e0269ea7a628fdeddd65b92fe29c09655dbb80b9"
},
{
"url": "https://git.kernel.org/stable/c/4ad7033de109d0fec99086f352f58a3412e378b8"
},
{
"url": "https://git.kernel.org/stable/c/578ca89b04680145d41011e7cec8806fefbb59e7"
},
{
"url": "https://git.kernel.org/stable/c/ac6ebb9edcdb7077e841862c402697c4c48a7c0a"
},
{
"url": "https://git.kernel.org/stable/c/fdb90006184aa84c7b4e09144ed0936d4e1891a7"
},
{
"url": "https://git.kernel.org/stable/c/000930193fe5eb79ce5563ee2e9ddb0c6e4e1bb5"
},
{
"url": "https://git.kernel.org/stable/c/1fe774a93b46bb029b8f6fa9d1f25affa53f06c6"
}
],
"title": "EDAC/bluefield: Fix potential integer overflow",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53161",
"datePublished": "2024-12-24T11:29:01.938Z",
"dateReserved": "2024-11-19T17:17:25.002Z",
"dateUpdated": "2025-01-20T06:20:05.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53151
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Address an integer overflow
Dan Carpenter reports:
> Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data
> structure") from Jun 22, 2020 (linux-next), leads to the following
> Smatch static checker warning:
>
> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()
> warn: potential user controlled sizeof overflow 'segcount * 4 * 4'
>
> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
> 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
> 489 {
> 490 u32 segcount;
> 491 __be32 *p;
> 492
> 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
> ^^^^^^^^
>
> 494 return false;
> 495
> 496 /* A bogus segcount causes this buffer overflow check to fail. */
> 497 p = xdr_inline_decode(&rctxt->rc_stream,
> --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p));
>
>
> segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will
> have an integer overflow and some those values will be accepted by
> xdr_inline_decode().
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 Version: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 Version: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 Version: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 Version: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 Version: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "c1f8195bf68edd2cef0f18a4cead394075a54b5a",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "838dd342962cef4c320632a5af48d3c31f2f9877",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "4cbc3ba6dc2f746497cade60bcbaa82ae3696689",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "e5c440c227ecdc721f2da0dd88b6358afd1031a7",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "3c63d8946e578663b868cb9912dac616ea68bfd0",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Address an integer overflow\n\nDan Carpenter reports:\n\u003e Commit 78147ca8b4a9 (\"svcrdma: Add a \"parsed chunk list\" data\n\u003e structure\") from Jun 22, 2020 (linux-next), leads to the following\n\u003e Smatch static checker warning:\n\u003e\n\u003e\tnet/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()\n\u003e\twarn: potential user controlled sizeof overflow \u0027segcount * 4 * 4\u0027\n\u003e\n\u003e net/sunrpc/xprtrdma/svc_rdma_recvfrom.c\n\u003e 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)\n\u003e 489 {\n\u003e 490 u32 segcount;\n\u003e 491 __be32 *p;\n\u003e 492\n\u003e 493 if (xdr_stream_decode_u32(\u0026rctxt-\u003erc_stream, \u0026segcount))\n\u003e ^^^^^^^^\n\u003e\n\u003e 494 return false;\n\u003e 495\n\u003e 496 /* A bogus segcount causes this buffer overflow check to fail. */\n\u003e 497 p = xdr_inline_decode(\u0026rctxt-\u003erc_stream,\n\u003e --\u003e 498 segcount * rpcrdma_segment_maxsz * sizeof(*p));\n\u003e\n\u003e\n\u003e segcount is an untrusted u32. On 32bit systems anything \u003e= SIZE_MAX / 16 will\n\u003e have an integer overflow and some those values will be accepted by\n\u003e xdr_inline_decode()."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:49.245Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b"
},
{
"url": "https://git.kernel.org/stable/c/c1f8195bf68edd2cef0f18a4cead394075a54b5a"
},
{
"url": "https://git.kernel.org/stable/c/838dd342962cef4c320632a5af48d3c31f2f9877"
},
{
"url": "https://git.kernel.org/stable/c/4cbc3ba6dc2f746497cade60bcbaa82ae3696689"
},
{
"url": "https://git.kernel.org/stable/c/e5c440c227ecdc721f2da0dd88b6358afd1031a7"
},
{
"url": "https://git.kernel.org/stable/c/3c63d8946e578663b868cb9912dac616ea68bfd0"
}
],
"title": "svcrdma: Address an integer overflow",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53151",
"datePublished": "2024-12-24T11:28:50.917Z",
"dateReserved": "2024-11-19T17:17:25.000Z",
"dateUpdated": "2025-01-20T06:19:49.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53155
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
Syzbot has reported the following KMSAN splat:
BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80
ocfs2_file_read_iter+0x9a4/0xf80
__io_read+0x8d4/0x20f0
io_read+0x3e/0xf0
io_issue_sqe+0x42b/0x22c0
io_wq_submit_work+0xaf9/0xdc0
io_worker_handle_work+0xd13/0x2110
io_wq_worker+0x447/0x1410
ret_from_fork+0x6f/0x90
ret_from_fork_asm+0x1a/0x30
Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00
alloc_pages_mpol_noprof+0x299/0x990
alloc_pages_noprof+0x1bf/0x1e0
allocate_slab+0x33a/0x1250
___slab_alloc+0x12ef/0x35e0
kmem_cache_alloc_bulk_noprof+0x486/0x1330
__io_alloc_req_refill+0x84/0x560
io_submit_sqes+0x172f/0x2f30
__se_sys_io_uring_enter+0x406/0x41c0
__x64_sys_io_uring_enter+0x11f/0x1a0
x64_sys_call+0x2b54/0x3ba0
do_syscall_64+0xcd/0x1e0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Since an instance of 'struct kiocb' may be passed from the block layer
with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()'
and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in
'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e Version: 7cdfc3a1c3971c9125c317cb8c2525745851798e |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/aops.h",
"fs/ocfs2/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c8f8d1e595dabd5389817f6d798cc8bd95c40ab",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
},
{
"lessThan": "f4078ef38d3163e6be47403a619558b19c4bfccd",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
},
{
"lessThan": "66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
},
{
"lessThan": "8c966150d5abff58c3c2bdb9a6e63fd773782905",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
},
{
"lessThan": "83f8713a0ef1d55d6a287bcfadcaab8245ac5098",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
},
{
"lessThan": "8e0de82ed18ba0e71f817adbd81317fd1032ca5a",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
},
{
"lessThan": "366c933c2ab34dd6551acc03b4872726b7605143",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
},
{
"lessThan": "dc78efe556fed162d48736ef24066f42e463e27c",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
},
{
"lessThan": "adc77b19f62d7e80f98400b2fca9d700d2afdd6f",
"status": "affected",
"version": "7cdfc3a1c3971c9125c317cb8c2525745851798e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/aops.h",
"fs/ocfs2/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix uninitialized value in ocfs2_file_read_iter()\n\nSyzbot has reported the following KMSAN splat:\n\nBUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80\n ocfs2_file_read_iter+0x9a4/0xf80\n __io_read+0x8d4/0x20f0\n io_read+0x3e/0xf0\n io_issue_sqe+0x42b/0x22c0\n io_wq_submit_work+0xaf9/0xdc0\n io_worker_handle_work+0xd13/0x2110\n io_wq_worker+0x447/0x1410\n ret_from_fork+0x6f/0x90\n ret_from_fork_asm+0x1a/0x30\n\nUninit was created at:\n __alloc_pages_noprof+0x9a7/0xe00\n alloc_pages_mpol_noprof+0x299/0x990\n alloc_pages_noprof+0x1bf/0x1e0\n allocate_slab+0x33a/0x1250\n ___slab_alloc+0x12ef/0x35e0\n kmem_cache_alloc_bulk_noprof+0x486/0x1330\n __io_alloc_req_refill+0x84/0x560\n io_submit_sqes+0x172f/0x2f30\n __se_sys_io_uring_enter+0x406/0x41c0\n __x64_sys_io_uring_enter+0x11f/0x1a0\n x64_sys_call+0x2b54/0x3ba0\n do_syscall_64+0xcd/0x1e0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nSince an instance of \u0027struct kiocb\u0027 may be passed from the block layer\nwith \u0027private\u0027 field uninitialized, introduce \u0027ocfs2_iocb_init_rw_locked()\u0027\nand use it from where \u0027ocfs2_dio_end_io()\u0027 might take care, i.e. in\n\u0027ocfs2_file_read_iter()\u0027 and \u0027ocfs2_file_write_iter()\u0027."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:59.229Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c8f8d1e595dabd5389817f6d798cc8bd95c40ab"
},
{
"url": "https://git.kernel.org/stable/c/f4078ef38d3163e6be47403a619558b19c4bfccd"
},
{
"url": "https://git.kernel.org/stable/c/66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f"
},
{
"url": "https://git.kernel.org/stable/c/8c966150d5abff58c3c2bdb9a6e63fd773782905"
},
{
"url": "https://git.kernel.org/stable/c/83f8713a0ef1d55d6a287bcfadcaab8245ac5098"
},
{
"url": "https://git.kernel.org/stable/c/8e0de82ed18ba0e71f817adbd81317fd1032ca5a"
},
{
"url": "https://git.kernel.org/stable/c/366c933c2ab34dd6551acc03b4872726b7605143"
},
{
"url": "https://git.kernel.org/stable/c/dc78efe556fed162d48736ef24066f42e463e27c"
},
{
"url": "https://git.kernel.org/stable/c/adc77b19f62d7e80f98400b2fca9d700d2afdd6f"
}
],
"title": "ocfs2: fix uninitialized value in ocfs2_file_read_iter()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53155",
"datePublished": "2024-12-24T11:28:54.241Z",
"dateReserved": "2024-11-19T17:17:25.001Z",
"dateUpdated": "2025-01-20T06:19:59.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53158
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:20
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
This loop is supposed to break if the frequency returned from
clk_round_rate() is the same as on the previous iteration. However,
that check doesn't make sense on the first iteration through the loop.
It leads to reading before the start of these->clk_perf_tbl[] array.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a Version: eddac5af06546d2e7a0730e3dc02dde3dc91098a |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/qcom/qcom-geni-se.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "37cdd4f0c266560b7b924c42361eeae3dc5f0c3e",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
},
{
"lessThan": "7a3465b79ef0539aa10b310ac3cc35e0ae25b79e",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
},
{
"lessThan": "748557ca7dc94695a6e209eb68fce365da9a3bb3",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
},
{
"lessThan": "f4b7bf5a50f1fa25560f0b66a13563465542861b",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
},
{
"lessThan": "b0a9c6ccaf88c4701787f61ecd2ec0eb014a0677",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
},
{
"lessThan": "c24e019ca12d9ec814af04b30a64dd7173fb20fe",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
},
{
"lessThan": "56eda41dcce0ec4d3418b4f85037bdea181486cc",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
},
{
"lessThan": "351bb7f9ecb9d1f09bd7767491a2b8d07f4f1ea4",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
},
{
"lessThan": "78261cb08f06c93d362cab5c5034bf5899bc7552",
"status": "affected",
"version": "eddac5af06546d2e7a0730e3dc02dde3dc91098a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/qcom/qcom-geni-se.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()\n\nThis loop is supposed to break if the frequency returned from\nclk_round_rate() is the same as on the previous iteration. However,\nthat check doesn\u0027t make sense on the first iteration through the loop.\nIt leads to reading before the start of these-\u003eclk_perf_tbl[] array."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:20:02.912Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/37cdd4f0c266560b7b924c42361eeae3dc5f0c3e"
},
{
"url": "https://git.kernel.org/stable/c/7a3465b79ef0539aa10b310ac3cc35e0ae25b79e"
},
{
"url": "https://git.kernel.org/stable/c/748557ca7dc94695a6e209eb68fce365da9a3bb3"
},
{
"url": "https://git.kernel.org/stable/c/f4b7bf5a50f1fa25560f0b66a13563465542861b"
},
{
"url": "https://git.kernel.org/stable/c/b0a9c6ccaf88c4701787f61ecd2ec0eb014a0677"
},
{
"url": "https://git.kernel.org/stable/c/c24e019ca12d9ec814af04b30a64dd7173fb20fe"
},
{
"url": "https://git.kernel.org/stable/c/56eda41dcce0ec4d3418b4f85037bdea181486cc"
},
{
"url": "https://git.kernel.org/stable/c/351bb7f9ecb9d1f09bd7767491a2b8d07f4f1ea4"
},
{
"url": "https://git.kernel.org/stable/c/78261cb08f06c93d362cab5c5034bf5899bc7552"
}
],
"title": "soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53158",
"datePublished": "2024-12-24T11:28:57.160Z",
"dateReserved": "2024-11-19T17:17:25.001Z",
"dateUpdated": "2025-01-20T06:20:02.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53160
Vulnerability from cvelistv5
Published
2024-12-24 11:29
Modified
2025-01-20 06:20
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
KCSAN reports a data race when access the krcp->monitor_work.timer.expires
variable in the schedule_delayed_monitor_work() function:
<snip>
BUG: KCSAN: data-race in __mod_timer / kvfree_call_rcu
read to 0xffff888237d1cce8 of 8 bytes by task 10149 on cpu 1:
schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline]
kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839
trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441
bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203
generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849
bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143
__sys_bpf+0x2e5/0x7a0
__do_sys_bpf kernel/bpf/syscall.c:5741 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5739 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739
x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
write to 0xffff888237d1cce8 of 8 bytes by task 56 on cpu 0:
__mod_timer+0x578/0x7f0 kernel/time/timer.c:1173
add_timer_global+0x51/0x70 kernel/time/timer.c:1330
__queue_delayed_work+0x127/0x1a0 kernel/workqueue.c:2523
queue_delayed_work_on+0xdf/0x190 kernel/workqueue.c:2552
queue_delayed_work include/linux/workqueue.h:677 [inline]
schedule_delayed_monitor_work kernel/rcu/tree.c:3525 [inline]
kfree_rcu_monitor+0x5e8/0x660 kernel/rcu/tree.c:3643
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310
worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391
kthread+0x1d1/0x210 kernel/kthread.c:389
ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 56 Comm: kworker/u8:4 Not tainted 6.12.0-rc2-syzkaller-00050-g5b7c893ed5ed #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_unbound kfree_rcu_monitor
<snip>
kfree_rcu_monitor() rearms the work if a "krcp" has to be still
offloaded and this is done without holding krcp->lock, whereas
the kvfree_call_rcu() holds it.
Fix it by acquiring the "krcp->lock" for kfree_rcu_monitor() so
both functions do not race anymore.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/rcu/tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "967a0e61910825d1fad009d836a6cb41f7402395",
"status": "affected",
"version": "8fc5494ad5face62747a3937db66b00db1e5d80b",
"versionType": "git"
},
{
"lessThan": "05b8ea1f16667f07c8e5843fb4bde3e49d49ead8",
"status": "affected",
"version": "8fc5494ad5face62747a3937db66b00db1e5d80b",
"versionType": "git"
},
{
"lessThan": "5ced426d97ce84299ecfcc7bd8b38f975fd11089",
"status": "affected",
"version": "8fc5494ad5face62747a3937db66b00db1e5d80b",
"versionType": "git"
},
{
"lessThan": "a23da88c6c80e41e0503e0b481a22c9eea63f263",
"status": "affected",
"version": "8fc5494ad5face62747a3937db66b00db1e5d80b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/rcu/tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu\n\nKCSAN reports a data race when access the krcp-\u003emonitor_work.timer.expires\nvariable in the schedule_delayed_monitor_work() function:\n\n\u003csnip\u003e\nBUG: KCSAN: data-race in __mod_timer / kvfree_call_rcu\n\nread to 0xffff888237d1cce8 of 8 bytes by task 10149 on cpu 1:\n schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline]\n kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839\n trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441\n bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203\n generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849\n bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143\n __sys_bpf+0x2e5/0x7a0\n __do_sys_bpf kernel/bpf/syscall.c:5741 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5739 [inline]\n __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739\n x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nwrite to 0xffff888237d1cce8 of 8 bytes by task 56 on cpu 0:\n __mod_timer+0x578/0x7f0 kernel/time/timer.c:1173\n add_timer_global+0x51/0x70 kernel/time/timer.c:1330\n __queue_delayed_work+0x127/0x1a0 kernel/workqueue.c:2523\n queue_delayed_work_on+0xdf/0x190 kernel/workqueue.c:2552\n queue_delayed_work include/linux/workqueue.h:677 [inline]\n schedule_delayed_monitor_work kernel/rcu/tree.c:3525 [inline]\n kfree_rcu_monitor+0x5e8/0x660 kernel/rcu/tree.c:3643\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310\n worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391\n kthread+0x1d1/0x210 kernel/kthread.c:389\n ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 UID: 0 PID: 56 Comm: kworker/u8:4 Not tainted 6.12.0-rc2-syzkaller-00050-g5b7c893ed5ed #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: events_unbound kfree_rcu_monitor\n\u003csnip\u003e\n\nkfree_rcu_monitor() rearms the work if a \"krcp\" has to be still\noffloaded and this is done without holding krcp-\u003elock, whereas\nthe kvfree_call_rcu() holds it.\n\nFix it by acquiring the \"krcp-\u003elock\" for kfree_rcu_monitor() so\nboth functions do not race anymore."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:20:04.058Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/967a0e61910825d1fad009d836a6cb41f7402395"
},
{
"url": "https://git.kernel.org/stable/c/05b8ea1f16667f07c8e5843fb4bde3e49d49ead8"
},
{
"url": "https://git.kernel.org/stable/c/5ced426d97ce84299ecfcc7bd8b38f975fd11089"
},
{
"url": "https://git.kernel.org/stable/c/a23da88c6c80e41e0503e0b481a22c9eea63f263"
}
],
"title": "rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53160",
"datePublished": "2024-12-24T11:29:00.964Z",
"dateReserved": "2024-11-19T17:17:25.002Z",
"dateUpdated": "2025-01-20T06:20:04.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53163
Vulnerability from cvelistv5
Published
2024-12-24 11:29
Modified
2025-01-20 06:20
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat/qat_420xx - fix off by one in uof_get_name()
This is called from uof_get_name_420xx() where "num_objs" is the
ARRAY_SIZE() of fw_objs[]. The > needs to be >= to prevent an out of
bounds access.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c23661a36eea840b657e485d48ed88b246da1bb8",
"status": "affected",
"version": "fcf60f4bcf54952cc14d14178c358be222dbeb43",
"versionType": "git"
},
{
"lessThan": "91eef1ad75f03d37dba926b73f9dd6f058bc4d58",
"status": "affected",
"version": "fcf60f4bcf54952cc14d14178c358be222dbeb43",
"versionType": "git"
},
{
"lessThan": "93a11608fb3720e1bc2b19a2649ac2b49cca1921",
"status": "affected",
"version": "fcf60f4bcf54952cc14d14178c358be222dbeb43",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat/qat_420xx - fix off by one in uof_get_name()\n\nThis is called from uof_get_name_420xx() where \"num_objs\" is the\nARRAY_SIZE() of fw_objs[]. The \u003e needs to be \u003e= to prevent an out of\nbounds access."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:20:12.833Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c23661a36eea840b657e485d48ed88b246da1bb8"
},
{
"url": "https://git.kernel.org/stable/c/91eef1ad75f03d37dba926b73f9dd6f058bc4d58"
},
{
"url": "https://git.kernel.org/stable/c/93a11608fb3720e1bc2b19a2649ac2b49cca1921"
}
],
"title": "crypto: qat/qat_420xx - fix off by one in uof_get_name()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53163",
"datePublished": "2024-12-24T11:29:19.315Z",
"dateReserved": "2024-11-19T17:17:25.004Z",
"dateUpdated": "2025-01-20T06:20:12.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53152
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()
Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF
deinit notify function pci_epc_deinit_notify() are called during the
execution of pex_ep_event_pex_rst_assert() i.e., when the host has asserted
PERST#. But quickly after this step, refclk will also be disabled by the
host.
All of the tegra194 endpoint SoCs supported as of now depend on the refclk
from the host for keeping the controller operational. Due to this
limitation, any access to the hardware registers in the absence of refclk
will result in a whole endpoint crash. Unfortunately, most of the
controller cleanups require accessing the hardware registers (like eDMA
cleanup performed in dw_pcie_ep_cleanup(), etc...). So these cleanup
functions can cause the crash in the endpoint SoC once host asserts PERST#.
One way to address this issue is by generating the refclk in the endpoint
itself and not depending on the host. But that is not always possible as
some of the endpoint designs do require the endpoint to consume refclk from
the host.
Thus, fix this crash by moving the controller cleanups to the start of
the pex_ep_event_pex_rst_deassert() function. This function is called
whenever the host has deasserted PERST# and it is guaranteed that the
refclk would be active at this point. So at the start of this function
(after enabling resources) the controller cleanup can be performed. Once
finished, rest of the code execution for PERST# deassert can continue as
usual.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/dwc/pcie-tegra194.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "70212c2300971506e986d95000d2745529cac9d7",
"status": "affected",
"version": "570d7715eed8a29ac5bd96c7694f060a991e5a31",
"versionType": "git"
},
{
"lessThan": "72034050ccf4202cd6558b0afd2474f756ea3b9b",
"status": "affected",
"version": "570d7715eed8a29ac5bd96c7694f060a991e5a31",
"versionType": "git"
},
{
"lessThan": "40e2125381dc11379112485e3eefdd25c6df5375",
"status": "affected",
"version": "570d7715eed8a29ac5bd96c7694f060a991e5a31",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/dwc/pcie-tegra194.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()\n\nCurrently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF\ndeinit notify function pci_epc_deinit_notify() are called during the\nexecution of pex_ep_event_pex_rst_assert() i.e., when the host has asserted\nPERST#. But quickly after this step, refclk will also be disabled by the\nhost.\n\nAll of the tegra194 endpoint SoCs supported as of now depend on the refclk\nfrom the host for keeping the controller operational. Due to this\nlimitation, any access to the hardware registers in the absence of refclk\nwill result in a whole endpoint crash. Unfortunately, most of the\ncontroller cleanups require accessing the hardware registers (like eDMA\ncleanup performed in dw_pcie_ep_cleanup(), etc...). So these cleanup\nfunctions can cause the crash in the endpoint SoC once host asserts PERST#.\n\nOne way to address this issue is by generating the refclk in the endpoint\nitself and not depending on the host. But that is not always possible as\nsome of the endpoint designs do require the endpoint to consume refclk from\nthe host.\n\nThus, fix this crash by moving the controller cleanups to the start of\nthe pex_ep_event_pex_rst_deassert() function. This function is called\nwhenever the host has deasserted PERST# and it is guaranteed that the\nrefclk would be active at this point. So at the start of this function\n(after enabling resources) the controller cleanup can be performed. Once\nfinished, rest of the code execution for PERST# deassert can continue as\nusual."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:50.383Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/70212c2300971506e986d95000d2745529cac9d7"
},
{
"url": "https://git.kernel.org/stable/c/72034050ccf4202cd6558b0afd2474f756ea3b9b"
},
{
"url": "https://git.kernel.org/stable/c/40e2125381dc11379112485e3eefdd25c6df5375"
}
],
"title": "PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53152",
"datePublished": "2024-12-24T11:28:51.610Z",
"dateReserved": "2024-11-19T17:17:25.000Z",
"dateUpdated": "2025-01-20T06:19:50.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53157
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:20
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
Fix a kernel crash with the below call trace when the SCPI firmware
returns OPP count of zero.
dvfs_info.opp_count may be zero on some platforms during the reboot
test, and the kernel will crash after dereferencing the pointer to
kcalloc(info->count, sizeof(*opp), GFP_KERNEL).
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
| Mem abort info:
| ESR = 0x96000004
| Exception class = DABT (current EL), IL = 32 bits
| SET = 0, FnV = 0
| EA = 0, S1PTW = 0
| Data abort info:
| ISV = 0, ISS = 0x00000004
| CM = 0, WnR = 0
| user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c
| [0000000000000028] pgd=0000000000000000
| Internal error: Oops: 96000004 [#1] SMP
| scpi-hwmon: probe of PHYT000D:00 failed with error -110
| Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c)
| CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1
| Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS
| pstate: 60000005 (nZCv daif -PAN -UAO)
| pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
| lr : clk_register+0x438/0x720
| Call trace:
| scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
| devm_clk_hw_register+0x50/0xa0
| scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi]
| scpi_clocks_probe+0x528/0x70c [clk_scpi]
| platform_drv_probe+0x58/0xa8
| really_probe+0x260/0x3d0
| driver_probe_device+0x12c/0x148
| device_driver_attach+0x74/0x98
| __driver_attach+0xb4/0xe8
| bus_for_each_dev+0x88/0xe0
| driver_attach+0x30/0x40
| bus_add_driver+0x178/0x2b0
| driver_register+0x64/0x118
| __platform_driver_register+0x54/0x60
| scpi_clocks_driver_init+0x24/0x1000 [clk_scpi]
| do_one_initcall+0x54/0x220
| do_init_module+0x54/0x1c8
| load_module+0x14a4/0x1668
| __se_sys_finit_module+0xf8/0x110
| __arm64_sys_finit_module+0x24/0x30
| el0_svc_common+0x78/0x170
| el0_svc_handler+0x38/0x78
| el0_svc+0x8/0x340
| Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820)
| ---[ end trace 06feb22469d89fa8 ]---
| Kernel panic - not syncing: Fatal exception
| SMP: stopping secondary CPUs
| Kernel Offset: disabled
| CPU features: 0x10,a0002008
| Memory Limit: none
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "12e2c520a0a4202575e4a45ea41f06a8e9aa3417",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "8be4e51f3ecfb0915e3510b600c4cce0dc68a383",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "380c0e1d96f3b522f3170c18ee5e0f1a28fec5d6",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "2a5b8de6fcb944f9af0c5fcb30bb0c039705e051",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "06258e57fee253f4046d3a6a86d7fde09f596eac",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "025067eeb945aa17c7dd483a63960125b7efb577",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "dfc9c2aa7f04f7db7e7225a5e118a24bf1c3b325",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "9beaff47bcea5eec7d4ead98f5043057161fd71a",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "109aa654f85c5141e813b2cd1bd36d90be678407",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: Check the DVFS OPP count returned by the firmware\n\nFix a kernel crash with the below call trace when the SCPI firmware\nreturns OPP count of zero.\n\ndvfs_info.opp_count may be zero on some platforms during the reboot\ntest, and the kernel will crash after dereferencing the pointer to\nkcalloc(info-\u003ecount, sizeof(*opp), GFP_KERNEL).\n\n | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028\n | Mem abort info:\n | ESR = 0x96000004\n | Exception class = DABT (current EL), IL = 32 bits\n | SET = 0, FnV = 0\n | EA = 0, S1PTW = 0\n | Data abort info:\n | ISV = 0, ISS = 0x00000004\n | CM = 0, WnR = 0\n | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c\n | [0000000000000028] pgd=0000000000000000\n | Internal error: Oops: 96000004 [#1] SMP\n | scpi-hwmon: probe of PHYT000D:00 failed with error -110\n | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c)\n | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1\n | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS\n | pstate: 60000005 (nZCv daif -PAN -UAO)\n | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]\n | lr : clk_register+0x438/0x720\n | Call trace:\n | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]\n | devm_clk_hw_register+0x50/0xa0\n | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi]\n | scpi_clocks_probe+0x528/0x70c [clk_scpi]\n | platform_drv_probe+0x58/0xa8\n | really_probe+0x260/0x3d0\n | driver_probe_device+0x12c/0x148\n | device_driver_attach+0x74/0x98\n | __driver_attach+0xb4/0xe8\n | bus_for_each_dev+0x88/0xe0\n | driver_attach+0x30/0x40\n | bus_add_driver+0x178/0x2b0\n | driver_register+0x64/0x118\n | __platform_driver_register+0x54/0x60\n | scpi_clocks_driver_init+0x24/0x1000 [clk_scpi]\n | do_one_initcall+0x54/0x220\n | do_init_module+0x54/0x1c8\n | load_module+0x14a4/0x1668\n | __se_sys_finit_module+0xf8/0x110\n | __arm64_sys_finit_module+0x24/0x30\n | el0_svc_common+0x78/0x170\n | el0_svc_handler+0x38/0x78\n | el0_svc+0x8/0x340\n | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820)\n | ---[ end trace 06feb22469d89fa8 ]---\n | Kernel panic - not syncing: Fatal exception\n | SMP: stopping secondary CPUs\n | Kernel Offset: disabled\n | CPU features: 0x10,a0002008\n | Memory Limit: none"
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:20:01.512Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/12e2c520a0a4202575e4a45ea41f06a8e9aa3417"
},
{
"url": "https://git.kernel.org/stable/c/8be4e51f3ecfb0915e3510b600c4cce0dc68a383"
},
{
"url": "https://git.kernel.org/stable/c/380c0e1d96f3b522f3170c18ee5e0f1a28fec5d6"
},
{
"url": "https://git.kernel.org/stable/c/2a5b8de6fcb944f9af0c5fcb30bb0c039705e051"
},
{
"url": "https://git.kernel.org/stable/c/06258e57fee253f4046d3a6a86d7fde09f596eac"
},
{
"url": "https://git.kernel.org/stable/c/025067eeb945aa17c7dd483a63960125b7efb577"
},
{
"url": "https://git.kernel.org/stable/c/dfc9c2aa7f04f7db7e7225a5e118a24bf1c3b325"
},
{
"url": "https://git.kernel.org/stable/c/9beaff47bcea5eec7d4ead98f5043057161fd71a"
},
{
"url": "https://git.kernel.org/stable/c/109aa654f85c5141e813b2cd1bd36d90be678407"
}
],
"title": "firmware: arm_scpi: Check the DVFS OPP count returned by the firmware",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53157",
"datePublished": "2024-12-24T11:28:56.218Z",
"dateReserved": "2024-11-19T17:17:25.001Z",
"dateUpdated": "2025-01-20T06:20:01.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53153
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF
deinit notify function pci_epc_deinit_notify() are called during the
execution of qcom_pcie_perst_assert() i.e., when the host has asserted
PERST#. But quickly after this step, refclk will also be disabled by the
host.
All of the Qcom endpoint SoCs supported as of now depend on the refclk from
the host for keeping the controller operational. Due to this limitation,
any access to the hardware registers in the absence of refclk will result
in a whole endpoint crash. Unfortunately, most of the controller cleanups
require accessing the hardware registers (like eDMA cleanup performed in
dw_pcie_ep_cleanup(), powering down MHI EPF etc...). So these cleanup
functions are currently causing the crash in the endpoint SoC once host
asserts PERST#.
One way to address this issue is by generating the refclk in the endpoint
itself and not depending on the host. But that is not always possible as
some of the endpoint designs do require the endpoint to consume refclk from
the host (as I was told by the Qcom engineers).
Thus, fix this crash by moving the controller cleanups to the start of
the qcom_pcie_perst_deassert() function. qcom_pcie_perst_deassert() is
called whenever the host has deasserted PERST# and it is guaranteed that
the refclk would be active at this point. So at the start of this function
(after enabling resources), the controller cleanup can be performed. Once
finished, rest of the code execution for PERST# deassert can continue as
usual.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/dwc/pcie-qcom-ep.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e03b5f1615c84f4139cb53ef8659f4cdb8d6a563",
"status": "affected",
"version": "570d7715eed8a29ac5bd96c7694f060a991e5a31",
"versionType": "git"
},
{
"lessThan": "516969d5765e2302d33b4f251496eedb757d55ea",
"status": "affected",
"version": "570d7715eed8a29ac5bd96c7694f060a991e5a31",
"versionType": "git"
},
{
"lessThan": "7d7cf89b119af433354f865fc01017b9f8aa411a",
"status": "affected",
"version": "570d7715eed8a29ac5bd96c7694f060a991e5a31",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/dwc/pcie-qcom-ep.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()\n\nCurrently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF\ndeinit notify function pci_epc_deinit_notify() are called during the\nexecution of qcom_pcie_perst_assert() i.e., when the host has asserted\nPERST#. But quickly after this step, refclk will also be disabled by the\nhost.\n\nAll of the Qcom endpoint SoCs supported as of now depend on the refclk from\nthe host for keeping the controller operational. Due to this limitation,\nany access to the hardware registers in the absence of refclk will result\nin a whole endpoint crash. Unfortunately, most of the controller cleanups\nrequire accessing the hardware registers (like eDMA cleanup performed in\ndw_pcie_ep_cleanup(), powering down MHI EPF etc...). So these cleanup\nfunctions are currently causing the crash in the endpoint SoC once host\nasserts PERST#.\n\nOne way to address this issue is by generating the refclk in the endpoint\nitself and not depending on the host. But that is not always possible as\nsome of the endpoint designs do require the endpoint to consume refclk from\nthe host (as I was told by the Qcom engineers).\n\nThus, fix this crash by moving the controller cleanups to the start of\nthe qcom_pcie_perst_deassert() function. qcom_pcie_perst_deassert() is\ncalled whenever the host has deasserted PERST# and it is guaranteed that\nthe refclk would be active at this point. So at the start of this function\n(after enabling resources), the controller cleanup can be performed. Once\nfinished, rest of the code execution for PERST# deassert can continue as\nusual."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:56.924Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e03b5f1615c84f4139cb53ef8659f4cdb8d6a563"
},
{
"url": "https://git.kernel.org/stable/c/516969d5765e2302d33b4f251496eedb757d55ea"
},
{
"url": "https://git.kernel.org/stable/c/7d7cf89b119af433354f865fc01017b9f8aa411a"
}
],
"title": "PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53153",
"datePublished": "2024-12-24T11:28:52.518Z",
"dateReserved": "2024-11-19T17:17:25.000Z",
"dateUpdated": "2025-01-20T06:19:56.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53150
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
The current USB-audio driver code doesn't check bLength of each
descriptor at traversing for clock descriptors. That is, when a
device provides a bogus descriptor with a shorter bLength, the driver
might hit out-of-bounds reads.
For addressing it, this patch adds sanity checks to the validator
functions for the clock descriptor traversal. When the descriptor
length is shorter than expected, it's skipped in the loop.
For the clock source and clock multiplier descriptors, we can just
check bLength against the sizeof() of each descriptor type.
OTOH, the clock selector descriptor of UAC2 and UAC3 has an array
of bNrInPins elements and two more fields at its tail, hence those
have to be checked in addition to the sizeof() check.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/clock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a632bdcb359fd8145e86486ff8612da98e239acd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "da13ade87a12dd58829278bc816a61bea06a56a9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "74cb86e1006c5437b1d90084d22018da30fddc77",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ea0fa76f61cf8e932d1d26e6193513230816e11d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "096bb5b43edf755bc4477e64004fa3a20539ec2f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a3dd4d63eeb452cfb064a13862fb376ab108f6a6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/clock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn\u0027t check bLength of each\ndescriptor at traversing for clock descriptors. That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal. When the descriptor\nlength is shorter than expected, it\u0027s skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:48.089Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd"
},
{
"url": "https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b"
},
{
"url": "https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9"
},
{
"url": "https://git.kernel.org/stable/c/da13ade87a12dd58829278bc816a61bea06a56a9"
},
{
"url": "https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77"
},
{
"url": "https://git.kernel.org/stable/c/ea0fa76f61cf8e932d1d26e6193513230816e11d"
},
{
"url": "https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f"
},
{
"url": "https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6"
}
],
"title": "ALSA: usb-audio: Fix out of bounds reads when finding clock sources",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53150",
"datePublished": "2024-12-24T11:28:50.175Z",
"dateReserved": "2024-11-19T17:17:24.999Z",
"dateUpdated": "2025-01-20T06:19:48.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53145
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
um: Fix potential integer overflow during physmem setup
This issue happens when the real map size is greater than LONG_MAX,
which can be easily triggered on UML/i386.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1 Version: fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1 Version: fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1 Version: fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1 Version: fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1 Version: fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1 Version: fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1 Version: fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/um/kernel/physmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c710f45811e7e2bfcf703980c306f19c7e1ecfe",
"status": "affected",
"version": "fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1",
"versionType": "git"
},
{
"lessThan": "e6102b72edc4eb8c0858df00ba74b5ce579c8fa2",
"status": "affected",
"version": "fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1",
"versionType": "git"
},
{
"lessThan": "1bd118c5f887802cef2d9ba0d1917258667f1cae",
"status": "affected",
"version": "fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1",
"versionType": "git"
},
{
"lessThan": "1575df968650d11771359e5ac78278c5b0cc19f3",
"status": "affected",
"version": "fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1",
"versionType": "git"
},
{
"lessThan": "a875c023155ea92b75d6323977003e64d92ae7fc",
"status": "affected",
"version": "fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1",
"versionType": "git"
},
{
"lessThan": "d1a211e5210d31da8f49fc0021bf7129b726468c",
"status": "affected",
"version": "fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1",
"versionType": "git"
},
{
"lessThan": "a9c95f787b88b29165563fd97761032db77116e7",
"status": "affected",
"version": "fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1",
"versionType": "git"
},
{
"lessThan": "a98b7761f697e590ed5d610d87fa12be66f23419",
"status": "affected",
"version": "fe205bdd1321f95f8f3c35d243ea7cb22af8fbe1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/um/kernel/physmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Fix potential integer overflow during physmem setup\n\nThis issue happens when the real map size is greater than LONG_MAX,\nwhich can be easily triggered on UML/i386."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:42.406Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c710f45811e7e2bfcf703980c306f19c7e1ecfe"
},
{
"url": "https://git.kernel.org/stable/c/e6102b72edc4eb8c0858df00ba74b5ce579c8fa2"
},
{
"url": "https://git.kernel.org/stable/c/1bd118c5f887802cef2d9ba0d1917258667f1cae"
},
{
"url": "https://git.kernel.org/stable/c/1575df968650d11771359e5ac78278c5b0cc19f3"
},
{
"url": "https://git.kernel.org/stable/c/a875c023155ea92b75d6323977003e64d92ae7fc"
},
{
"url": "https://git.kernel.org/stable/c/d1a211e5210d31da8f49fc0021bf7129b726468c"
},
{
"url": "https://git.kernel.org/stable/c/a9c95f787b88b29165563fd97761032db77116e7"
},
{
"url": "https://git.kernel.org/stable/c/a98b7761f697e590ed5d610d87fa12be66f23419"
}
],
"title": "um: Fix potential integer overflow during physmem setup",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53145",
"datePublished": "2024-12-24T11:28:46.113Z",
"dateReserved": "2024-11-19T17:17:24.997Z",
"dateUpdated": "2025-01-20T06:19:42.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53154
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: clk-apple-nco: Add NULL check in applnco_probe
Add NULL check in applnco_probe, to handle kernel NULL pointer
dereference error.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 6641057d5dba87338780cf3e0d0ae8389ef1125c Version: 6641057d5dba87338780cf3e0d0ae8389ef1125c Version: 6641057d5dba87338780cf3e0d0ae8389ef1125c Version: 6641057d5dba87338780cf3e0d0ae8389ef1125c Version: 6641057d5dba87338780cf3e0d0ae8389ef1125c |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-apple-nco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9a5905b725739af6a105f9e564e7c80d69969d2b",
"status": "affected",
"version": "6641057d5dba87338780cf3e0d0ae8389ef1125c",
"versionType": "git"
},
{
"lessThan": "72ea9a7e9e260aa39f9d1c9254cf92adfb05c4f5",
"status": "affected",
"version": "6641057d5dba87338780cf3e0d0ae8389ef1125c",
"versionType": "git"
},
{
"lessThan": "066c14619e8379c1bafbbf8196fd38eac303472b",
"status": "affected",
"version": "6641057d5dba87338780cf3e0d0ae8389ef1125c",
"versionType": "git"
},
{
"lessThan": "534e02f83889ccef5fe6beb46e773ab9d4ae1655",
"status": "affected",
"version": "6641057d5dba87338780cf3e0d0ae8389ef1125c",
"versionType": "git"
},
{
"lessThan": "969c765e2b508cca9099d246c010a1e48dcfd089",
"status": "affected",
"version": "6641057d5dba87338780cf3e0d0ae8389ef1125c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-apple-nco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: clk-apple-nco: Add NULL check in applnco_probe\n\nAdd NULL check in applnco_probe, to handle kernel NULL pointer\ndereference error."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:58.065Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9a5905b725739af6a105f9e564e7c80d69969d2b"
},
{
"url": "https://git.kernel.org/stable/c/72ea9a7e9e260aa39f9d1c9254cf92adfb05c4f5"
},
{
"url": "https://git.kernel.org/stable/c/066c14619e8379c1bafbbf8196fd38eac303472b"
},
{
"url": "https://git.kernel.org/stable/c/534e02f83889ccef5fe6beb46e773ab9d4ae1655"
},
{
"url": "https://git.kernel.org/stable/c/969c765e2b508cca9099d246c010a1e48dcfd089"
}
],
"title": "clk: clk-apple-nco: Add NULL check in applnco_probe",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53154",
"datePublished": "2024-12-24T11:28:53.424Z",
"dateReserved": "2024-11-19T17:17:25.000Z",
"dateUpdated": "2025-01-20T06:19:58.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53159
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2025-01-09T15:48:23.224Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53159",
"datePublished": "2024-12-24T11:28:58.241Z",
"dateRejected": "2025-01-09T15:48:23.224Z",
"dateReserved": "2024-11-19T17:17:25.002Z",
"dateUpdated": "2025-01-09T15:48:23.224Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53149
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: glink: fix off-by-one in connector_status
UCSI connector's indices start from 1 up to 3, PMIC_GLINK_MAX_PORTS.
Correct the condition in the pmic_glink_ucsi_connector_status()
callback, fixing Type-C orientation reporting for the third USB-C
connector.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/ucsi_glink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8a2273e5c1beb285729aa001422967b4711c53fe",
"status": "affected",
"version": "fd662c37a1087a2631cd2544138650b153e65f90",
"versionType": "git"
},
{
"lessThan": "9a5a8b5bd72169aa7a8ec800ef57be2f2cb4d9b2",
"status": "affected",
"version": "76716fd5bf09725c2c6825264147f16c21e56853",
"versionType": "git"
},
{
"lessThan": "6ba6f7f29e0dff47a2799e60dcd1b5c29cd811a5",
"status": "affected",
"version": "76716fd5bf09725c2c6825264147f16c21e56853",
"versionType": "git"
},
{
"lessThan": "4a22918810980897393fa1776ea3877e4baf8cca",
"status": "affected",
"version": "76716fd5bf09725c2c6825264147f16c21e56853",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/ucsi_glink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: glink: fix off-by-one in connector_status\n\nUCSI connector\u0027s indices start from 1 up to 3, PMIC_GLINK_MAX_PORTS.\nCorrect the condition in the pmic_glink_ucsi_connector_status()\ncallback, fixing Type-C orientation reporting for the third USB-C\nconnector."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:46.935Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a2273e5c1beb285729aa001422967b4711c53fe"
},
{
"url": "https://git.kernel.org/stable/c/9a5a8b5bd72169aa7a8ec800ef57be2f2cb4d9b2"
},
{
"url": "https://git.kernel.org/stable/c/6ba6f7f29e0dff47a2799e60dcd1b5c29cd811a5"
},
{
"url": "https://git.kernel.org/stable/c/4a22918810980897393fa1776ea3877e4baf8cca"
}
],
"title": "usb: typec: ucsi: glink: fix off-by-one in connector_status",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53149",
"datePublished": "2024-12-24T11:28:49.432Z",
"dateReserved": "2024-11-19T17:17:24.998Z",
"dateUpdated": "2025-01-20T06:19:46.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53162
Vulnerability from cvelistv5
Published
2024-12-24 11:29
Modified
2025-01-20 06:20
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat/qat_4xxx - fix off by one in uof_get_name()
The fw_objs[] array has "num_objs" elements so the > needs to be >= to
prevent an out of bounds read.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05c9a7a5344425860202a8f3efea4d8ed2d10edb",
"status": "affected",
"version": "10484c647af6b1952d1675e83be9cc976cdb6a96",
"versionType": "git"
},
{
"lessThan": "e69d2845aaa080960f38761f78fd25aa856620c6",
"status": "affected",
"version": "10484c647af6b1952d1675e83be9cc976cdb6a96",
"versionType": "git"
},
{
"lessThan": "700852528fc5295897d6089eea0656d67f9b9d88",
"status": "affected",
"version": "10484c647af6b1952d1675e83be9cc976cdb6a96",
"versionType": "git"
},
{
"lessThan": "475b5098043eef6e72751aadeab687992a5b63d1",
"status": "affected",
"version": "10484c647af6b1952d1675e83be9cc976cdb6a96",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat/qat_4xxx - fix off by one in uof_get_name()\n\nThe fw_objs[] array has \"num_objs\" elements so the \u003e needs to be \u003e= to\nprevent an out of bounds read."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:20:06.543Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05c9a7a5344425860202a8f3efea4d8ed2d10edb"
},
{
"url": "https://git.kernel.org/stable/c/e69d2845aaa080960f38761f78fd25aa856620c6"
},
{
"url": "https://git.kernel.org/stable/c/700852528fc5295897d6089eea0656d67f9b9d88"
},
{
"url": "https://git.kernel.org/stable/c/475b5098043eef6e72751aadeab687992a5b63d1"
}
],
"title": "crypto: qat/qat_4xxx - fix off by one in uof_get_name()",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53162",
"datePublished": "2024-12-24T11:29:10.439Z",
"dateReserved": "2024-11-19T17:17:25.003Z",
"dateUpdated": "2025-01-20T06:20:06.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53148
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
comedi: Flush partial mappings in error case
If some remap_pfn_range() calls succeeded before one failed, we still have
buffer pages mapped into the userspace page tables when we drop the buffer
reference with comedi_buf_map_put(bm). The userspace mappings are only
cleaned up later in the mmap error path.
Fix it by explicitly flushing all mappings in our VMA on the error path.
See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in
error case").
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/comedi/comedi_fops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "57f048c2d205b85e34282a9b0b0ae177e84c2f44",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "b9322408d83accc8b96322bc7356593206288c56",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "8797b7712de704dc231f9e821d8eb3b9aeb3a032",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "16c507df509113c037cdc0ba642b9ab3389bd26c",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "9b07fb464eb69a752406e78e62ab3a60bfa7b00d",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "c6963a06ce5c61d3238751ada04ee1569663a828",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "297f14fbb81895f4ccdb0ad25d196786d6461e00",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "ce8f9fb651fac95dd41f69afe54d935420b945bd",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/comedi/comedi_fops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Flush partial mappings in error case\n\nIf some remap_pfn_range() calls succeeded before one failed, we still have\nbuffer pages mapped into the userspace page tables when we drop the buffer\nreference with comedi_buf_map_put(bm). The userspace mappings are only\ncleaned up later in the mmap error path.\n\nFix it by explicitly flushing all mappings in our VMA on the error path.\n\nSee commit 79a61cc3fc04 (\"mm: avoid leaving partial pfn mappings around in\nerror case\")."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:45.823Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/57f048c2d205b85e34282a9b0b0ae177e84c2f44"
},
{
"url": "https://git.kernel.org/stable/c/b9322408d83accc8b96322bc7356593206288c56"
},
{
"url": "https://git.kernel.org/stable/c/8797b7712de704dc231f9e821d8eb3b9aeb3a032"
},
{
"url": "https://git.kernel.org/stable/c/16c507df509113c037cdc0ba642b9ab3389bd26c"
},
{
"url": "https://git.kernel.org/stable/c/9b07fb464eb69a752406e78e62ab3a60bfa7b00d"
},
{
"url": "https://git.kernel.org/stable/c/c6963a06ce5c61d3238751ada04ee1569663a828"
},
{
"url": "https://git.kernel.org/stable/c/297f14fbb81895f4ccdb0ad25d196786d6461e00"
},
{
"url": "https://git.kernel.org/stable/c/ce8f9fb651fac95dd41f69afe54d935420b945bd"
}
],
"title": "comedi: Flush partial mappings in error case",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53148",
"datePublished": "2024-12-24T11:28:48.619Z",
"dateReserved": "2024-11-19T17:17:24.998Z",
"dateUpdated": "2025-01-20T06:19:45.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53146
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent a potential integer overflow
If the tag length is >= U32_MAX - 3 then the "length + 4" addition
can result in an integer overflow. Address this by splitting the
decoding into several steps so that decode_cb_compound4res() does
not have to perform arithmetic on the unsafe length value.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4callback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "745f7ce5a95e783ba62fe774325829466aec2aa8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "90adbae9dd158da8331d9fdd32077bd1af04f553",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3c5f545c9a1f8a1869246f6f3ae8c17289d6a841",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "842f1c27a1aef5367e535f9e85c8c3b06352151a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "de53c5305184ca1333b87e695d329d1502d694ce",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dde654cad08fdaac370febb161ec41eb58e9d2a2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "084f797dbc7e52209a4ab6dbc7f0109268754eb9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ccd3394f9a7200d6b088553bf38e688620cd27af",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7f33b92e5b18e904a481e6e208486da43e4dc841",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4callback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent a potential integer overflow\n\nIf the tag length is \u003e= U32_MAX - 3 then the \"length + 4\" addition\ncan result in an integer overflow. Address this by splitting the\ndecoding into several steps so that decode_cb_compound4res() does\nnot have to perform arithmetic on the unsafe length value."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:43.545Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8"
},
{
"url": "https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553"
},
{
"url": "https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841"
},
{
"url": "https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a"
},
{
"url": "https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce"
},
{
"url": "https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2"
},
{
"url": "https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9"
},
{
"url": "https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af"
},
{
"url": "https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841"
}
],
"title": "NFSD: Prevent a potential integer overflow",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53146",
"datePublished": "2024-12-24T11:28:46.883Z",
"dateReserved": "2024-11-19T17:17:24.998Z",
"dateUpdated": "2025-01-20T06:19:43.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-53147
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
exfat: fix out-of-bounds access of directory entries
In the case of the directory size is greater than or equal to
the cluster size, if start_clu becomes an EOF cluster(an invalid
cluster) due to file system corruption, then the directory entry
where ei->hint_femp.eidx hint is outside the directory, resulting
in an out-of-bounds access, which may cause further file system
corruption.
This commit adds a check for start_clu, if it is an invalid cluster,
the file or directory will be treated as empty.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/exfat/namei.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0120d6463368378539ef928cf067d02372efb8c",
"status": "affected",
"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
"versionType": "git"
},
{
"lessThan": "3ddd1cb2b458ff6a193bc845f408dfff217db29e",
"status": "affected",
"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
"versionType": "git"
},
{
"lessThan": "184fa506e392eb78364d9283c961217ff2c0617b",
"status": "affected",
"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/exfat/namei.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix out-of-bounds access of directory entries\n\nIn the case of the directory size is greater than or equal to\nthe cluster size, if start_clu becomes an EOF cluster(an invalid\ncluster) due to file system corruption, then the directory entry\nwhere ei-\u003ehint_femp.eidx hint is outside the directory, resulting\nin an out-of-bounds access, which may cause further file system\ncorruption.\n\nThis commit adds a check for start_clu, if it is an invalid cluster,\nthe file or directory will be treated as empty."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T06:19:44.694Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0120d6463368378539ef928cf067d02372efb8c"
},
{
"url": "https://git.kernel.org/stable/c/3ddd1cb2b458ff6a193bc845f408dfff217db29e"
},
{
"url": "https://git.kernel.org/stable/c/184fa506e392eb78364d9283c961217ff2c0617b"
}
],
"title": "exfat: fix out-of-bounds access of directory entries",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53147",
"datePublished": "2024-12-24T11:28:47.695Z",
"dateReserved": "2024-11-19T17:17:24.998Z",
"dateUpdated": "2025-01-20T06:19:44.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.