Action not permitted
Modal body text goes here.
Modal Title
Modal Body
wid-sec-w-2025-0047
Vulnerability from csaf_certbund
Published
2025-01-12 23:00
Modified
2025-01-12 23:00
Summary
Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und weitere nicht spezifizierte Angriffe zu starten.
Betroffene Betriebssysteme
- Linux
{ document: { aggregate_severity: { text: "mittel", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Der Kernel stellt den Kern des Linux Betriebssystems dar.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und weitere nicht spezifizierte Angriffe zu starten.", title: "Angriff", }, { category: "general", text: "- Linux", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2025-0047 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0047.json", }, { category: "self", summary: "WID-SEC-2025-0047 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0047", }, { category: "external", summary: "Kernel CVE Announce Mailingliste", url: "https://lore.kernel.org/linux-cve-announce/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-41149", url: "https://lore.kernel.org/linux-cve-announce/2025011141-CVE-2024-41149-7e9b@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-41932", url: "https://lore.kernel.org/linux-cve-announce/2025011116-CVE-2024-41932-ed84@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-41935", url: "https://lore.kernel.org/linux-cve-announce/2025011118-CVE-2024-41935-e11d@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-43098", url: "https://lore.kernel.org/linux-cve-announce/2025011118-CVE-2024-43098-e732@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-45828", url: "https://lore.kernel.org/linux-cve-announce/2025011119-CVE-2024-45828-8cbd@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-46896", url: "https://lore.kernel.org/linux-cve-announce/2025011141-CVE-2024-46896-8e7c@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-47141", url: "https://lore.kernel.org/linux-cve-announce/2025011119-CVE-2024-47141-13f5@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-47143", url: "https://lore.kernel.org/linux-cve-announce/2025011119-CVE-2024-47143-37ba@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-47408", url: "https://lore.kernel.org/linux-cve-announce/2025011141-CVE-2024-47408-e686@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-47794", url: "https://lore.kernel.org/linux-cve-announce/2025011120-CVE-2024-47794-09e9@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-47809", url: "https://lore.kernel.org/linux-cve-announce/2025011120-CVE-2024-47809-7b40@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-48873", url: "https://lore.kernel.org/linux-cve-announce/2025011120-CVE-2024-48873-75a9@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-48875", url: "https://lore.kernel.org/linux-cve-announce/2025011121-CVE-2024-48875-5b79@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-48876", url: "https://lore.kernel.org/linux-cve-announce/2025011121-CVE-2024-48876-da61@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-48881", url: "https://lore.kernel.org/linux-cve-announce/2025011121-CVE-2024-48881-c4e5@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-49568", url: "https://lore.kernel.org/linux-cve-announce/2025011142-CVE-2024-49568-e5f6@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-49569", url: "https://lore.kernel.org/linux-cve-announce/2025011122-CVE-2024-49569-c532@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-49571", url: "https://lore.kernel.org/linux-cve-announce/2025011142-CVE-2024-49571-c86d@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-49573", url: "https://lore.kernel.org/linux-cve-announce/2025011142-CVE-2024-49573-fa46@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-50051", url: "https://lore.kernel.org/linux-cve-announce/2025011122-CVE-2024-50051-d822@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-51729", url: "https://lore.kernel.org/linux-cve-announce/2025011143-CVE-2024-51729-799d@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-52319", url: "https://lore.kernel.org/linux-cve-announce/2025011143-CVE-2024-52319-61ca@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-52332", url: "https://lore.kernel.org/linux-cve-announce/2025011122-CVE-2024-52332-9d2f@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-53680", url: "https://lore.kernel.org/linux-cve-announce/2025011123-CVE-2024-53680-88d4@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-53682", url: "https://lore.kernel.org/linux-cve-announce/2025011157-CVE-2024-53682-263d@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-53685", url: "https://lore.kernel.org/linux-cve-announce/2025011143-CVE-2024-53685-e6c3@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-53687", url: "https://lore.kernel.org/linux-cve-announce/2025011157-CVE-2024-53687-5f05@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-53689", url: "https://lore.kernel.org/linux-cve-announce/2025011158-CVE-2024-53689-c526@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-53690", url: "https://lore.kernel.org/linux-cve-announce/2025011144-CVE-2024-53690-8ad8@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-54191", url: "https://lore.kernel.org/linux-cve-announce/2025011158-CVE-2024-54191-eeef@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-54193", url: "https://lore.kernel.org/linux-cve-announce/2025011144-CVE-2024-54193-9ce6@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-54455", url: "https://lore.kernel.org/linux-cve-announce/2025011145-CVE-2024-54455-0e8e@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-54460", url: "https://lore.kernel.org/linux-cve-announce/2025011158-CVE-2024-54460-c8c8@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-54680", url: "https://lore.kernel.org/linux-cve-announce/2025011145-CVE-2024-54680-db98@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-54683", url: "https://lore.kernel.org/linux-cve-announce/2025011159-CVE-2024-54683-042e@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-55639", url: "https://lore.kernel.org/linux-cve-announce/2025011159-CVE-2024-55639-b3d2@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-55641", url: "https://lore.kernel.org/linux-cve-announce/2025011159-CVE-2024-55641-fa58@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-55642", url: "https://lore.kernel.org/linux-cve-announce/2025011100-CVE-2024-55642-29a8@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-55881", url: "https://lore.kernel.org/linux-cve-announce/2025011145-CVE-2024-55881-ad68@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-55916", url: "https://lore.kernel.org/linux-cve-announce/2025011146-CVE-2024-55916-3a1f@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-56368", url: "https://lore.kernel.org/linux-cve-announce/2025011146-CVE-2024-56368-e3cd@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-56369", url: "https://lore.kernel.org/linux-cve-announce/2025011146-CVE-2024-56369-be56@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-56372", url: "https://lore.kernel.org/linux-cve-announce/2025011147-CVE-2024-56372-99e3@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-56788", url: "https://lore.kernel.org/linux-cve-announce/2025011147-CVE-2024-56788-7a74@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57791", url: "https://lore.kernel.org/linux-cve-announce/2025011147-CVE-2024-57791-7bc8@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57792", url: "https://lore.kernel.org/linux-cve-announce/2025011150-CVE-2024-57792-0002@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57793", url: "https://lore.kernel.org/linux-cve-announce/2025011150-CVE-2024-57793-4d57@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57798", url: "https://lore.kernel.org/linux-cve-announce/2025011151-CVE-2024-57798-68b5@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57799", url: "https://lore.kernel.org/linux-cve-announce/2025011151-CVE-2024-57799-ae66@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57800", url: "https://lore.kernel.org/linux-cve-announce/2025011152-CVE-2024-57800-699a@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57804", url: "https://lore.kernel.org/linux-cve-announce/2025011152-CVE-2024-57804-4bad@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57805", url: "https://lore.kernel.org/linux-cve-announce/2025011152-CVE-2024-57805-fbae@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57806", url: "https://lore.kernel.org/linux-cve-announce/2025011153-CVE-2024-57806-0afb@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57807", url: "https://lore.kernel.org/linux-cve-announce/2025011153-CVE-2024-57807-b595@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57809", url: "https://lore.kernel.org/linux-cve-announce/2025011103-CVE-2024-57809-a6be@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57838", url: "https://lore.kernel.org/linux-cve-announce/2025011105-CVE-2024-57838-4111@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57839", url: "https://lore.kernel.org/linux-cve-announce/2025011101-CVE-2024-57839-daf6@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57843", url: "https://lore.kernel.org/linux-cve-announce/2025011103-CVE-2024-57843-1c15@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57849", url: "https://lore.kernel.org/linux-cve-announce/2025011103-CVE-2024-57849-64db@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57850", url: "https://lore.kernel.org/linux-cve-announce/2025011104-CVE-2024-57850-7e8d@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57872", url: "https://lore.kernel.org/linux-cve-announce/2025011104-CVE-2024-57872-28ee@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57874", url: "https://lore.kernel.org/linux-cve-announce/2025011113-CVE-2024-57874-539d@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57875", url: "https://lore.kernel.org/linux-cve-announce/2025011107-CVE-2024-57875-7902@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57876", url: "https://lore.kernel.org/linux-cve-announce/2025011107-CVE-2024-57876-1d02@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57877", url: "https://lore.kernel.org/linux-cve-announce/2025011108-CVE-2024-57877-ee49@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57878", url: "https://lore.kernel.org/linux-cve-announce/2025011108-CVE-2024-57878-465c@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57879", url: "https://lore.kernel.org/linux-cve-announce/2025011131-CVE-2024-57879-7fa8@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57880", url: "https://lore.kernel.org/linux-cve-announce/2025011134-CVE-2024-57880-c009@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2024-57881", url: "https://lore.kernel.org/linux-cve-announce/2025011146-CVE-2024-57881-7516@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2025-23124", url: "https://lore.kernel.org/linux-cve-announce/2025011104-CVE-2025-23124-6e63@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2025-23125", url: "https://lore.kernel.org/linux-cve-announce/2025011105-CVE-2025-23125-069a@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2025-23126", url: "https://lore.kernel.org/linux-cve-announce/2025011105-CVE-2025-23126-4c4f@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2025-23127", url: "https://lore.kernel.org/linux-cve-announce/2025011105-CVE-2025-23127-2b8d@gregkh/", }, { category: "external", summary: "Linux Kernel CVE Announcement CVE-2025-23128", url: "https://lore.kernel.org/linux-cve-announce/2025011106-CVE-2025-23128-2d6e@gregkh/#t", }, ], source_lang: "en-US", title: "Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service", tracking: { current_release_date: "2025-01-12T23:00:00.000+00:00", generator: { date: "2025-01-13T10:03:16.686+00:00", engine: { name: "BSI-WID", version: "1.3.10", }, }, id: "WID-SEC-W-2025-0047", initial_release_date: "2025-01-12T23:00:00.000+00:00", revision_history: [ { date: "2025-01-12T23:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "Open Source Linux Kernel", product: { name: "Open Source Linux Kernel", product_id: "T008144", product_identification_helper: { cpe: "cpe:/a:linux:linux_kernel:-", }, }, }, ], category: "vendor", name: "Open Source", }, ], }, vulnerabilities: [ { cve: "CVE-2024-41149", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-41149", }, { cve: "CVE-2024-41932", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-41932", }, { cve: "CVE-2024-41935", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-41935", }, { cve: "CVE-2024-43098", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-43098", }, { cve: "CVE-2024-45828", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-45828", }, { cve: "CVE-2024-46896", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-46896", }, { cve: "CVE-2024-47141", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-47141", }, { cve: "CVE-2024-47143", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-47143", }, { cve: "CVE-2024-47408", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-47408", }, { cve: "CVE-2024-47794", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-47794", }, { cve: "CVE-2024-47809", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-47809", }, { cve: "CVE-2024-48873", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-48873", }, { cve: "CVE-2024-48875", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-48875", }, { cve: "CVE-2024-48876", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-48876", }, { cve: "CVE-2024-48881", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-48881", }, { cve: "CVE-2024-49568", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-49568", }, { cve: "CVE-2024-49569", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-49569", }, { cve: "CVE-2024-49571", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-49571", }, { cve: "CVE-2024-49573", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-49573", }, { cve: "CVE-2024-50051", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-50051", }, { cve: "CVE-2024-51729", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-51729", }, { cve: "CVE-2024-52319", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-52319", }, { cve: "CVE-2024-52332", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-52332", }, { cve: "CVE-2024-53680", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-53680", }, { cve: "CVE-2024-53682", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-53682", }, { cve: "CVE-2024-53685", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-53685", }, { cve: "CVE-2024-53687", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-53687", }, { cve: "CVE-2024-53689", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-53689", }, { cve: "CVE-2024-53690", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-53690", }, { cve: "CVE-2024-54191", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-54191", }, { cve: "CVE-2024-54193", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-54193", }, { cve: "CVE-2024-54455", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-54455", }, { cve: "CVE-2024-54460", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-54460", }, { cve: "CVE-2024-54680", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-54680", }, { cve: "CVE-2024-54683", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-54683", }, { cve: "CVE-2024-55639", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-55639", }, { cve: "CVE-2024-55641", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-55641", }, { cve: "CVE-2024-55642", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-55642", }, { cve: "CVE-2024-55881", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-55881", }, { cve: "CVE-2024-55916", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-55916", }, { cve: "CVE-2024-56368", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-56368", }, { cve: "CVE-2024-56369", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-56369", }, { cve: "CVE-2024-56372", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-56372", }, { cve: "CVE-2024-56788", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-56788", }, { cve: "CVE-2024-57791", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57791", }, { cve: "CVE-2024-57792", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57792", }, { cve: "CVE-2024-57793", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57793", }, { cve: "CVE-2024-57798", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57798", }, { cve: "CVE-2024-57799", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57799", }, { cve: "CVE-2024-57800", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57800", }, { cve: "CVE-2024-57804", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57804", }, { cve: "CVE-2024-57805", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57805", }, { cve: "CVE-2024-57806", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57806", }, { cve: "CVE-2024-57807", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57807", }, { cve: "CVE-2024-57809", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57809", }, { cve: "CVE-2024-57838", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57838", }, { cve: "CVE-2024-57839", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57839", }, { cve: "CVE-2024-57843", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57843", }, { cve: "CVE-2024-57849", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57849", }, { cve: "CVE-2024-57850", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57850", }, { cve: "CVE-2024-57872", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57872", }, { cve: "CVE-2024-57874", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57874", }, { cve: "CVE-2024-57875", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57875", }, { cve: "CVE-2024-57876", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57876", }, { cve: "CVE-2024-57877", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57877", }, { cve: "CVE-2024-57878", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57878", }, { cve: "CVE-2024-57879", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57879", }, { cve: "CVE-2024-57880", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57880", }, { cve: "CVE-2024-57881", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2024-57881", }, { cve: "CVE-2025-23124", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2025-23124", }, { cve: "CVE-2025-23125", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2025-23125", }, { cve: "CVE-2025-23126", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2025-23126", }, { cve: "CVE-2025-23127", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2025-23127", }, { cve: "CVE-2025-23128", notes: [ { category: "description", text: "Im Linux-Kernel bestehen mehrere Schwachstellen aufgrund verschiedener Fehler in der Speicherverwaltung (use after free, null pointer, etc.). Ein lokaler Angreifer kann dies ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und möglicherweise andere, nicht spezifizierte Auswirkungen zu verursachen.", }, ], product_status: { known_affected: [ "T008144", ], }, release_date: "2025-01-12T23:00:00.000+00:00", title: "CVE-2025-23128", }, ], }
cve-2024-57881
Vulnerability from cvelistv5
Published
2025-01-11 15:10
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()
In split_large_buddy(), we might call pfn_to_page() on a PFN that might
not exist. In corner cases, such as when freeing the highest pageblock in
the last memory section, this could result with CONFIG_SPARSEMEM &&
!CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and
__section_mem_map_addr() dereferencing that NULL pointer.
Let's fix it, and avoid doing a pfn_to_page() call for the first
iteration, where we already have the page.
So far this was found by code inspection, but let's just CC stable as the
fix is easy.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "mm/page_alloc.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "4234ca9884bcae9e48ed38652d91696ad5cd591d", status: "affected", version: "fd919a85cd55be5d00a6a7372071f44c8eafb825", versionType: "git", }, { lessThan: "faeec8e23c10bd30e8aa759a2eb3018dae00f924", status: "affected", version: "fd919a85cd55be5d00a6a7372071f44c8eafb825", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "mm/page_alloc.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.10", }, { lessThan: "6.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()\n\nIn split_large_buddy(), we might call pfn_to_page() on a PFN that might\nnot exist. In corner cases, such as when freeing the highest pageblock in\nthe last memory section, this could result with CONFIG_SPARSEMEM &&\n!CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and\n__section_mem_map_addr() dereferencing that NULL pointer.\n\nLet's fix it, and avoid doing a pfn_to_page() call for the first\niteration, where we already have the page.\n\nSo far this was found by code inspection, but let's just CC stable as the\nfix is easy.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:47.675Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/4234ca9884bcae9e48ed38652d91696ad5cd591d", }, { url: "https://git.kernel.org/stable/c/faeec8e23c10bd30e8aa759a2eb3018dae00f924", }, ], title: "mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57881", datePublished: "2025-01-11T15:10:43.786Z", dateReserved: "2025-01-11T14:45:42.023Z", dateUpdated: "2025-01-20T06:28:47.675Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-53680
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:21
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
Under certain kernel configurations when building with Clang/LLVM, the
compiler does not generate a return or jump as the terminator
instruction for ip_vs_protocol_init(), triggering the following objtool
warning during build time:
vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6()
At runtime, this either causes an oops when trying to load the ipvs
module or a boot-time panic if ipvs is built-in. This same issue has
been reported by the Intel kernel test robot previously.
Digging deeper into both LLVM and the kernel code reveals this to be a
undefined behavior problem. ip_vs_protocol_init() uses a on-stack buffer
of 64 chars to store the registered protocol names and leaves it
uninitialized after definition. The function calls strnlen() when
concatenating protocol names into the buffer. With CONFIG_FORTIFY_SOURCE
strnlen() performs an extra step to check whether the last byte of the
input char buffer is a null character (commit 3009f891bb9f ("fortify:
Allow strlen() and strnlen() to pass compile-time known lengths")).
This, together with possibly other configurations, cause the following
IR to be generated:
define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #5 section ".init.text" align 16 !kcfi_type !29 {
%1 = alloca [64 x i8], align 16
...
14: ; preds = %11
%15 = getelementptr inbounds i8, ptr %1, i64 63
%16 = load i8, ptr %15, align 1
%17 = tail call i1 @llvm.is.constant.i8(i8 %16)
%18 = icmp eq i8 %16, 0
%19 = select i1 %17, i1 %18, i1 false
br i1 %19, label %20, label %23
20: ; preds = %14
%21 = call i64 @strlen(ptr noundef nonnull dereferenceable(1) %1) #23
...
23: ; preds = %14, %11, %20
%24 = call i64 @strnlen(ptr noundef nonnull dereferenceable(1) %1, i64 noundef 64) #24
...
}
The above code calculates the address of the last char in the buffer
(value %15) and then loads from it (value %16). Because the buffer is
never initialized, the LLVM GVN pass marks value %16 as undefined:
%13 = getelementptr inbounds i8, ptr %1, i64 63
br i1 undef, label %14, label %17
This gives later passes (SCCP, in particular) more DCE opportunities by
propagating the undef value further, and eventually removes everything
after the load on the uninitialized stack location:
define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #0 section ".init.text" align 16 !kcfi_type !11 {
%1 = alloca [64 x i8], align 16
...
12: ; preds = %11
%13 = getelementptr inbounds i8, ptr %1, i64 63
unreachable
}
In this way, the generated native code will just fall through to the
next function, as LLVM does not generate any code for the unreachable IR
instruction and leaves the function without a terminator.
Zero the on-stack buffer to avoid this possible UB.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/netfilter/ipvs/ip_vs_proto.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "31d1ddc1ce8e8d3f101a679243abb42a313ee88a", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "0b2cbed82b7c6504a8a0fbd181f92dd56b432c12", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "d6e1776f51c95827142f1d7064118e255e2deec1", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "664d0feab92495b6a27edc3d1119e232c0fe8b2b", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "124834133b32f9386bb2d8581d9ab92f65e951e4", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "48130002e64fd191b7d18efeb4d253fcc23e4688", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "146b6f1112eb30a19776d6c323c994e9d67790db", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/netfilter/ipvs/ip_vs_proto.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "2.6.12", }, { lessThan: "2.6.12", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.287", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()\n\nUnder certain kernel configurations when building with Clang/LLVM, the\ncompiler does not generate a return or jump as the terminator\ninstruction for ip_vs_protocol_init(), triggering the following objtool\nwarning during build time:\n\n vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6()\n\nAt runtime, this either causes an oops when trying to load the ipvs\nmodule or a boot-time panic if ipvs is built-in. This same issue has\nbeen reported by the Intel kernel test robot previously.\n\nDigging deeper into both LLVM and the kernel code reveals this to be a\nundefined behavior problem. ip_vs_protocol_init() uses a on-stack buffer\nof 64 chars to store the registered protocol names and leaves it\nuninitialized after definition. The function calls strnlen() when\nconcatenating protocol names into the buffer. With CONFIG_FORTIFY_SOURCE\nstrnlen() performs an extra step to check whether the last byte of the\ninput char buffer is a null character (commit 3009f891bb9f (\"fortify:\nAllow strlen() and strnlen() to pass compile-time known lengths\")).\nThis, together with possibly other configurations, cause the following\nIR to be generated:\n\n define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #5 section \".init.text\" align 16 !kcfi_type !29 {\n %1 = alloca [64 x i8], align 16\n ...\n\n 14: ; preds = %11\n %15 = getelementptr inbounds i8, ptr %1, i64 63\n %16 = load i8, ptr %15, align 1\n %17 = tail call i1 @llvm.is.constant.i8(i8 %16)\n %18 = icmp eq i8 %16, 0\n %19 = select i1 %17, i1 %18, i1 false\n br i1 %19, label %20, label %23\n\n 20: ; preds = %14\n %21 = call i64 @strlen(ptr noundef nonnull dereferenceable(1) %1) #23\n ...\n\n 23: ; preds = %14, %11, %20\n %24 = call i64 @strnlen(ptr noundef nonnull dereferenceable(1) %1, i64 noundef 64) #24\n ...\n }\n\nThe above code calculates the address of the last char in the buffer\n(value %15) and then loads from it (value %16). Because the buffer is\nnever initialized, the LLVM GVN pass marks value %16 as undefined:\n\n %13 = getelementptr inbounds i8, ptr %1, i64 63\n br i1 undef, label %14, label %17\n\nThis gives later passes (SCCP, in particular) more DCE opportunities by\npropagating the undef value further, and eventually removes everything\nafter the load on the uninitialized stack location:\n\n define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #0 section \".init.text\" align 16 !kcfi_type !11 {\n %1 = alloca [64 x i8], align 16\n ...\n\n 12: ; preds = %11\n %13 = getelementptr inbounds i8, ptr %1, i64 63\n unreachable\n }\n\nIn this way, the generated native code will just fall through to the\nnext function, as LLVM does not generate any code for the unreachable IR\ninstruction and leaves the function without a terminator.\n\nZero the on-stack buffer to avoid this possible UB.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:21:55.698Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/31d1ddc1ce8e8d3f101a679243abb42a313ee88a", }, { url: "https://git.kernel.org/stable/c/0b2cbed82b7c6504a8a0fbd181f92dd56b432c12", }, { url: "https://git.kernel.org/stable/c/d6e1776f51c95827142f1d7064118e255e2deec1", }, { url: "https://git.kernel.org/stable/c/664d0feab92495b6a27edc3d1119e232c0fe8b2b", }, { url: "https://git.kernel.org/stable/c/124834133b32f9386bb2d8581d9ab92f65e951e4", }, { url: "https://git.kernel.org/stable/c/48130002e64fd191b7d18efeb4d253fcc23e4688", }, { url: "https://git.kernel.org/stable/c/146b6f1112eb30a19776d6c323c994e9d67790db", }, ], title: "ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-53680", datePublished: "2025-01-11T12:25:21.794Z", dateReserved: "2025-01-09T09:49:29.723Z", dateUpdated: "2025-01-20T06:21:55.698Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-49569
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: unquiesce admin_q before destroy it
Kernel will hang on destroy admin_q while we create ctrl failed, such
as following calltrace:
PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme"
#0 [ff61d23de260fb78] __schedule at ffffffff8323bc15
#1 [ff61d23de260fc08] schedule at ffffffff8323c014
#2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1
#3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a
#4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006
#5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce
#6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced
#7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b
#8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362
#9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25
RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202
RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574
RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004
RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004
R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500
ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b
This due to we have quiesced admi_q before cancel requests, but forgot
to unquiesce before destroy it, as a result we fail to drain the
pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here
try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and
simplify the code.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/nvme/host/rdma.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "05b436f3cf65c957eff86c5ea5ddfa2604b32c63", status: "affected", version: "958dc1d32c80566f58d18f05ef1f05bd32d172c1", versionType: "git", }, { lessThan: "5858b687559809f05393af745cbadf06dee61295", status: "affected", version: "958dc1d32c80566f58d18f05ef1f05bd32d172c1", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/nvme/host/rdma.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.12", }, { lessThan: "5.12", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: unquiesce admin_q before destroy it\n\nKernel will hang on destroy admin_q while we create ctrl failed, such\nas following calltrace:\n\nPID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: \"nvme\"\n #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15\n #1 [ff61d23de260fc08] schedule at ffffffff8323c014\n #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1\n #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a\n #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006\n #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce\n #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced\n #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b\n #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362\n #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25\n RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202\n RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574\n RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004\n RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90\n R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004\n R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500\n ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b\n\nThis due to we have quiesced admi_q before cancel requests, but forgot\nto unquiesce before destroy it, as a result we fail to drain the\npending requests, and hang on blk_mq_freeze_queue_wait() forever. Here\ntry to reuse nvme_rdma_teardown_admin_queue() to fix this issue and\nsimplify the code.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:17.469Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/05b436f3cf65c957eff86c5ea5ddfa2604b32c63", }, { url: "https://git.kernel.org/stable/c/5858b687559809f05393af745cbadf06dee61295", }, ], title: "nvme-rdma: unquiesce admin_q before destroy it", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-49569", datePublished: "2025-01-11T12:25:19.455Z", dateReserved: "2025-01-09T09:50:31.772Z", dateUpdated: "2025-01-20T06:19:17.469Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57805
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
The linkDMA should not be released on stop trigger since a stream re-start
might happen without closing of the stream. This leaves a short time for
other streams to 'steal' the linkDMA since it has been released.
This issue is not easy to reproduce under normal conditions as usually
after stop the stream is closed, or the same stream is restarted, but if
another stream got in between the stop and start, like this:
aplay -Dhw:0,3 -c2 -r48000 -fS32_LE /dev/zero -d 120
CTRL+z
aplay -Dhw:0,0 -c2 -r48000 -fS32_LE /dev/zero -d 120
then the link DMA channels will be mixed up, resulting firmware error or
crash.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "sound/soc/sof/intel/hda-dai.c", "sound/soc/sof/intel/hda.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "909ecf15cb70f78cdb5c930f58df01db039a0ff8", status: "affected", version: "ab5593793e9088abcddce30ba8e376e31b7285fd", versionType: "git", }, { lessThan: "e8d0ba147d901022bcb69da8d8fd817f84e9f3ca", status: "affected", version: "ab5593793e9088abcddce30ba8e376e31b7285fd", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "sound/soc/sof/intel/hda-dai.c", "sound/soc/sof/intel/hda.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.12", }, { lessThan: "6.12", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP\n\nThe linkDMA should not be released on stop trigger since a stream re-start\nmight happen without closing of the stream. This leaves a short time for\nother streams to 'steal' the linkDMA since it has been released.\n\nThis issue is not easy to reproduce under normal conditions as usually\nafter stop the stream is closed, or the same stream is restarted, but if\nanother stream got in between the stop and start, like this:\naplay -Dhw:0,3 -c2 -r48000 -fS32_LE /dev/zero -d 120\nCTRL+z\naplay -Dhw:0,0 -c2 -r48000 -fS32_LE /dev/zero -d 120\n\nthen the link DMA channels will be mixed up, resulting firmware error or\ncrash.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:24.169Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/909ecf15cb70f78cdb5c930f58df01db039a0ff8", }, { url: "https://git.kernel.org/stable/c/e8d0ba147d901022bcb69da8d8fd817f84e9f3ca", }, ], title: "ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57805", datePublished: "2025-01-11T12:39:51.798Z", dateReserved: "2025-01-11T12:32:49.459Z", dateUpdated: "2025-01-20T06:28:24.169Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-55639
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: renesas: rswitch: avoid use-after-put for a device tree node
The device tree node saved in the rswitch_device structure is used at
several driver locations. So passing this node to of_node_put() after
the first use is wrong.
Move of_node_put() for this node to exit paths.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/net/ethernet/renesas/rswitch.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "bf8c6755f02029d1eddc3ff19b870240f054afc7", status: "affected", version: "b46f1e5793298c67efc2f1b917350a2cefacf9d6", versionType: "git", }, { lessThan: "92007a28f95413058a7268dc84e5f44b700165d1", status: "affected", version: "b46f1e5793298c67efc2f1b917350a2cefacf9d6", versionType: "git", }, { lessThan: "66b7e9f85b8459c823b11e9af69dbf4be5eb6be8", status: "affected", version: "b46f1e5793298c67efc2f1b917350a2cefacf9d6", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/net/ethernet/renesas/rswitch.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.3", }, { lessThan: "6.3", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.67", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: renesas: rswitch: avoid use-after-put for a device tree node\n\nThe device tree node saved in the rswitch_device structure is used at\nseveral driver locations. So passing this node to of_node_put() after\nthe first use is wrong.\n\nMove of_node_put() for this node to exit paths.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:12.410Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/bf8c6755f02029d1eddc3ff19b870240f054afc7", }, { url: "https://git.kernel.org/stable/c/92007a28f95413058a7268dc84e5f44b700165d1", }, { url: "https://git.kernel.org/stable/c/66b7e9f85b8459c823b11e9af69dbf4be5eb6be8", }, ], title: "net: renesas: rswitch: avoid use-after-put for a device tree node", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-55639", datePublished: "2025-01-11T12:29:55.309Z", dateReserved: "2025-01-09T09:51:32.415Z", dateUpdated: "2025-01-20T06:22:12.410Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-41932
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:18
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched: fix warning in sched_setaffinity
Commit 8f9ea86fdf99b added some logic to sched_setaffinity that included
a WARN when a per-task affinity assignment races with a cpuset update.
Specifically, we can have a race where a cpuset update results in the
task affinity no longer being a subset of the cpuset. That's fine; we
have a fallback to instead use the cpuset mask. However, we have a WARN
set up that will trigger if the cpuset mask has no overlap at all with
the requested task affinity. This shouldn't be a warning condition; its
trivial to create this condition.
Reproduced the warning by the following setup:
- $PID inside a cpuset cgroup
- another thread repeatedly switching the cpuset cpus from 1-2 to just 1
- another thread repeatedly setting the $PID affinity (via taskset) to 2
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "kernel/sched/syscalls.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "5c3fb75f538cfcb886f6dfeb497d99fc2f263ee6", status: "affected", version: "8f9ea86fdf99b81458cc21fc1c591fcd4a0fa1f4", versionType: "git", }, { lessThan: "70ee7947a29029736a1a06c73a48ff37674a851b", status: "affected", version: "8f9ea86fdf99b81458cc21fc1c591fcd4a0fa1f4", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "kernel/sched/syscalls.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.2", }, { lessThan: "6.2", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: fix warning in sched_setaffinity\n\nCommit 8f9ea86fdf99b added some logic to sched_setaffinity that included\na WARN when a per-task affinity assignment races with a cpuset update.\n\nSpecifically, we can have a race where a cpuset update results in the\ntask affinity no longer being a subset of the cpuset. That's fine; we\nhave a fallback to instead use the cpuset mask. However, we have a WARN\nset up that will trigger if the cpuset mask has no overlap at all with\nthe requested task affinity. This shouldn't be a warning condition; its\ntrivial to create this condition.\n\nReproduced the warning by the following setup:\n\n- $PID inside a cpuset cgroup\n- another thread repeatedly switching the cpuset cpus from 1-2 to just 1\n- another thread repeatedly setting the $PID affinity (via taskset) to 2", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:18:57.530Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/5c3fb75f538cfcb886f6dfeb497d99fc2f263ee6", }, { url: "https://git.kernel.org/stable/c/70ee7947a29029736a1a06c73a48ff37674a851b", }, ], title: "sched: fix warning in sched_setaffinity", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-41932", datePublished: "2025-01-11T12:25:08.892Z", dateReserved: "2025-01-09T09:51:32.405Z", dateUpdated: "2025-01-20T06:18:57.530Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-54193
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
Move pm_runtime_set_active() to ivpu_pm_init() so when
ivpu_ipc_send_receive_internal() is executed before ivpu_pm_enable()
it already has correct runtime state, even if last resume was
not successful.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/accel/ivpu/ivpu_pm.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "578874b2bb947e047708f4df286e4ff1ba6be3ad", status: "affected", version: "8ed520ff4682aaaef7d124bd9c0950092fddb9c1", versionType: "git", }, { lessThan: "0f6482caa6acdfdfc744db7430771fe7e6c4e787", status: "affected", version: "8ed520ff4682aaaef7d124bd9c0950092fddb9c1", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/accel/ivpu/ivpu_pm.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.7", }, { lessThan: "6.7", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()\n\nMove pm_runtime_set_active() to ivpu_pm_init() so when\nivpu_ipc_send_receive_internal() is executed before ivpu_pm_enable()\nit already has correct runtime state, even if last resume was\nnot successful.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:06.638Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/578874b2bb947e047708f4df286e4ff1ba6be3ad", }, { url: "https://git.kernel.org/stable/c/0f6482caa6acdfdfc744db7430771fe7e6c4e787", }, ], title: "accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-54193", datePublished: "2025-01-11T12:35:41.727Z", dateReserved: "2025-01-11T12:34:02.648Z", dateUpdated: "2025-01-20T06:22:06.638Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57806
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix transaction atomicity bug when enabling simple quotas
Set squota incompat bit before committing the transaction that enables
the feature.
With the config CONFIG_BTRFS_ASSERT enabled, an assertion
failure occurs regarding the simple quota feature.
[5.596534] assertion failed: btrfs_fs_incompat(fs_info, SIMPLE_QUOTA), in fs/btrfs/qgroup.c:365
[5.597098] ------------[ cut here ]------------
[5.597371] kernel BUG at fs/btrfs/qgroup.c:365!
[5.597946] CPU: 1 UID: 0 PID: 268 Comm: mount Not tainted 6.13.0-rc2-00031-gf92f4749861b #146
[5.598450] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[5.599008] RIP: 0010:btrfs_read_qgroup_config+0x74d/0x7a0
[5.604303] <TASK>
[5.605230] ? btrfs_read_qgroup_config+0x74d/0x7a0
[5.605538] ? exc_invalid_op+0x56/0x70
[5.605775] ? btrfs_read_qgroup_config+0x74d/0x7a0
[5.606066] ? asm_exc_invalid_op+0x1f/0x30
[5.606441] ? btrfs_read_qgroup_config+0x74d/0x7a0
[5.606741] ? btrfs_read_qgroup_config+0x74d/0x7a0
[5.607038] ? try_to_wake_up+0x317/0x760
[5.607286] open_ctree+0xd9c/0x1710
[5.607509] btrfs_get_tree+0x58a/0x7e0
[5.608002] vfs_get_tree+0x2e/0x100
[5.608224] fc_mount+0x16/0x60
[5.608420] btrfs_get_tree+0x2f8/0x7e0
[5.608897] vfs_get_tree+0x2e/0x100
[5.609121] path_mount+0x4c8/0xbc0
[5.609538] __x64_sys_mount+0x10d/0x150
The issue can be easily reproduced using the following reproducer:
root@q:linux# cat repro.sh
set -e
mkfs.btrfs -q -f /dev/sdb
mount /dev/sdb /mnt/btrfs
btrfs quota enable -s /mnt/btrfs
umount /mnt/btrfs
mount /dev/sdb /mnt/btrfs
The issue is that when enabling quotas, at btrfs_quota_enable(), we set
BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE at fs_info->qgroup_flags and persist
it in the quota root in the item with the key BTRFS_QGROUP_STATUS_KEY, but
we only set the incompat bit BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA after we
commit the transaction used to enable simple quotas.
This means that if after that transaction commit we unmount the filesystem
without starting and committing any other transaction, or we have a power
failure, the next time we mount the filesystem we will find the flag
BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE set in the item with the key
BTRFS_QGROUP_STATUS_KEY but we will not find the incompat bit
BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA set in the superblock, triggering an
assertion failure at:
btrfs_read_qgroup_config() -> qgroup_read_enable_gen()
To fix this issue, set the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA flag
immediately after setting the BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE.
This ensures that both flags are flushed to disk within the same
transaction.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/btrfs/qgroup.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "b87c9b9ba05ba6e8e2ee9ecd29a8c930b35648ed", status: "affected", version: "182940f4f4dbd932776414744c8de64333957725", versionType: "git", }, { lessThan: "f2363e6fcc7938c5f0f6ac066fad0dd247598b51", status: "affected", version: "182940f4f4dbd932776414744c8de64333957725", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/btrfs/qgroup.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.7", }, { lessThan: "6.7", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix transaction atomicity bug when enabling simple quotas\n\nSet squota incompat bit before committing the transaction that enables\nthe feature.\n\nWith the config CONFIG_BTRFS_ASSERT enabled, an assertion\nfailure occurs regarding the simple quota feature.\n\n [5.596534] assertion failed: btrfs_fs_incompat(fs_info, SIMPLE_QUOTA), in fs/btrfs/qgroup.c:365\n [5.597098] ------------[ cut here ]------------\n [5.597371] kernel BUG at fs/btrfs/qgroup.c:365!\n [5.597946] CPU: 1 UID: 0 PID: 268 Comm: mount Not tainted 6.13.0-rc2-00031-gf92f4749861b #146\n [5.598450] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n [5.599008] RIP: 0010:btrfs_read_qgroup_config+0x74d/0x7a0\n [5.604303] <TASK>\n [5.605230] ? btrfs_read_qgroup_config+0x74d/0x7a0\n [5.605538] ? exc_invalid_op+0x56/0x70\n [5.605775] ? btrfs_read_qgroup_config+0x74d/0x7a0\n [5.606066] ? asm_exc_invalid_op+0x1f/0x30\n [5.606441] ? btrfs_read_qgroup_config+0x74d/0x7a0\n [5.606741] ? btrfs_read_qgroup_config+0x74d/0x7a0\n [5.607038] ? try_to_wake_up+0x317/0x760\n [5.607286] open_ctree+0xd9c/0x1710\n [5.607509] btrfs_get_tree+0x58a/0x7e0\n [5.608002] vfs_get_tree+0x2e/0x100\n [5.608224] fc_mount+0x16/0x60\n [5.608420] btrfs_get_tree+0x2f8/0x7e0\n [5.608897] vfs_get_tree+0x2e/0x100\n [5.609121] path_mount+0x4c8/0xbc0\n [5.609538] __x64_sys_mount+0x10d/0x150\n\nThe issue can be easily reproduced using the following reproducer:\n\n root@q:linux# cat repro.sh\n set -e\n\n mkfs.btrfs -q -f /dev/sdb\n mount /dev/sdb /mnt/btrfs\n btrfs quota enable -s /mnt/btrfs\n umount /mnt/btrfs\n mount /dev/sdb /mnt/btrfs\n\nThe issue is that when enabling quotas, at btrfs_quota_enable(), we set\nBTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE at fs_info->qgroup_flags and persist\nit in the quota root in the item with the key BTRFS_QGROUP_STATUS_KEY, but\nwe only set the incompat bit BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA after we\ncommit the transaction used to enable simple quotas.\n\nThis means that if after that transaction commit we unmount the filesystem\nwithout starting and committing any other transaction, or we have a power\nfailure, the next time we mount the filesystem we will find the flag\nBTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE set in the item with the key\nBTRFS_QGROUP_STATUS_KEY but we will not find the incompat bit\nBTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA set in the superblock, triggering an\nassertion failure at:\n\n btrfs_read_qgroup_config() -> qgroup_read_enable_gen()\n\nTo fix this issue, set the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA flag\nimmediately after setting the BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE.\nThis ensures that both flags are flushed to disk within the same\ntransaction.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:25.314Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/b87c9b9ba05ba6e8e2ee9ecd29a8c930b35648ed", }, { url: "https://git.kernel.org/stable/c/f2363e6fcc7938c5f0f6ac066fad0dd247598b51", }, ], title: "btrfs: fix transaction atomicity bug when enabling simple quotas", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57806", datePublished: "2025-01-11T12:39:52.628Z", dateReserved: "2025-01-11T12:32:49.322Z", dateUpdated: "2025-01-20T06:28:25.314Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-23125
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2025-01-11T14:40:03.813Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, rejectedReasons: [ { lang: "en", value: "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", }, ], }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2025-23125", datePublished: "2025-01-11T14:31:02.416Z", dateRejected: "2025-01-11T14:40:03.813Z", dateReserved: "2025-01-11T14:28:41.510Z", dateUpdated: "2025-01-11T14:40:03.813Z", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-53682
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:21
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
regulator: axp20x: AXP717: set ramp_delay
AXP717 datasheet says that regulator ramp delay is 15.625 us/step,
which is 10mV in our case.
Add a AXP_DESC_RANGES_DELAY macro and update AXP_DESC_RANGES macro to
expand to AXP_DESC_RANGES_DELAY with ramp_delay = 0
For DCDC4, steps is 100mv
Add a AXP_DESC_DELAY macro and update AXP_DESC macro to
expand to AXP_DESC_DELAY with ramp_delay = 0
This patch fix crashes when using CPU DVFS.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/regulator/axp20x-regulator.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "10eb845a87193ef922cd002e0ff4f4759c1e918d", status: "affected", version: "d2ac3df75c3a995064cfac0171e082a30d8c4c66", versionType: "git", }, { lessThan: "f07ae52f5cf6a5584fdf7c8c652f027d90bc8b74", status: "affected", version: "d2ac3df75c3a995064cfac0171e082a30d8c4c66", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/regulator/axp20x-regulator.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.10", }, { lessThan: "6.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: axp20x: AXP717: set ramp_delay\n\nAXP717 datasheet says that regulator ramp delay is 15.625 us/step,\nwhich is 10mV in our case.\n\nAdd a AXP_DESC_RANGES_DELAY macro and update AXP_DESC_RANGES macro to\nexpand to AXP_DESC_RANGES_DELAY with ramp_delay = 0\n\nFor DCDC4, steps is 100mv\n\nAdd a AXP_DESC_DELAY macro and update AXP_DESC macro to\nexpand to AXP_DESC_DELAY with ramp_delay = 0\n\nThis patch fix crashes when using CPU DVFS.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:21:58.351Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/10eb845a87193ef922cd002e0ff4f4759c1e918d", }, { url: "https://git.kernel.org/stable/c/f07ae52f5cf6a5584fdf7c8c652f027d90bc8b74", }, ], title: "regulator: axp20x: AXP717: set ramp_delay", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-53682", datePublished: "2025-01-11T12:29:49.692Z", dateReserved: "2025-01-09T09:50:31.747Z", dateUpdated: "2025-01-20T06:21:58.351Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-45828
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when
the ring is being stopped. Depending on timing between ring stop request
completion, interrupt handler removal and code execution this may lead
to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run
after the io_data pointer is set to NULL in hci_dma_cleanup().
Prevent this my masking the ring interrupts before ring stop request.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/i3c/master/mipi-i3c-hci/dma.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "a6cddf68b3405b272b5a3cad9657be0b02b34bf4", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "9d745a56aea45e47f4755bc12e6429d6314dbb54", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "a6dc4b4fda2e147e557050eaae51ff15edeb680b", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "19cc5767334bfe980f52421627d0826c0da86721", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "6ca2738174e4ee44edb2ab2d86ce74f015a0cc32", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/i3c/master/mipi-i3c-hci/dma.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.0", }, { lessThan: "5.0", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Mask ring interrupts before ring stop request\n\nBus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when\nthe ring is being stopped. Depending on timing between ring stop request\ncompletion, interrupt handler removal and code execution this may lead\nto a NULL pointer dereference in hci_dma_irq_handler() if it gets to run\nafter the io_data pointer is set to NULL in hci_dma_cleanup().\n\nPrevent this my masking the ring interrupts before ring stop request.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:00.977Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/a6cddf68b3405b272b5a3cad9657be0b02b34bf4", }, { url: "https://git.kernel.org/stable/c/9d745a56aea45e47f4755bc12e6429d6314dbb54", }, { url: "https://git.kernel.org/stable/c/a6dc4b4fda2e147e557050eaae51ff15edeb680b", }, { url: "https://git.kernel.org/stable/c/19cc5767334bfe980f52421627d0826c0da86721", }, { url: "https://git.kernel.org/stable/c/6ca2738174e4ee44edb2ab2d86ce74f015a0cc32", }, ], title: "i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-45828", datePublished: "2025-01-11T12:25:11.560Z", dateReserved: "2025-01-09T09:51:32.498Z", dateUpdated: "2025-01-20T06:19:00.977Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-46896
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: don't access invalid sched
Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()")
accessing job->base.sched can produce unexpected results as the initialisation
of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the
memset.
This commit fixes an issue when a CS would fail validation and would
be rejected after job->num_ibs is incremented. In this case,
amdgpu_ib_free(ring->adev, ...) will be called, which would crash the
machine because the ring value is bogus.
To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this
because the device is actually not used in this function.
The next commit will remove the ring argument completely.
(cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 166df51487f46b6e997dfeea7ca0c2a970853f07 Version: 87210234e5a273ebf9c4110a6aa82b8221478daa Version: 2da108b4b5fb7ec04d7e951418ed80e97f7c35ad Version: 2320c9e6a768d135c7b0039995182bb1a4e4fd22 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/gpu/drm/amd/amdgpu/amdgpu_job.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "65501a4fd84ecdc0af863dbb37759242aab9f2dd", status: "affected", version: "166df51487f46b6e997dfeea7ca0c2a970853f07", versionType: "git", }, { lessThan: "da6b2c626ae73c303378ce9eaf6e3eaf16c9925a", status: "affected", version: "87210234e5a273ebf9c4110a6aa82b8221478daa", versionType: "git", }, { lessThan: "67291d601f2b032062b1b2f60ffef1b63e10094c", status: "affected", version: "2da108b4b5fb7ec04d7e951418ed80e97f7c35ad", versionType: "git", }, { lessThan: "a93b1020eb9386d7da11608477121b10079c076a", status: "affected", version: "2320c9e6a768d135c7b0039995182bb1a4e4fd22", versionType: "git", }, ], }, { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/gpu/drm/amd/amdgpu/amdgpu_job.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "6.1.122", status: "affected", version: "6.1.120", versionType: "semver", }, { lessThan: "6.6.68", status: "affected", version: "6.6.66", versionType: "semver", }, { lessThan: "6.12.7", status: "affected", version: "6.12.5", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: don't access invalid sched\n\nSince 2320c9e6a768 (\"drm/sched: memset() 'job' in drm_sched_job_init()\")\naccessing job->base.sched can produce unexpected results as the initialisation\nof (*job)->base.sched done in amdgpu_job_alloc is overwritten by the\nmemset.\n\nThis commit fixes an issue when a CS would fail validation and would\nbe rejected after job->num_ibs is incremented. In this case,\namdgpu_ib_free(ring->adev, ...) will be called, which would crash the\nmachine because the ring value is bogus.\n\nTo fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this\nbecause the device is actually not used in this function.\n\nThe next commit will remove the ring argument completely.\n\n(cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:02.196Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/65501a4fd84ecdc0af863dbb37759242aab9f2dd", }, { url: "https://git.kernel.org/stable/c/da6b2c626ae73c303378ce9eaf6e3eaf16c9925a", }, { url: "https://git.kernel.org/stable/c/67291d601f2b032062b1b2f60ffef1b63e10094c", }, { url: "https://git.kernel.org/stable/c/a93b1020eb9386d7da11608477121b10079c076a", }, ], title: "drm/amdgpu: don't access invalid sched", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-46896", datePublished: "2025-01-11T12:35:34.351Z", dateReserved: "2025-01-11T12:33:33.708Z", dateUpdated: "2025-01-20T06:19:02.196Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-23127
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2025-01-11T14:41:48.188Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, rejectedReasons: [ { lang: "en", value: "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", }, ], }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2025-23127", datePublished: "2025-01-11T14:31:03.969Z", dateRejected: "2025-01-11T14:41:48.188Z", dateReserved: "2025-01-11T14:28:41.510Z", dateUpdated: "2025-01-11T14:41:48.188Z", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-52319
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: use aligned address in clear_gigantic_page()
In current kernel, hugetlb_no_page() calls folio_zero_user() with the
fault address. Where the fault address may be not aligned with the huge
page size. Then, folio_zero_user() may call clear_gigantic_page() with
the address, while clear_gigantic_page() requires the address to be huge
page size aligned. So, this may cause memory corruption or information
leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for
clear_gigantic_page().
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/hugetlbfs/inode.c", "mm/memory.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "b79b6fe0737f233f0be1465052b7f0e75f324735", status: "affected", version: "78fefd04c123493bbf28434768fa577b2153c79b", versionType: "git", }, { lessThan: "8aca2bc96c833ba695ede7a45ad7784c836a262e", status: "affected", version: "78fefd04c123493bbf28434768fa577b2153c79b", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/hugetlbfs/inode.c", "mm/memory.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.11", }, { lessThan: "6.11", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: use aligned address in clear_gigantic_page()\n\nIn current kernel, hugetlb_no_page() calls folio_zero_user() with the\nfault address. Where the fault address may be not aligned with the huge\npage size. Then, folio_zero_user() may call clear_gigantic_page() with\nthe address, while clear_gigantic_page() requires the address to be huge\npage size aligned. So, this may cause memory corruption or information\nleak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for\nclear_gigantic_page().", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:34.290Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/b79b6fe0737f233f0be1465052b7f0e75f324735", }, { url: "https://git.kernel.org/stable/c/8aca2bc96c833ba695ede7a45ad7784c836a262e", }, ], title: "mm: use aligned address in clear_gigantic_page()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-52319", datePublished: "2025-01-11T12:35:39.280Z", dateReserved: "2025-01-11T12:33:33.694Z", dateUpdated: "2025-01-20T06:19:34.290Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-53687
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv: Fix IPIs usage in kfence_protect_page()
flush_tlb_kernel_range() may use IPIs to flush the TLBs of all the
cores, which triggers the following warning when the irqs are disabled:
[ 3.455330] WARNING: CPU: 1 PID: 0 at kernel/smp.c:815 smp_call_function_many_cond+0x452/0x520
[ 3.456647] Modules linked in:
[ 3.457218] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7-00010-g91d3de7240b8 #1
[ 3.457416] Hardware name: QEMU QEMU Virtual Machine, BIOS
[ 3.457633] epc : smp_call_function_many_cond+0x452/0x520
[ 3.457736] ra : on_each_cpu_cond_mask+0x1e/0x30
[ 3.457786] epc : ffffffff800b669a ra : ffffffff800b67c2 sp : ff2000000000bb50
[ 3.457824] gp : ffffffff815212b8 tp : ff6000008014f080 t0 : 000000000000003f
[ 3.457859] t1 : ffffffff815221e0 t2 : 000000000000000f s0 : ff2000000000bc10
[ 3.457920] s1 : 0000000000000040 a0 : ffffffff815221e0 a1 : 0000000000000001
[ 3.457953] a2 : 0000000000010000 a3 : 0000000000000003 a4 : 0000000000000000
[ 3.458006] a5 : 0000000000000000 a6 : ffffffffffffffff a7 : 0000000000000000
[ 3.458042] s2 : ffffffff815223be s3 : 00fffffffffff000 s4 : ff600001ffe38fc0
[ 3.458076] s5 : ff600001ff950d00 s6 : 0000000200000120 s7 : 0000000000000001
[ 3.458109] s8 : 0000000000000001 s9 : ff60000080841ef0 s10: 0000000000000001
[ 3.458141] s11: ffffffff81524812 t3 : 0000000000000001 t4 : ff60000080092bc0
[ 3.458172] t5 : 0000000000000000 t6 : ff200000000236d0
[ 3.458203] status: 0000000200000100 badaddr: ffffffff800b669a cause: 0000000000000003
[ 3.458373] [<ffffffff800b669a>] smp_call_function_many_cond+0x452/0x520
[ 3.458593] [<ffffffff800b67c2>] on_each_cpu_cond_mask+0x1e/0x30
[ 3.458625] [<ffffffff8000e4ca>] __flush_tlb_range+0x118/0x1ca
[ 3.458656] [<ffffffff8000e6b2>] flush_tlb_kernel_range+0x1e/0x26
[ 3.458683] [<ffffffff801ea56a>] kfence_protect+0xc0/0xce
[ 3.458717] [<ffffffff801e9456>] kfence_guarded_free+0xc6/0x1c0
[ 3.458742] [<ffffffff801e9d6c>] __kfence_free+0x62/0xc6
[ 3.458764] [<ffffffff801c57d8>] kfree+0x106/0x32c
[ 3.458786] [<ffffffff80588cf2>] detach_buf_split+0x188/0x1a8
[ 3.458816] [<ffffffff8058708c>] virtqueue_get_buf_ctx+0xb6/0x1f6
[ 3.458839] [<ffffffff805871da>] virtqueue_get_buf+0xe/0x16
[ 3.458880] [<ffffffff80613d6a>] virtblk_done+0x5c/0xe2
[ 3.458908] [<ffffffff8058766e>] vring_interrupt+0x6a/0x74
[ 3.458930] [<ffffffff800747d8>] __handle_irq_event_percpu+0x7c/0xe2
[ 3.458956] [<ffffffff800748f0>] handle_irq_event+0x3c/0x86
[ 3.458978] [<ffffffff800786cc>] handle_simple_irq+0x9e/0xbe
[ 3.459004] [<ffffffff80073934>] generic_handle_domain_irq+0x1c/0x2a
[ 3.459027] [<ffffffff804bf87c>] imsic_handle_irq+0xba/0x120
[ 3.459056] [<ffffffff80073934>] generic_handle_domain_irq+0x1c/0x2a
[ 3.459080] [<ffffffff804bdb76>] riscv_intc_aia_irq+0x24/0x34
[ 3.459103] [<ffffffff809d0452>] handle_riscv_irq+0x2e/0x4c
[ 3.459133] [<ffffffff809d923e>] call_on_irq_stack+0x32/0x40
So only flush the local TLB and let the lazy kfence page fault handling
deal with the faults which could happen when a core has an old protected
pte version cached in its TLB. That leads to potential inaccuracies which
can be tolerated when using kfence.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "arch/riscv/include/asm/kfence.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "6f796a6a396d6f963f2cc8f5edd7dfba2cca097f", status: "affected", version: "47513f243b452a5e21180dcf3d6ac1c57e1781a6", versionType: "git", }, { lessThan: "3abfc4130c4222099c69d023fed97f1180a8ad7b", status: "affected", version: "47513f243b452a5e21180dcf3d6ac1c57e1781a6", versionType: "git", }, { lessThan: "b3431a8bb336cece8adc452437befa7d4534b2fd", status: "affected", version: "47513f243b452a5e21180dcf3d6ac1c57e1781a6", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "arch/riscv/include/asm/kfence.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.14", }, { lessThan: "5.14", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.67", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Fix IPIs usage in kfence_protect_page()\n\nflush_tlb_kernel_range() may use IPIs to flush the TLBs of all the\ncores, which triggers the following warning when the irqs are disabled:\n\n[ 3.455330] WARNING: CPU: 1 PID: 0 at kernel/smp.c:815 smp_call_function_many_cond+0x452/0x520\n[ 3.456647] Modules linked in:\n[ 3.457218] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7-00010-g91d3de7240b8 #1\n[ 3.457416] Hardware name: QEMU QEMU Virtual Machine, BIOS\n[ 3.457633] epc : smp_call_function_many_cond+0x452/0x520\n[ 3.457736] ra : on_each_cpu_cond_mask+0x1e/0x30\n[ 3.457786] epc : ffffffff800b669a ra : ffffffff800b67c2 sp : ff2000000000bb50\n[ 3.457824] gp : ffffffff815212b8 tp : ff6000008014f080 t0 : 000000000000003f\n[ 3.457859] t1 : ffffffff815221e0 t2 : 000000000000000f s0 : ff2000000000bc10\n[ 3.457920] s1 : 0000000000000040 a0 : ffffffff815221e0 a1 : 0000000000000001\n[ 3.457953] a2 : 0000000000010000 a3 : 0000000000000003 a4 : 0000000000000000\n[ 3.458006] a5 : 0000000000000000 a6 : ffffffffffffffff a7 : 0000000000000000\n[ 3.458042] s2 : ffffffff815223be s3 : 00fffffffffff000 s4 : ff600001ffe38fc0\n[ 3.458076] s5 : ff600001ff950d00 s6 : 0000000200000120 s7 : 0000000000000001\n[ 3.458109] s8 : 0000000000000001 s9 : ff60000080841ef0 s10: 0000000000000001\n[ 3.458141] s11: ffffffff81524812 t3 : 0000000000000001 t4 : ff60000080092bc0\n[ 3.458172] t5 : 0000000000000000 t6 : ff200000000236d0\n[ 3.458203] status: 0000000200000100 badaddr: ffffffff800b669a cause: 0000000000000003\n[ 3.458373] [<ffffffff800b669a>] smp_call_function_many_cond+0x452/0x520\n[ 3.458593] [<ffffffff800b67c2>] on_each_cpu_cond_mask+0x1e/0x30\n[ 3.458625] [<ffffffff8000e4ca>] __flush_tlb_range+0x118/0x1ca\n[ 3.458656] [<ffffffff8000e6b2>] flush_tlb_kernel_range+0x1e/0x26\n[ 3.458683] [<ffffffff801ea56a>] kfence_protect+0xc0/0xce\n[ 3.458717] [<ffffffff801e9456>] kfence_guarded_free+0xc6/0x1c0\n[ 3.458742] [<ffffffff801e9d6c>] __kfence_free+0x62/0xc6\n[ 3.458764] [<ffffffff801c57d8>] kfree+0x106/0x32c\n[ 3.458786] [<ffffffff80588cf2>] detach_buf_split+0x188/0x1a8\n[ 3.458816] [<ffffffff8058708c>] virtqueue_get_buf_ctx+0xb6/0x1f6\n[ 3.458839] [<ffffffff805871da>] virtqueue_get_buf+0xe/0x16\n[ 3.458880] [<ffffffff80613d6a>] virtblk_done+0x5c/0xe2\n[ 3.458908] [<ffffffff8058766e>] vring_interrupt+0x6a/0x74\n[ 3.458930] [<ffffffff800747d8>] __handle_irq_event_percpu+0x7c/0xe2\n[ 3.458956] [<ffffffff800748f0>] handle_irq_event+0x3c/0x86\n[ 3.458978] [<ffffffff800786cc>] handle_simple_irq+0x9e/0xbe\n[ 3.459004] [<ffffffff80073934>] generic_handle_domain_irq+0x1c/0x2a\n[ 3.459027] [<ffffffff804bf87c>] imsic_handle_irq+0xba/0x120\n[ 3.459056] [<ffffffff80073934>] generic_handle_domain_irq+0x1c/0x2a\n[ 3.459080] [<ffffffff804bdb76>] riscv_intc_aia_irq+0x24/0x34\n[ 3.459103] [<ffffffff809d0452>] handle_riscv_irq+0x2e/0x4c\n[ 3.459133] [<ffffffff809d923e>] call_on_irq_stack+0x32/0x40\n\nSo only flush the local TLB and let the lazy kfence page fault handling\ndeal with the faults which could happen when a core has an old protected\npte version cached in its TLB. That leads to potential inaccuracies which\ncan be tolerated when using kfence.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:00.689Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/6f796a6a396d6f963f2cc8f5edd7dfba2cca097f", }, { url: "https://git.kernel.org/stable/c/3abfc4130c4222099c69d023fed97f1180a8ad7b", }, { url: "https://git.kernel.org/stable/c/b3431a8bb336cece8adc452437befa7d4534b2fd", }, ], title: "riscv: Fix IPIs usage in kfence_protect_page()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-53687", datePublished: "2025-01-11T12:29:50.589Z", dateReserved: "2025-01-09T09:49:29.686Z", dateUpdated: "2025-01-20T06:22:00.689Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-54455
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix general protection fault in ivpu_bo_list()
Check if ctx is not NULL before accessing its fields.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/accel/ivpu/ivpu_gem.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "a1e597ee5920a6aabdf4dfc3bf76e55e1b115e23", status: "affected", version: "37dee2a2f4330a030abc5674bcec25ccc4addbcc", versionType: "git", }, { lessThan: "4b2efb9db0c22a130bbd1275e489b42c02d08050", status: "affected", version: "37dee2a2f4330a030abc5674bcec25ccc4addbcc", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/accel/ivpu/ivpu_gem.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.8", }, { lessThan: "6.8", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Fix general protection fault in ivpu_bo_list()\n\nCheck if ctx is not NULL before accessing its fields.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:07.835Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/a1e597ee5920a6aabdf4dfc3bf76e55e1b115e23", }, { url: "https://git.kernel.org/stable/c/4b2efb9db0c22a130bbd1275e489b42c02d08050", }, ], title: "accel/ivpu: Fix general protection fault in ivpu_bo_list()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-54455", datePublished: "2025-01-11T12:35:42.392Z", dateReserved: "2025-01-11T12:32:49.400Z", dateUpdated: "2025-01-20T06:22:07.835Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57800
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: memalloc: prefer dma_mapping_error() over explicit address checking
With CONFIG_DMA_API_DEBUG enabled, the following warning is observed:
DMA-API: snd_hda_intel 0000:03:00.1: device driver failed to check map error[device address=0x00000000ffff0000] [size=20480 bytes] [mapped as single]
WARNING: CPU: 28 PID: 2255 at kernel/dma/debug.c:1036 check_unmap+0x1408/0x2430
CPU: 28 UID: 42 PID: 2255 Comm: wireplumber Tainted: G W L 6.12.0-10-133577cad6bf48e5a7848c4338124081393bfe8a+ #759
debug_dma_unmap_page+0xe9/0xf0
snd_dma_wc_free+0x85/0x130 [snd_pcm]
snd_pcm_lib_free_pages+0x1e3/0x440 [snd_pcm]
snd_pcm_common_ioctl+0x1c9a/0x2960 [snd_pcm]
snd_pcm_ioctl+0x6a/0xc0 [snd_pcm]
...
Check for returned DMA addresses using specialized dma_mapping_error()
helper which is generally recommended for this purpose by
Documentation/core-api/dma-api.rst.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "sound/core/memalloc.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "c180c3f42d340e8dcb9094bb8ea7d477d37081a8", status: "affected", version: "c880a5146642e9d35f88aaa353ae98ffd4fc3f99", versionType: "git", }, { lessThan: "fa0308134d26dbbeb209a1581eea46df663866b6", status: "affected", version: "c880a5146642e9d35f88aaa353ae98ffd4fc3f99", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "sound/core/memalloc.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.12", }, { lessThan: "6.12", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: memalloc: prefer dma_mapping_error() over explicit address checking\n\nWith CONFIG_DMA_API_DEBUG enabled, the following warning is observed:\n\nDMA-API: snd_hda_intel 0000:03:00.1: device driver failed to check map error[device address=0x00000000ffff0000] [size=20480 bytes] [mapped as single]\nWARNING: CPU: 28 PID: 2255 at kernel/dma/debug.c:1036 check_unmap+0x1408/0x2430\nCPU: 28 UID: 42 PID: 2255 Comm: wireplumber Tainted: G W L 6.12.0-10-133577cad6bf48e5a7848c4338124081393bfe8a+ #759\ndebug_dma_unmap_page+0xe9/0xf0\nsnd_dma_wc_free+0x85/0x130 [snd_pcm]\nsnd_pcm_lib_free_pages+0x1e3/0x440 [snd_pcm]\nsnd_pcm_common_ioctl+0x1c9a/0x2960 [snd_pcm]\nsnd_pcm_ioctl+0x6a/0xc0 [snd_pcm]\n...\n\nCheck for returned DMA addresses using specialized dma_mapping_error()\nhelper which is generally recommended for this purpose by\nDocumentation/core-api/dma-api.rst.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:19.566Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/c180c3f42d340e8dcb9094bb8ea7d477d37081a8", }, { url: "https://git.kernel.org/stable/c/fa0308134d26dbbeb209a1581eea46df663866b6", }, ], title: "ALSA: memalloc: prefer dma_mapping_error() over explicit address checking", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57800", datePublished: "2025-01-11T12:39:49.702Z", dateReserved: "2025-01-11T12:33:33.722Z", dateUpdated: "2025-01-20T06:28:19.566Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-47141
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinmux: Use sequential access to access desc->pinmux data
When two client of the same gpio call pinctrl_select_state() for the
same functionality, we are seeing NULL pointer issue while accessing
desc->mux_owner.
Let's say two processes A, B executing in pin_request() for the same pin
and process A updates the desc->mux_usecount but not yet updated the
desc->mux_owner while process B see the desc->mux_usecount which got
updated by A path and further executes strcmp and while accessing
desc->mux_owner it crashes with NULL pointer.
Serialize the access to mux related setting with a mutex lock.
cpu0 (process A) cpu1(process B)
pinctrl_select_state() { pinctrl_select_state() {
pin_request() { pin_request() {
...
....
} else {
desc->mux_usecount++;
desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
if (desc->mux_usecount > 1)
return 0;
desc->mux_owner = owner;
} }
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/pinctrl/core.c", "drivers/pinctrl/core.h", "drivers/pinctrl/pinmux.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "c11e2ec9a780f54982a187ee10ffd1b810715c85", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/pinctrl/core.c", "drivers/pinctrl/core.h", "drivers/pinctrl/pinmux.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\npinmux: Use sequential access to access desc->pinmux data\n\nWhen two client of the same gpio call pinctrl_select_state() for the\nsame functionality, we are seeing NULL pointer issue while accessing\ndesc->mux_owner.\n\nLet's say two processes A, B executing in pin_request() for the same pin\nand process A updates the desc->mux_usecount but not yet updated the\ndesc->mux_owner while process B see the desc->mux_usecount which got\nupdated by A path and further executes strcmp and while accessing\ndesc->mux_owner it crashes with NULL pointer.\n\nSerialize the access to mux related setting with a mutex lock.\n\n\tcpu0 (process A)\t\t\tcpu1(process B)\n\npinctrl_select_state() {\t\t pinctrl_select_state() {\n pin_request() {\t\t\t\tpin_request() {\n ...\n\t\t\t\t\t\t ....\n } else {\n desc->mux_usecount++;\n \t\t\t\t\t\tdesc->mux_usecount && strcmp(desc->mux_owner, owner)) {\n\n if (desc->mux_usecount > 1)\n return 0;\n desc->mux_owner = owner;\n\n }\t\t\t\t\t\t}", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:03.349Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b", }, { url: "https://git.kernel.org/stable/c/c11e2ec9a780f54982a187ee10ffd1b810715c85", }, { url: "https://git.kernel.org/stable/c/5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e", }, ], title: "pinmux: Use sequential access to access desc->pinmux data", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-47141", datePublished: "2025-01-11T12:25:12.399Z", dateReserved: "2025-01-09T09:50:31.758Z", dateUpdated: "2025-01-20T06:19:03.349Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57804
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-21 10:55
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
The driver, through the SAS transport, exposes a sysfs interface to
enable/disable PHYs in a controller/expander setup. When multiple PHYs
are disabled and enabled in rapid succession, the persistent and current
config pages related to SAS IO unit/SAS Expander pages could get
corrupted.
Use separate memory for each config request.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/scsi/mpi3mr/mpi3mr.h", "drivers/scsi/mpi3mr/mpi3mr_fw.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "869fdc6f0606060301aef648231e186c7c542f5a", status: "affected", version: "32d457d5a2af9bf5ddbe28297eabf1fc93451665", versionType: "git", }, { lessThan: "711201a8b8334a397440ac0b859df0054e174bc9", status: "affected", version: "32d457d5a2af9bf5ddbe28297eabf1fc93451665", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/scsi/mpi3mr/mpi3mr.h", "drivers/scsi/mpi3mr/mpi3mr_fw.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.1", }, { lessThan: "6.1", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs\n\nThe driver, through the SAS transport, exposes a sysfs interface to\nenable/disable PHYs in a controller/expander setup. When multiple PHYs\nare disabled and enabled in rapid succession, the persistent and current\nconfig pages related to SAS IO unit/SAS Expander pages could get\ncorrupted.\n\nUse separate memory for each config request.", }, ], providerMetadata: { dateUpdated: "2025-01-21T10:55:23.664Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/869fdc6f0606060301aef648231e186c7c542f5a", }, { url: "https://git.kernel.org/stable/c/711201a8b8334a397440ac0b859df0054e174bc9", }, ], title: "scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57804", datePublished: "2025-01-11T12:39:50.958Z", dateReserved: "2025-01-09T09:50:31.793Z", dateUpdated: "2025-01-21T10:55:23.664Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-54680
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2025-04-02T15:20:35.748Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, rejectedReasons: [ { lang: "en", value: "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", }, ], }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-54680", datePublished: "2025-01-11T12:35:43.170Z", dateRejected: "2025-04-02T15:20:35.748Z", dateReserved: "2025-01-11T12:33:33.715Z", dateUpdated: "2025-04-02T15:20:35.748Z", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-54460
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: iso: Fix circular lock in iso_listen_bis
This fixes the circular locking dependency warning below, by
releasing the socket lock before enterning iso_listen_bis, to
avoid any potential deadlock with hdev lock.
[ 75.307983] ======================================================
[ 75.307984] WARNING: possible circular locking dependency detected
[ 75.307985] 6.12.0-rc6+ #22 Not tainted
[ 75.307987] ------------------------------------------------------
[ 75.307987] kworker/u81:2/2623 is trying to acquire lock:
[ 75.307988] ffff8fde1769da58 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO)
at: iso_connect_cfm+0x253/0x840 [bluetooth]
[ 75.308021]
but task is already holding lock:
[ 75.308022] ffff8fdd61a10078 (&hdev->lock)
at: hci_le_per_adv_report_evt+0x47/0x2f0 [bluetooth]
[ 75.308053]
which lock already depends on the new lock.
[ 75.308054]
the existing dependency chain (in reverse order) is:
[ 75.308055]
-> #1 (&hdev->lock){+.+.}-{3:3}:
[ 75.308057] __mutex_lock+0xad/0xc50
[ 75.308061] mutex_lock_nested+0x1b/0x30
[ 75.308063] iso_sock_listen+0x143/0x5c0 [bluetooth]
[ 75.308085] __sys_listen_socket+0x49/0x60
[ 75.308088] __x64_sys_listen+0x4c/0x90
[ 75.308090] x64_sys_call+0x2517/0x25f0
[ 75.308092] do_syscall_64+0x87/0x150
[ 75.308095] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 75.308098]
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}:
[ 75.308100] __lock_acquire+0x155e/0x25f0
[ 75.308103] lock_acquire+0xc9/0x300
[ 75.308105] lock_sock_nested+0x32/0x90
[ 75.308107] iso_connect_cfm+0x253/0x840 [bluetooth]
[ 75.308128] hci_connect_cfm+0x6c/0x190 [bluetooth]
[ 75.308155] hci_le_per_adv_report_evt+0x27b/0x2f0 [bluetooth]
[ 75.308180] hci_le_meta_evt+0xe7/0x200 [bluetooth]
[ 75.308206] hci_event_packet+0x21f/0x5c0 [bluetooth]
[ 75.308230] hci_rx_work+0x3ae/0xb10 [bluetooth]
[ 75.308254] process_one_work+0x212/0x740
[ 75.308256] worker_thread+0x1bd/0x3a0
[ 75.308258] kthread+0xe4/0x120
[ 75.308259] ret_from_fork+0x44/0x70
[ 75.308261] ret_from_fork_asm+0x1a/0x30
[ 75.308263]
other info that might help us debug this:
[ 75.308264] Possible unsafe locking scenario:
[ 75.308264] CPU0 CPU1
[ 75.308265] ---- ----
[ 75.308265] lock(&hdev->lock);
[ 75.308267] lock(sk_lock-
AF_BLUETOOTH-BTPROTO_ISO);
[ 75.308268] lock(&hdev->lock);
[ 75.308269] lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO);
[ 75.308270]
*** DEADLOCK ***
[ 75.308271] 4 locks held by kworker/u81:2/2623:
[ 75.308272] #0: ffff8fdd66e52148 ((wq_completion)hci0#2){+.+.}-{0:0},
at: process_one_work+0x443/0x740
[ 75.308276] #1: ffffafb488b7fe48 ((work_completion)(&hdev->rx_work)),
at: process_one_work+0x1ce/0x740
[ 75.308280] #2: ffff8fdd61a10078 (&hdev->lock){+.+.}-{3:3}
at: hci_le_per_adv_report_evt+0x47/0x2f0 [bluetooth]
[ 75.308304] #3: ffffffffb6ba4900 (rcu_read_lock){....}-{1:2},
at: hci_connect_cfm+0x29/0x190 [bluetooth]
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/bluetooth/iso.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "c541d7b5e17987ed330798b07d4ad508859c1c93", status: "affected", version: "02171da6e86a73e1b343b36722f5d9d5c04b3539", versionType: "git", }, { lessThan: "168e28305b871d8ec604a8f51f35467b8d7ba05b", status: "affected", version: "02171da6e86a73e1b343b36722f5d9d5c04b3539", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/bluetooth/iso.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.9", }, { lessThan: "6.9", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: iso: Fix circular lock in iso_listen_bis\n\nThis fixes the circular locking dependency warning below, by\nreleasing the socket lock before enterning iso_listen_bis, to\navoid any potential deadlock with hdev lock.\n\n[ 75.307983] ======================================================\n[ 75.307984] WARNING: possible circular locking dependency detected\n[ 75.307985] 6.12.0-rc6+ #22 Not tainted\n[ 75.307987] ------------------------------------------------------\n[ 75.307987] kworker/u81:2/2623 is trying to acquire lock:\n[ 75.307988] ffff8fde1769da58 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO)\n at: iso_connect_cfm+0x253/0x840 [bluetooth]\n[ 75.308021]\n but task is already holding lock:\n[ 75.308022] ffff8fdd61a10078 (&hdev->lock)\n at: hci_le_per_adv_report_evt+0x47/0x2f0 [bluetooth]\n[ 75.308053]\n which lock already depends on the new lock.\n\n[ 75.308054]\n the existing dependency chain (in reverse order) is:\n[ 75.308055]\n -> #1 (&hdev->lock){+.+.}-{3:3}:\n[ 75.308057] __mutex_lock+0xad/0xc50\n[ 75.308061] mutex_lock_nested+0x1b/0x30\n[ 75.308063] iso_sock_listen+0x143/0x5c0 [bluetooth]\n[ 75.308085] __sys_listen_socket+0x49/0x60\n[ 75.308088] __x64_sys_listen+0x4c/0x90\n[ 75.308090] x64_sys_call+0x2517/0x25f0\n[ 75.308092] do_syscall_64+0x87/0x150\n[ 75.308095] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 75.308098]\n -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}:\n[ 75.308100] __lock_acquire+0x155e/0x25f0\n[ 75.308103] lock_acquire+0xc9/0x300\n[ 75.308105] lock_sock_nested+0x32/0x90\n[ 75.308107] iso_connect_cfm+0x253/0x840 [bluetooth]\n[ 75.308128] hci_connect_cfm+0x6c/0x190 [bluetooth]\n[ 75.308155] hci_le_per_adv_report_evt+0x27b/0x2f0 [bluetooth]\n[ 75.308180] hci_le_meta_evt+0xe7/0x200 [bluetooth]\n[ 75.308206] hci_event_packet+0x21f/0x5c0 [bluetooth]\n[ 75.308230] hci_rx_work+0x3ae/0xb10 [bluetooth]\n[ 75.308254] process_one_work+0x212/0x740\n[ 75.308256] worker_thread+0x1bd/0x3a0\n[ 75.308258] kthread+0xe4/0x120\n[ 75.308259] ret_from_fork+0x44/0x70\n[ 75.308261] ret_from_fork_asm+0x1a/0x30\n[ 75.308263]\n other info that might help us debug this:\n\n[ 75.308264] Possible unsafe locking scenario:\n\n[ 75.308264] CPU0 CPU1\n[ 75.308265] ---- ----\n[ 75.308265] lock(&hdev->lock);\n[ 75.308267] lock(sk_lock-\n AF_BLUETOOTH-BTPROTO_ISO);\n[ 75.308268] lock(&hdev->lock);\n[ 75.308269] lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO);\n[ 75.308270]\n *** DEADLOCK ***\n\n[ 75.308271] 4 locks held by kworker/u81:2/2623:\n[ 75.308272] #0: ffff8fdd66e52148 ((wq_completion)hci0#2){+.+.}-{0:0},\n at: process_one_work+0x443/0x740\n[ 75.308276] #1: ffffafb488b7fe48 ((work_completion)(&hdev->rx_work)),\n at: process_one_work+0x1ce/0x740\n[ 75.308280] #2: ffff8fdd61a10078 (&hdev->lock){+.+.}-{3:3}\n at: hci_le_per_adv_report_evt+0x47/0x2f0 [bluetooth]\n[ 75.308304] #3: ffffffffb6ba4900 (rcu_read_lock){....}-{1:2},\n at: hci_connect_cfm+0x29/0x190 [bluetooth]", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:08.994Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/c541d7b5e17987ed330798b07d4ad508859c1c93", }, { url: "https://git.kernel.org/stable/c/168e28305b871d8ec604a8f51f35467b8d7ba05b", }, ], title: "Bluetooth: iso: Fix circular lock in iso_listen_bis", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-54460", datePublished: "2025-01-11T12:29:53.553Z", dateReserved: "2025-01-09T09:51:32.434Z", dateUpdated: "2025-01-20T06:22:08.994Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57798
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
While receiving an MST up request message from one thread in
drm_dp_mst_handle_up_req(), the MST topology could be removed from
another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing
mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL.
This could lead to a NULL deref/use-after-free of mst_primary in
drm_dp_mst_handle_up_req().
Avoid the above by holding a reference for mst_primary in
drm_dp_mst_handle_up_req() while it's used.
v2: Fix kfreeing the request if getting an mst_primary reference fails.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/gpu/drm/display/drm_dp_mst_topology.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "f61b2e5e7821f868d6afc22382a66a30ee780ba0", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "9735d40f5fde9970aa46e828ecc85c32571d58a2", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "ce55818b2d3a999f886af91679589e4644ff1dc8", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "e54b00086f7473dbda1a7d6fc47720ced157c6a8", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/gpu/drm/display/drm_dp_mst_topology.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.123", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.69", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()\n\nWhile receiving an MST up request message from one thread in\ndrm_dp_mst_handle_up_req(), the MST topology could be removed from\nanother thread via drm_dp_mst_topology_mgr_set_mst(false), freeing\nmst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL.\nThis could lead to a NULL deref/use-after-free of mst_primary in\ndrm_dp_mst_handle_up_req().\n\nAvoid the above by holding a reference for mst_primary in\ndrm_dp_mst_handle_up_req() while it's used.\n\nv2: Fix kfreeing the request if getting an mst_primary reference fails.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:17.252Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/f61b2e5e7821f868d6afc22382a66a30ee780ba0", }, { url: "https://git.kernel.org/stable/c/9735d40f5fde9970aa46e828ecc85c32571d58a2", }, { url: "https://git.kernel.org/stable/c/ce55818b2d3a999f886af91679589e4644ff1dc8", }, { url: "https://git.kernel.org/stable/c/e54b00086f7473dbda1a7d6fc47720ced157c6a8", }, ], title: "drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57798", datePublished: "2025-01-11T12:39:48.212Z", dateReserved: "2025-01-11T12:32:49.420Z", dateUpdated: "2025-01-20T06:28:17.252Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57809
Vulnerability from cvelistv5
Published
2025-01-11 14:08
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: imx6: Fix suspend/resume support on i.MX6QDL
The suspend/resume functionality is currently broken on the i.MX6QDL
platform, as documented in the NXP errata (ERR005723):
https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf
This patch addresses the issue by sharing most of the suspend/resume
sequences used by other i.MX devices, while avoiding modifications to
critical registers that disrupt the PCIe functionality. It targets the
same problem as the following downstream commit:
https://github.com/nxp-imx/linux-imx/commit/4e92355e1f79d225ea842511fcfd42b343b32995
Unlike the downstream commit, this patch also resets the connected PCIe
device if possible. Without this reset, certain drivers, such as ath10k
or iwlwifi, will crash on resume. The device reset is also done by the
driver on other i.MX platforms, making this patch consistent with
existing practices.
Upon resuming, the kernel will hang and display an error. Here's an
example of the error encountered with the ath10k driver:
ath10k_pci 0000:01:00.0: Unable to change power state from D3hot to D0, device inaccessible
Unhandled fault: imprecise external abort (0x1406) at 0x0106f944
Without this patch, suspend/resume will fail on i.MX6QDL devices if a
PCIe device is connected.
[kwilczynski: commit log, added tag for stable releases]
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/pci/controller/dwc/pci-imx6.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "ac43ea3d27a8f9beadf3af66c9ea4a566ebfff1f", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/pci/controller/dwc/pci-imx6.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.4", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: imx6: Fix suspend/resume support on i.MX6QDL\n\nThe suspend/resume functionality is currently broken on the i.MX6QDL\nplatform, as documented in the NXP errata (ERR005723):\n\n https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf\n\nThis patch addresses the issue by sharing most of the suspend/resume\nsequences used by other i.MX devices, while avoiding modifications to\ncritical registers that disrupt the PCIe functionality. It targets the\nsame problem as the following downstream commit:\n\n https://github.com/nxp-imx/linux-imx/commit/4e92355e1f79d225ea842511fcfd42b343b32995\n\nUnlike the downstream commit, this patch also resets the connected PCIe\ndevice if possible. Without this reset, certain drivers, such as ath10k\nor iwlwifi, will crash on resume. The device reset is also done by the\ndriver on other i.MX platforms, making this patch consistent with\nexisting practices.\n\nUpon resuming, the kernel will hang and display an error. Here's an\nexample of the error encountered with the ath10k driver:\n\n ath10k_pci 0000:01:00.0: Unable to change power state from D3hot to D0, device inaccessible\n Unhandled fault: imprecise external abort (0x1406) at 0x0106f944\n\nWithout this patch, suspend/resume will fail on i.MX6QDL devices if a\nPCIe device is connected.\n\n[kwilczynski: commit log, added tag for stable releases]", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:27.591Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/ac43ea3d27a8f9beadf3af66c9ea4a566ebfff1f", }, { url: "https://git.kernel.org/stable/c/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3", }, ], title: "PCI: imx6: Fix suspend/resume support on i.MX6QDL", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57809", datePublished: "2025-01-11T14:08:56.044Z", dateReserved: "2025-01-11T12:34:02.689Z", dateUpdated: "2025-01-20T06:28:27.591Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-55881
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Play nice with protected guests in complete_hypercall_exit()
Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit
hypercall when completing said hypercall. For guests with protected state,
e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit
mode as the vCPU state needed to detect 64-bit mode is unavailable.
Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE
hypercall via VMGEXIT trips the WARN:
------------[ cut here ]------------
WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm]
Modules linked in: kvm_amd kvm ... [last unloaded: kvm]
CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat #470
Hardware name: Google Astoria/astoria, BIOS 0.20240617.0-0 06/17/2024
RIP: 0010:complete_hypercall_exit+0x44/0xe0 [kvm]
Call Trace:
<TASK>
kvm_arch_vcpu_ioctl_run+0x2400/0x2720 [kvm]
kvm_vcpu_ioctl+0x54f/0x630 [kvm]
__se_sys_ioctl+0x6b/0xc0
do_syscall_64+0x83/0x160
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
---[ end trace 0000000000000000 ]---
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 5969e2435cbd7f0ce8c28d717bfc39987ee8d8f1 Version: b5aead0064f33ae5e693a364e3204fe1c0ac9af2 Version: b5aead0064f33ae5e693a364e3204fe1c0ac9af2 Version: b5aead0064f33ae5e693a364e3204fe1c0ac9af2 Version: b5aead0064f33ae5e693a364e3204fe1c0ac9af2 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "arch/x86/kvm/x86.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "0840d360a8909c722fb62459f42836afe32ededb", status: "affected", version: "5969e2435cbd7f0ce8c28d717bfc39987ee8d8f1", versionType: "git", }, { lessThan: "7ed4db315094963de0678a8adfd43c46471b9349", status: "affected", version: "b5aead0064f33ae5e693a364e3204fe1c0ac9af2", versionType: "git", }, { lessThan: "3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6", status: "affected", version: "b5aead0064f33ae5e693a364e3204fe1c0ac9af2", versionType: "git", }, { lessThan: "22b5c2acd65dbe949032f619d4758a35a82fffc3", status: "affected", version: "b5aead0064f33ae5e693a364e3204fe1c0ac9af2", versionType: "git", }, { lessThan: "9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0", status: "affected", version: "b5aead0064f33ae5e693a364e3204fe1c0ac9af2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "arch/x86/kvm/x86.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.16", }, { lessThan: "5.16", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.122", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Play nice with protected guests in complete_hypercall_exit()\n\nUse is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit\nhypercall when completing said hypercall. For guests with protected state,\ne.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit\nmode as the vCPU state needed to detect 64-bit mode is unavailable.\n\nHacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE\nhypercall via VMGEXIT trips the WARN:\n\n ------------[ cut here ]------------\n WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm]\n Modules linked in: kvm_amd kvm ... [last unloaded: kvm]\n CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat #470\n Hardware name: Google Astoria/astoria, BIOS 0.20240617.0-0 06/17/2024\n RIP: 0010:complete_hypercall_exit+0x44/0xe0 [kvm]\n Call Trace:\n <TASK>\n kvm_arch_vcpu_ioctl_run+0x2400/0x2720 [kvm]\n kvm_vcpu_ioctl+0x54f/0x630 [kvm]\n __se_sys_ioctl+0x6b/0xc0\n do_syscall_64+0x83/0x160\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n ---[ end trace 0000000000000000 ]---", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:15.885Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/0840d360a8909c722fb62459f42836afe32ededb", }, { url: "https://git.kernel.org/stable/c/7ed4db315094963de0678a8adfd43c46471b9349", }, { url: "https://git.kernel.org/stable/c/3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6", }, { url: "https://git.kernel.org/stable/c/22b5c2acd65dbe949032f619d4758a35a82fffc3", }, { url: "https://git.kernel.org/stable/c/9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0", }, ], title: "KVM: x86: Play nice with protected guests in complete_hypercall_exit()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-55881", datePublished: "2025-01-11T12:35:44.019Z", dateReserved: "2025-01-09T09:51:32.450Z", dateUpdated: "2025-01-20T06:22:15.885Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57839
Vulnerability from cvelistv5
Published
2025-01-11 14:30
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()"
This reverts commit 7c877586da3178974a8a94577b6045a48377ff25.
Anders and Philippe have reported that recent kernels occasionally hang
when used with NFS in readahead code. The problem has been bisected to
7c877586da3 ("readahead: properly shorten readahead when falling back to
do_page_cache_ra()"). The cause of the problem is that ra->size can be
shrunk by read_pages() call and subsequently we end up calling
do_page_cache_ra() with negative (read huge positive) number of pages.
Let's revert 7c877586da3 for now until we can find a proper way how the
logic in read_pages() and page_cache_ra_order() can coexist. This can
lead to reduced readahead throughput due to readahead window confusion but
that's better than outright hangs.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "mm/readahead.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "85351e4941a253e4c50fb7048bfc19b60b4ec44b", status: "affected", version: "7c877586da3178974a8a94577b6045a48377ff25", versionType: "git", }, { lessThan: "a220d6b95b1ae12c7626283d7609f0a1438e6437", status: "affected", version: "7c877586da3178974a8a94577b6045a48377ff25", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "mm/readahead.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.11", }, { lessThan: "6.11", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"readahead: properly shorten readahead when falling back to do_page_cache_ra()\"\n\nThis reverts commit 7c877586da3178974a8a94577b6045a48377ff25.\n\nAnders and Philippe have reported that recent kernels occasionally hang\nwhen used with NFS in readahead code. The problem has been bisected to\n7c877586da3 (\"readahead: properly shorten readahead when falling back to\ndo_page_cache_ra()\"). The cause of the problem is that ra->size can be\nshrunk by read_pages() call and subsequently we end up calling\ndo_page_cache_ra() with negative (read huge positive) number of pages. \nLet's revert 7c877586da3 for now until we can find a proper way how the\nlogic in read_pages() and page_cache_ra_order() can coexist. This can\nlead to reduced readahead throughput due to readahead window confusion but\nthat's better than outright hangs.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:29.901Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/85351e4941a253e4c50fb7048bfc19b60b4ec44b", }, { url: "https://git.kernel.org/stable/c/a220d6b95b1ae12c7626283d7609f0a1438e6437", }, ], title: "Revert \"readahead: properly shorten readahead when falling back to do_page_cache_ra()\"", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57839", datePublished: "2025-01-11T14:30:56.149Z", dateReserved: "2025-01-11T12:34:02.622Z", dateUpdated: "2025-01-20T06:28:29.901Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57793
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
In CoCo VMs it is possible for the untrusted host to cause
set_memory_decrypted() to fail such that an error is returned
and the resulting memory is shared. Callers need to take care
to handle these errors to avoid returning decrypted (shared)
memory to the page allocator, which could lead to functional
or security issues.
Leak the decrypted memory when set_memory_decrypted() fails,
and don't need to print an error since set_memory_decrypted()
will call WARN_ONCE().
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/virt/coco/tdx-guest/tdx-guest.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "1429ae7b7d4759a1e362456b8911c701bae655b4", status: "affected", version: "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", versionType: "git", }, { lessThan: "27834971f616c5e154423c578fa95e0444444ce1", status: "affected", version: "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/virt/coco/tdx-guest/tdx-guest.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.7", }, { lessThan: "6.7", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: tdx-guest: Just leak decrypted memory on unrecoverable errors\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_decrypted() to fail such that an error is returned\nand the resulting memory is shared. Callers need to take care\nto handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional\nor security issues.\n\nLeak the decrypted memory when set_memory_decrypted() fails,\nand don't need to print an error since set_memory_decrypted()\nwill call WARN_ONCE().", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:14.928Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/1429ae7b7d4759a1e362456b8911c701bae655b4", }, { url: "https://git.kernel.org/stable/c/27834971f616c5e154423c578fa95e0444444ce1", }, ], title: "virt: tdx-guest: Just leak decrypted memory on unrecoverable errors", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57793", datePublished: "2025-01-11T12:39:47.347Z", dateReserved: "2025-01-11T12:32:49.384Z", dateUpdated: "2025-01-20T06:28:14.928Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-47408
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: check smcd_v2_ext_offset when receiving proposal msg
When receiving proposal msg in server, the field smcd_v2_ext_offset in
proposal msg is from the remote client and can not be fully trusted.
Once the value of smcd_v2_ext_offset exceed the max value, there has
the chance to access wrong address, and crash may happen.
This patch checks the value of smcd_v2_ext_offset before using it.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 5c21c4ccafe85906db809de3af391fd434df8a27 Version: 5c21c4ccafe85906db809de3af391fd434df8a27 Version: 5c21c4ccafe85906db809de3af391fd434df8a27 Version: 5c21c4ccafe85906db809de3af391fd434df8a27 Version: 5c21c4ccafe85906db809de3af391fd434df8a27 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/smc/af_smc.c", "net/smc/smc_clc.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "a36364d8d4fabb105001f992fb8ff2d3546203d6", status: "affected", version: "5c21c4ccafe85906db809de3af391fd434df8a27", versionType: "git", }, { lessThan: "e1cc8be2a785a8f1ce1f597f3e608602c5fccd46", status: "affected", version: "5c21c4ccafe85906db809de3af391fd434df8a27", versionType: "git", }, { lessThan: "935caf324b445fe73d7708fae6f7176fb243f357", status: "affected", version: "5c21c4ccafe85906db809de3af391fd434df8a27", versionType: "git", }, { lessThan: "48d5a8a304a643613dab376a278f29d3e22f7c34", status: "affected", version: "5c21c4ccafe85906db809de3af391fd434df8a27", versionType: "git", }, { lessThan: "9ab332deb671d8f7e66d82a2ff2b3f715bc3a4ad", status: "affected", version: "5c21c4ccafe85906db809de3af391fd434df8a27", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/smc/af_smc.c", "net/smc/smc_clc.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.10", }, { lessThan: "5.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.122", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check smcd_v2_ext_offset when receiving proposal msg\n\nWhen receiving proposal msg in server, the field smcd_v2_ext_offset in\nproposal msg is from the remote client and can not be fully trusted.\nOnce the value of smcd_v2_ext_offset exceed the max value, there has\nthe chance to access wrong address, and crash may happen.\n\nThis patch checks the value of smcd_v2_ext_offset before using it.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:05.658Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/a36364d8d4fabb105001f992fb8ff2d3546203d6", }, { url: "https://git.kernel.org/stable/c/e1cc8be2a785a8f1ce1f597f3e608602c5fccd46", }, { url: "https://git.kernel.org/stable/c/935caf324b445fe73d7708fae6f7176fb243f357", }, { url: "https://git.kernel.org/stable/c/48d5a8a304a643613dab376a278f29d3e22f7c34", }, { url: "https://git.kernel.org/stable/c/9ab332deb671d8f7e66d82a2ff2b3f715bc3a4ad", }, ], title: "net/smc: check smcd_v2_ext_offset when receiving proposal msg", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-47408", datePublished: "2025-01-11T12:35:35.284Z", dateReserved: "2025-01-11T12:34:02.588Z", dateUpdated: "2025-01-20T06:19:05.658Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-47809
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dlm: fix possible lkb_resource null dereference
This patch fixes a possible null pointer dereference when this function is
called from request_lock() as lkb->lkb_resource is not assigned yet,
only after validate_lock_args() by calling attach_lkb(). Another issue
is that a resource name could be a non printable bytearray and we cannot
assume to be ASCII coded.
The log functionality is probably never being hit when DLM is used in
normal way and no debug logging is enabled. The null pointer dereference
can only occur on a new created lkb that does not have the resource
assigned yet, it probably never hits the null pointer dereference but we
should be sure that other changes might not change this behaviour and we
actually can hit the mentioned null pointer dereference.
In this patch we just drop the printout of the resource name, the lkb id
is enough to make a possible connection to a resource name if this
exists.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/dlm/lock.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "6fbdc3980b70e9c1c86eccea7d5ee68108008fa7", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "2db11504ef82a60c1a2063ba7431a5cd013ecfcb", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "b98333c67daf887c724cd692e88e2db9418c0861", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/dlm/lock.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb->lkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:07.994Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/6fbdc3980b70e9c1c86eccea7d5ee68108008fa7", }, { url: "https://git.kernel.org/stable/c/2db11504ef82a60c1a2063ba7431a5cd013ecfcb", }, { url: "https://git.kernel.org/stable/c/b98333c67daf887c724cd692e88e2db9418c0861", }, ], title: "dlm: fix possible lkb_resource null dereference", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-47809", datePublished: "2025-01-11T12:25:15.356Z", dateReserved: "2025-01-09T09:51:32.479Z", dateUpdated: "2025-01-20T06:19:07.994Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57877
Vulnerability from cvelistv5
Published
2025-01-11 14:49
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: ptrace: fix partial SETREGSET for NT_ARM_POE
Currently poe_set() doesn't initialize the temporary 'ctrl' variable,
and a SETREGSET call with a length of zero will leave this
uninitialized. Consequently an arbitrary value will be written back to
target->thread.por_el0, potentially leaking up to 64 bits of memory from
the kernel stack. The read is limited to a specific slot on the stack,
and the issue does not provide a write mechanism.
Fix this by initializing the temporary value before copying the regset
from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,
NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing
contents of POR_EL1 will be retained.
Before this patch:
| # ./poe-test
| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d
| SETREGSET(nt=0x40f, len=8) wrote 8 bytes
|
| Attempting to read NT_ARM_POE::por_el0
| GETREGSET(nt=0x40f, len=8) read 8 bytes
| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d
|
| Attempting to write NT_ARM_POE (zero length)
| SETREGSET(nt=0x40f, len=0) wrote 0 bytes
|
| Attempting to read NT_ARM_POE::por_el0
| GETREGSET(nt=0x40f, len=8) read 8 bytes
| Read NT_ARM_POE::por_el0 = 0xffff8000839c3d50
After this patch:
| # ./poe-test
| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d
| SETREGSET(nt=0x40f, len=8) wrote 8 bytes
|
| Attempting to read NT_ARM_POE::por_el0
| GETREGSET(nt=0x40f, len=8) read 8 bytes
| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d
|
| Attempting to write NT_ARM_POE (zero length)
| SETREGSET(nt=0x40f, len=0) wrote 0 bytes
|
| Attempting to read NT_ARM_POE::por_el0
| GETREGSET(nt=0x40f, len=8) read 8 bytes
| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "arch/arm64/kernel/ptrace.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "4105dd76bc8ad6529d47157ef0565cb84ca6676c", status: "affected", version: "17519819926211e6b2834e00e4554bec0daf22ac", versionType: "git", }, { lessThan: "594bfc4947c4fcabba1318d8384c61a29a6b89fb", status: "affected", version: "17519819926211e6b2834e00e4554bec0daf22ac", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "arch/arm64/kernel/ptrace.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.12", }, { lessThan: "6.12", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: ptrace: fix partial SETREGSET for NT_ARM_POE\n\nCurrently poe_set() doesn't initialize the temporary 'ctrl' variable,\nand a SETREGSET call with a length of zero will leave this\nuninitialized. Consequently an arbitrary value will be written back to\ntarget->thread.por_el0, potentially leaking up to 64 bits of memory from\nthe kernel stack. The read is limited to a specific slot on the stack,\nand the issue does not provide a write mechanism.\n\nFix this by initializing the temporary value before copying the regset\nfrom userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,\nNT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing\ncontents of POR_EL1 will be retained.\n\nBefore this patch:\n\n| # ./poe-test\n| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d\n| SETREGSET(nt=0x40f, len=8) wrote 8 bytes\n|\n| Attempting to read NT_ARM_POE::por_el0\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d\n|\n| Attempting to write NT_ARM_POE (zero length)\n| SETREGSET(nt=0x40f, len=0) wrote 0 bytes\n|\n| Attempting to read NT_ARM_POE::por_el0\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\n| Read NT_ARM_POE::por_el0 = 0xffff8000839c3d50\n\nAfter this patch:\n\n| # ./poe-test\n| Attempting to write NT_ARM_POE::por_el0 = 0x900d900d900d900d\n| SETREGSET(nt=0x40f, len=8) wrote 8 bytes\n|\n| Attempting to read NT_ARM_POE::por_el0\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d\n|\n| Attempting to write NT_ARM_POE (zero length)\n| SETREGSET(nt=0x40f, len=0) wrote 0 bytes\n|\n| Attempting to read NT_ARM_POE::por_el0\n| GETREGSET(nt=0x40f, len=8) read 8 bytes\n| Read NT_ARM_POE::por_el0 = 0x900d900d900d900d", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:42.875Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/4105dd76bc8ad6529d47157ef0565cb84ca6676c", }, { url: "https://git.kernel.org/stable/c/594bfc4947c4fcabba1318d8384c61a29a6b89fb", }, ], title: "arm64: ptrace: fix partial SETREGSET for NT_ARM_POE", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57877", datePublished: "2025-01-11T14:49:03.297Z", dateReserved: "2025-01-11T14:45:42.023Z", dateUpdated: "2025-01-20T06:28:42.875Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57880
Vulnerability from cvelistv5
Published
2025-01-11 15:05
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array
The code uses the initialised member of the asoc_sdw_dailink struct to
determine if a member of the array is in use. However in the case the
array is completely full this will lead to an access 1 past the end of
the array, expand the array by one entry to include a space for a
terminator.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "sound/soc/intel/boards/sof_sdw.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "b21a849764a4111b0bc14a5ffe987a0582419de2", status: "affected", version: "27fd36aefa0013bea1cf6948e2e825e9b8cff97a", versionType: "git", }, { lessThan: "255cc582e6e16191a20d54bcdbca6c91d3e90c5e", status: "affected", version: "27fd36aefa0013bea1cf6948e2e825e9b8cff97a", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "sound/soc/intel/boards/sof_sdw.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.10", }, { lessThan: "6.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: sof_sdw: Add space for a terminator into DAIs array\n\nThe code uses the initialised member of the asoc_sdw_dailink struct to\ndetermine if a member of the array is in use. However in the case the\narray is completely full this will lead to an access 1 past the end of\nthe array, expand the array by one entry to include a space for a\nterminator.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:46.445Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/b21a849764a4111b0bc14a5ffe987a0582419de2", }, { url: "https://git.kernel.org/stable/c/255cc582e6e16191a20d54bcdbca6c91d3e90c5e", }, ], title: "ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57880", datePublished: "2025-01-11T15:05:28.763Z", dateReserved: "2025-01-11T14:45:42.023Z", dateUpdated: "2025-01-20T06:28:46.445Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-52332
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
igb: Fix potential invalid memory access in igb_init_module()
The pci_register_driver() can fail and when this happened, the dca_notifier
needs to be unregistered, otherwise the dca_notifier can be called when
igb fails to install, resulting to invalid memory access.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: bbd98fe48a43464b4a044bc4cbeefad284d6aa80 Version: bbd98fe48a43464b4a044bc4cbeefad284d6aa80 Version: bbd98fe48a43464b4a044bc4cbeefad284d6aa80 Version: bbd98fe48a43464b4a044bc4cbeefad284d6aa80 Version: bbd98fe48a43464b4a044bc4cbeefad284d6aa80 Version: bbd98fe48a43464b4a044bc4cbeefad284d6aa80 Version: bbd98fe48a43464b4a044bc4cbeefad284d6aa80 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/net/ethernet/intel/igb/igb_main.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "4458046617dfadc351162dbaea1945c57eebdf36", status: "affected", version: "bbd98fe48a43464b4a044bc4cbeefad284d6aa80", versionType: "git", }, { lessThan: "e0155b1b1509d0ef4799bd1cd73309ca466df3f3", status: "affected", version: "bbd98fe48a43464b4a044bc4cbeefad284d6aa80", versionType: "git", }, { lessThan: "4fe517643f529e805bb6b890a4331c100e8f2484", status: "affected", version: "bbd98fe48a43464b4a044bc4cbeefad284d6aa80", versionType: "git", }, { lessThan: "8009cdcc493fa30d4572016daf2d6999da4d6c54", status: "affected", version: "bbd98fe48a43464b4a044bc4cbeefad284d6aa80", versionType: "git", }, { lessThan: "f309733a8c9da7d4266a8a3755020b738a570cae", status: "affected", version: "bbd98fe48a43464b4a044bc4cbeefad284d6aa80", versionType: "git", }, { lessThan: "992fd34122de377b45cb75b64fc7f17fc1e6ed2f", status: "affected", version: "bbd98fe48a43464b4a044bc4cbeefad284d6aa80", versionType: "git", }, { lessThan: "0566f83d206c7a864abcd741fe39d6e0ae5eef29", status: "affected", version: "bbd98fe48a43464b4a044bc4cbeefad284d6aa80", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/net/ethernet/intel/igb/igb_main.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "2.6.29", }, { lessThan: "2.6.29", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.287", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix potential invalid memory access in igb_init_module()\n\nThe pci_register_driver() can fail and when this happened, the dca_notifier\nneeds to be unregistered, otherwise the dca_notifier can be called when\nigb fails to install, resulting to invalid memory access.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:35.449Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/4458046617dfadc351162dbaea1945c57eebdf36", }, { url: "https://git.kernel.org/stable/c/e0155b1b1509d0ef4799bd1cd73309ca466df3f3", }, { url: "https://git.kernel.org/stable/c/4fe517643f529e805bb6b890a4331c100e8f2484", }, { url: "https://git.kernel.org/stable/c/8009cdcc493fa30d4572016daf2d6999da4d6c54", }, { url: "https://git.kernel.org/stable/c/f309733a8c9da7d4266a8a3755020b738a570cae", }, { url: "https://git.kernel.org/stable/c/992fd34122de377b45cb75b64fc7f17fc1e6ed2f", }, { url: "https://git.kernel.org/stable/c/0566f83d206c7a864abcd741fe39d6e0ae5eef29", }, ], title: "igb: Fix potential invalid memory access in igb_init_module()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-52332", datePublished: "2025-01-11T12:25:21.014Z", dateReserved: "2025-01-09T09:50:31.799Z", dateUpdated: "2025-01-20T06:19:35.449Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57807
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: megaraid_sas: Fix for a potential deadlock
This fixes a 'possible circular locking dependency detected' warning
CPU0 CPU1
---- ----
lock(&instance->reset_mutex);
lock(&shost->scan_mutex);
lock(&instance->reset_mutex);
lock(&shost->scan_mutex);
Fix this by temporarily releasing the reset_mutex.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/scsi/megaraid/megaraid_sas_base.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "78afb9bfad00c4aa58a424111d7edbcab9452f2b", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "f36d024bd15ed356a80dda3ddc46d0a62aa55815", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "3c654998a3e8167a58b6c6fede545fe400a4b554", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "edadc693bfcc0f1ea08b8fa041c9361fd042410d", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "f50783148ec98a1d38b87422e2ceaf2380b7b606", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "466ca39dbf5d0ba71c16b15c27478a9c7d4022a8", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "50740f4dc78b41dec7c8e39772619d5ba841ddd7", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/scsi/megaraid/megaraid_sas_base.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.289", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.233", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.123", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.69", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix for a potential deadlock\n\nThis fixes a 'possible circular locking dependency detected' warning\n CPU0 CPU1\n ---- ----\n lock(&instance->reset_mutex);\n lock(&shost->scan_mutex);\n lock(&instance->reset_mutex);\n lock(&shost->scan_mutex);\n\nFix this by temporarily releasing the reset_mutex.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:26.443Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/78afb9bfad00c4aa58a424111d7edbcab9452f2b", }, { url: "https://git.kernel.org/stable/c/f36d024bd15ed356a80dda3ddc46d0a62aa55815", }, { url: "https://git.kernel.org/stable/c/3c654998a3e8167a58b6c6fede545fe400a4b554", }, { url: "https://git.kernel.org/stable/c/edadc693bfcc0f1ea08b8fa041c9361fd042410d", }, { url: "https://git.kernel.org/stable/c/f50783148ec98a1d38b87422e2ceaf2380b7b606", }, { url: "https://git.kernel.org/stable/c/466ca39dbf5d0ba71c16b15c27478a9c7d4022a8", }, { url: "https://git.kernel.org/stable/c/50740f4dc78b41dec7c8e39772619d5ba841ddd7", }, ], title: "scsi: megaraid_sas: Fix for a potential deadlock", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57807", datePublished: "2025-01-11T12:39:53.645Z", dateReserved: "2025-01-11T12:33:33.728Z", dateUpdated: "2025-01-20T06:28:26.443Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57874
Vulnerability from cvelistv5
Published
2025-01-11 14:47
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl'
variable, and a SETREGSET call with a length of zero will leave this
uninitialized. Consequently tagged_addr_ctrl_set() will consume an
arbitrary value, potentially leaking up to 64 bits of memory from the
kernel stack. The read is limited to a specific slot on the stack, and
the issue does not provide a write mechanism.
As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and
rejects other values, a partial SETREGSET attempt will randomly succeed
or fail depending on the value of the uninitialized value, and the
exposure is significantly limited.
Fix this by initializing the temporary value before copying the regset
from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,
NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing
value of the tagged address ctrl will be retained.
The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the
user_aarch64_view used by a native AArch64 task to manipulate another
native AArch64 task. As get_tagged_addr_ctrl() only returns an error
value when called for a compat task, tagged_addr_ctrl_get() and
tagged_addr_ctrl_set() should never observe an error value from
get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that
such an error would be unexpected, and error handlnig is not missing in
either case.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 2200aa7154cb7ef76bac93e98326883ba64bfa2e Version: 2200aa7154cb7ef76bac93e98326883ba64bfa2e Version: 2200aa7154cb7ef76bac93e98326883ba64bfa2e Version: 2200aa7154cb7ef76bac93e98326883ba64bfa2e Version: 2200aa7154cb7ef76bac93e98326883ba64bfa2e Version: 2200aa7154cb7ef76bac93e98326883ba64bfa2e |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "arch/arm64/kernel/ptrace.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "1152dd13845efde5554f80c7e1233bae1d26bd3e", status: "affected", version: "2200aa7154cb7ef76bac93e98326883ba64bfa2e", versionType: "git", }, { lessThan: "1c176f5155ee6161fee6f416b64aa50394d3f220", status: "affected", version: "2200aa7154cb7ef76bac93e98326883ba64bfa2e", versionType: "git", }, { lessThan: "1370cf3eb5495d70e00547598583a4cd45b40b99", status: "affected", version: "2200aa7154cb7ef76bac93e98326883ba64bfa2e", versionType: "git", }, { lessThan: "96035c0093db258975b8887676afe59a64c34a72", status: "affected", version: "2200aa7154cb7ef76bac93e98326883ba64bfa2e", versionType: "git", }, { lessThan: "abd614bbfcee73247495bd9472da8f85ac83546e", status: "affected", version: "2200aa7154cb7ef76bac93e98326883ba64bfa2e", versionType: "git", }, { lessThan: "ca62d90085f4af36de745883faab9f8a7cbb45d3", status: "affected", version: "2200aa7154cb7ef76bac93e98326883ba64bfa2e", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "arch/arm64/kernel/ptrace.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.10", }, { lessThan: "5.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL\n\nCurrently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl'\nvariable, and a SETREGSET call with a length of zero will leave this\nuninitialized. Consequently tagged_addr_ctrl_set() will consume an\narbitrary value, potentially leaking up to 64 bits of memory from the\nkernel stack. The read is limited to a specific slot on the stack, and\nthe issue does not provide a write mechanism.\n\nAs set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and\nrejects other values, a partial SETREGSET attempt will randomly succeed\nor fail depending on the value of the uninitialized value, and the\nexposure is significantly limited.\n\nFix this by initializing the temporary value before copying the regset\nfrom userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,\nNT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing\nvalue of the tagged address ctrl will be retained.\n\nThe NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the\nuser_aarch64_view used by a native AArch64 task to manipulate another\nnative AArch64 task. As get_tagged_addr_ctrl() only returns an error\nvalue when called for a compat task, tagged_addr_ctrl_get() and\ntagged_addr_ctrl_set() should never observe an error value from\nget_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that\nsuch an error would be unexpected, and error handlnig is not missing in\neither case.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:39.288Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/1152dd13845efde5554f80c7e1233bae1d26bd3e", }, { url: "https://git.kernel.org/stable/c/1c176f5155ee6161fee6f416b64aa50394d3f220", }, { url: "https://git.kernel.org/stable/c/1370cf3eb5495d70e00547598583a4cd45b40b99", }, { url: "https://git.kernel.org/stable/c/96035c0093db258975b8887676afe59a64c34a72", }, { url: "https://git.kernel.org/stable/c/abd614bbfcee73247495bd9472da8f85ac83546e", }, { url: "https://git.kernel.org/stable/c/ca62d90085f4af36de745883faab9f8a7cbb45d3", }, ], title: "arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57874", datePublished: "2025-01-11T14:47:10.665Z", dateReserved: "2025-01-11T14:45:42.022Z", dateUpdated: "2025-01-20T06:28:39.288Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-56788
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: oa_tc6: fix tx skb race condition between reference pointers
There are two skb pointers to manage tx skb's enqueued from n/w stack.
waiting_tx_skb pointer points to the tx skb which needs to be processed
and ongoing_tx_skb pointer points to the tx skb which is being processed.
SPI thread prepares the tx data chunks from the tx skb pointed by the
ongoing_tx_skb pointer. When the tx skb pointed by the ongoing_tx_skb is
processed, the tx skb pointed by the waiting_tx_skb is assigned to
ongoing_tx_skb and the waiting_tx_skb pointer is assigned with NULL.
Whenever there is a new tx skb from n/w stack, it will be assigned to
waiting_tx_skb pointer if it is NULL. Enqueuing and processing of a tx skb
handled in two different threads.
Consider a scenario where the SPI thread processed an ongoing_tx_skb and
it moves next tx skb from waiting_tx_skb pointer to ongoing_tx_skb pointer
without doing any NULL check. At this time, if the waiting_tx_skb pointer
is NULL then ongoing_tx_skb pointer is also assigned with NULL. After
that, if a new tx skb is assigned to waiting_tx_skb pointer by the n/w
stack and there is a chance to overwrite the tx skb pointer with NULL in
the SPI thread. Finally one of the tx skb will be left as unhandled,
resulting packet missing and memory leak.
- Consider the below scenario where the TXC reported from the previous
transfer is 10 and ongoing_tx_skb holds an tx ethernet frame which can be
transported in 20 TXCs and waiting_tx_skb is still NULL.
tx_credits = 10; /* 21 are filled in the previous transfer */
ongoing_tx_skb = 20;
waiting_tx_skb = NULL; /* Still NULL */
- So, (tc6->ongoing_tx_skb || tc6->waiting_tx_skb) becomes true.
- After oa_tc6_prepare_spi_tx_buf_for_tx_skbs()
ongoing_tx_skb = 10;
waiting_tx_skb = NULL; /* Still NULL */
- Perform SPI transfer.
- Process SPI rx buffer to get the TXC from footers.
- Now let's assume previously filled 21 TXCs are freed so we are good to
transport the next remaining 10 tx chunks from ongoing_tx_skb.
tx_credits = 21;
ongoing_tx_skb = 10;
waiting_tx_skb = NULL;
- So, (tc6->ongoing_tx_skb || tc6->waiting_tx_skb) becomes true again.
- In the oa_tc6_prepare_spi_tx_buf_for_tx_skbs()
ongoing_tx_skb = NULL;
waiting_tx_skb = NULL;
- Now the below bad case might happen,
Thread1 (oa_tc6_start_xmit) Thread2 (oa_tc6_spi_thread_handler)
--------------------------- -----------------------------------
- if waiting_tx_skb is NULL
- if ongoing_tx_skb is NULL
- ongoing_tx_skb = waiting_tx_skb
- waiting_tx_skb = skb
- waiting_tx_skb = NULL
...
- ongoing_tx_skb = NULL
- if waiting_tx_skb is NULL
- waiting_tx_skb = skb
To overcome the above issue, protect the moving of tx skb reference from
waiting_tx_skb pointer to ongoing_tx_skb pointer and assigning new tx skb
to waiting_tx_skb pointer, so that the other thread can't access the
waiting_tx_skb pointer until the current thread completes moving the tx
skb reference safely.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/net/ethernet/oa_tc6.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "1f2eb6c32bae04b375bb7a0aedbeefb6dbbcb775", status: "affected", version: "53fbde8ab21e8c2c6187159cc17fc10cbf20900a", versionType: "git", }, { lessThan: "e592b5110b3e9393881b0a019d86832bbf71a47f", status: "affected", version: "53fbde8ab21e8c2c6187159cc17fc10cbf20900a", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/net/ethernet/oa_tc6.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.12", }, { lessThan: "6.12", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: oa_tc6: fix tx skb race condition between reference pointers\n\nThere are two skb pointers to manage tx skb's enqueued from n/w stack.\nwaiting_tx_skb pointer points to the tx skb which needs to be processed\nand ongoing_tx_skb pointer points to the tx skb which is being processed.\n\nSPI thread prepares the tx data chunks from the tx skb pointed by the\nongoing_tx_skb pointer. When the tx skb pointed by the ongoing_tx_skb is\nprocessed, the tx skb pointed by the waiting_tx_skb is assigned to\nongoing_tx_skb and the waiting_tx_skb pointer is assigned with NULL.\nWhenever there is a new tx skb from n/w stack, it will be assigned to\nwaiting_tx_skb pointer if it is NULL. Enqueuing and processing of a tx skb\nhandled in two different threads.\n\nConsider a scenario where the SPI thread processed an ongoing_tx_skb and\nit moves next tx skb from waiting_tx_skb pointer to ongoing_tx_skb pointer\nwithout doing any NULL check. At this time, if the waiting_tx_skb pointer\nis NULL then ongoing_tx_skb pointer is also assigned with NULL. After\nthat, if a new tx skb is assigned to waiting_tx_skb pointer by the n/w\nstack and there is a chance to overwrite the tx skb pointer with NULL in\nthe SPI thread. Finally one of the tx skb will be left as unhandled,\nresulting packet missing and memory leak.\n\n- Consider the below scenario where the TXC reported from the previous\ntransfer is 10 and ongoing_tx_skb holds an tx ethernet frame which can be\ntransported in 20 TXCs and waiting_tx_skb is still NULL.\n\ttx_credits = 10; /* 21 are filled in the previous transfer */\n\tongoing_tx_skb = 20;\n\twaiting_tx_skb = NULL; /* Still NULL */\n- So, (tc6->ongoing_tx_skb || tc6->waiting_tx_skb) becomes true.\n- After oa_tc6_prepare_spi_tx_buf_for_tx_skbs()\n\tongoing_tx_skb = 10;\n\twaiting_tx_skb = NULL; /* Still NULL */\n- Perform SPI transfer.\n- Process SPI rx buffer to get the TXC from footers.\n- Now let's assume previously filled 21 TXCs are freed so we are good to\ntransport the next remaining 10 tx chunks from ongoing_tx_skb.\n\ttx_credits = 21;\n\tongoing_tx_skb = 10;\n\twaiting_tx_skb = NULL;\n- So, (tc6->ongoing_tx_skb || tc6->waiting_tx_skb) becomes true again.\n- In the oa_tc6_prepare_spi_tx_buf_for_tx_skbs()\n\tongoing_tx_skb = NULL;\n\twaiting_tx_skb = NULL;\n\n- Now the below bad case might happen,\n\nThread1 (oa_tc6_start_xmit)\tThread2 (oa_tc6_spi_thread_handler)\n---------------------------\t-----------------------------------\n- if waiting_tx_skb is NULL\n\t\t\t\t- if ongoing_tx_skb is NULL\n\t\t\t\t- ongoing_tx_skb = waiting_tx_skb\n- waiting_tx_skb = skb\n\t\t\t\t- waiting_tx_skb = NULL\n\t\t\t\t...\n\t\t\t\t- ongoing_tx_skb = NULL\n- if waiting_tx_skb is NULL\n- waiting_tx_skb = skb\n\nTo overcome the above issue, protect the moving of tx skb reference from\nwaiting_tx_skb pointer to ongoing_tx_skb pointer and assigning new tx skb\nto waiting_tx_skb pointer, so that the other thread can't access the\nwaiting_tx_skb pointer until the current thread completes moving the tx\nskb reference safely.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:11.456Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/1f2eb6c32bae04b375bb7a0aedbeefb6dbbcb775", }, { url: "https://git.kernel.org/stable/c/e592b5110b3e9393881b0a019d86832bbf71a47f", }, ], title: "net: ethernet: oa_tc6: fix tx skb race condition between reference pointers", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-56788", datePublished: "2025-01-11T12:35:47.985Z", dateReserved: "2024-12-29T11:26:39.770Z", dateUpdated: "2025-01-20T06:28:11.456Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-55641
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: unlock inodes when erroring out of xfs_trans_alloc_dir
Debugging a filesystem patch with generic/475 caused the system to hang
after observing the following sequences in dmesg:
XFS (dm-0): metadata I/O error in "xfs_imap_to_bp+0x61/0xe0 [xfs]" at daddr 0x491520 len 32 error 5
XFS (dm-0): metadata I/O error in "xfs_btree_read_buf_block+0xba/0x160 [xfs]" at daddr 0x3445608 len 8 error 5
XFS (dm-0): metadata I/O error in "xfs_imap_to_bp+0x61/0xe0 [xfs]" at daddr 0x138e1c0 len 32 error 5
XFS (dm-0): log I/O error -5
XFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ea/0x4b0 [xfs] (fs/xfs/xfs_trans_buf.c:311). Shutting down filesystem.
XFS (dm-0): Please unmount the filesystem and rectify the problem(s)
XFS (dm-0): Internal error dqp->q_ino.reserved < dqp->q_ino.count at line 869 of file fs/xfs/xfs_trans_dquot.c. Caller xfs_trans_dqresv+0x236/0x440 [xfs]
XFS (dm-0): Corruption detected. Unmount and run xfs_repair
XFS (dm-0): Unmounting Filesystem be6bcbcc-9921-4deb-8d16-7cc94e335fa7
The system is stuck in unmount trying to lock a couple of inodes so that
they can be purged. The dquot corruption notice above is a clue to what
happened -- a link() call tried to set up a transaction to link a child
into a directory. Quota reservation for the transaction failed after IO
errors shut down the filesystem, but then we forgot to unlock the inodes
on our way out. Fix that.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/xfs/xfs_trans.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "6aefe5d97ae57b1343dc60d8bb6a4ed070e5bcea", status: "affected", version: "bd5562111d58392298a3c3b93caad71dff681b4b", versionType: "git", }, { lessThan: "53b001a21c9dff73b64e8c909c41991f01d5d00f", status: "affected", version: "bd5562111d58392298a3c3b93caad71dff681b4b", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/xfs/xfs_trans.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.10", }, { lessThan: "6.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: unlock inodes when erroring out of xfs_trans_alloc_dir\n\nDebugging a filesystem patch with generic/475 caused the system to hang\nafter observing the following sequences in dmesg:\n\n XFS (dm-0): metadata I/O error in \"xfs_imap_to_bp+0x61/0xe0 [xfs]\" at daddr 0x491520 len 32 error 5\n XFS (dm-0): metadata I/O error in \"xfs_btree_read_buf_block+0xba/0x160 [xfs]\" at daddr 0x3445608 len 8 error 5\n XFS (dm-0): metadata I/O error in \"xfs_imap_to_bp+0x61/0xe0 [xfs]\" at daddr 0x138e1c0 len 32 error 5\n XFS (dm-0): log I/O error -5\n XFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ea/0x4b0 [xfs] (fs/xfs/xfs_trans_buf.c:311). Shutting down filesystem.\n XFS (dm-0): Please unmount the filesystem and rectify the problem(s)\n XFS (dm-0): Internal error dqp->q_ino.reserved < dqp->q_ino.count at line 869 of file fs/xfs/xfs_trans_dquot.c. Caller xfs_trans_dqresv+0x236/0x440 [xfs]\n XFS (dm-0): Corruption detected. Unmount and run xfs_repair\n XFS (dm-0): Unmounting Filesystem be6bcbcc-9921-4deb-8d16-7cc94e335fa7\n\nThe system is stuck in unmount trying to lock a couple of inodes so that\nthey can be purged. The dquot corruption notice above is a clue to what\nhappened -- a link() call tried to set up a transaction to link a child\ninto a directory. Quota reservation for the transaction failed after IO\nerrors shut down the filesystem, but then we forgot to unlock the inodes\non our way out. Fix that.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:13.601Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/6aefe5d97ae57b1343dc60d8bb6a4ed070e5bcea", }, { url: "https://git.kernel.org/stable/c/53b001a21c9dff73b64e8c909c41991f01d5d00f", }, ], title: "xfs: unlock inodes when erroring out of xfs_trans_alloc_dir", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-55641", datePublished: "2025-01-11T12:29:56.052Z", dateReserved: "2025-01-09T09:51:32.506Z", dateUpdated: "2025-01-20T06:22:13.601Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57799
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PM
In some cases, rk_hdptx_phy_runtime_resume() may be invoked before
platform_set_drvdata() is executed in ->probe(), leading to a NULL
pointer dereference when using the return of dev_get_drvdata().
Ensure platform_set_drvdata() is called before devm_pm_runtime_enable().
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "7061849a4a1752a06944a819dd1f7bfd58df7383", status: "affected", version: "553be2830c5f33308483e8118de748a2c69fe593", versionType: "git", }, { lessThan: "9d23e48654620fdccfcc74cc2cef04eaf7353d07", status: "affected", version: "553be2830c5f33308483e8118de748a2c69fe593", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.9", }, { lessThan: "6.9", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PM\n\nIn some cases, rk_hdptx_phy_runtime_resume() may be invoked before\nplatform_set_drvdata() is executed in ->probe(), leading to a NULL\npointer dereference when using the return of dev_get_drvdata().\n\nEnsure platform_set_drvdata() is called before devm_pm_runtime_enable().", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:18.397Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/7061849a4a1752a06944a819dd1f7bfd58df7383", }, { url: "https://git.kernel.org/stable/c/9d23e48654620fdccfcc74cc2cef04eaf7353d07", }, ], title: "phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PM", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57799", datePublished: "2025-01-11T12:39:48.936Z", dateReserved: "2025-01-11T12:32:49.498Z", dateUpdated: "2025-01-20T06:28:18.397Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57849
Vulnerability from cvelistv5
Published
2025-01-11 14:30
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/cpum_sf: Handle CPU hotplug remove during sampling
CPU hotplug remove handling triggers the following function
call sequence:
CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu()
...
CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu()
The s390 CPUMF sampling CPU hotplug handler invokes:
s390_pmu_sf_offline_cpu()
+--> cpusf_pmu_setup()
+--> setup_pmc_cpu()
+--> deallocate_buffers()
This function de-allocates all sampling data buffers (SDBs) allocated
for that CPU at event initialization. It also clears the
PMU_F_RESERVED bit. The CPU is gone and can not be sampled.
With the event still being active on the removed CPU, the CPU event
hotplug support in kernel performance subsystem triggers the
following function calls on the removed CPU:
perf_event_exit_cpu()
+--> perf_event_exit_cpu_context()
+--> __perf_event_exit_context()
+--> __perf_remove_from_context()
+--> event_sched_out()
+--> cpumsf_pmu_del()
+--> cpumsf_pmu_stop()
+--> hw_perf_event_update()
to stop and remove the event. During removal of the event, the
sampling device driver tries to read out the remaining samples from
the sample data buffers (SDBs). But they have already been freed
(and may have been re-assigned). This may lead to a use after free
situation in which case the samples are most likely invalid. In the
best case the memory has not been reassigned and still contains
valid data.
Remedy this situation and check if the CPU is still in reserved
state (bit PMU_F_RESERVED set). In this case the SDBs have not been
released an contain valid data. This is always the case when
the event is removed (and no CPU hotplug off occured).
If the PMU_F_RESERVED bit is not set, the SDB buffers are gone.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "arch/s390/kernel/perf_cpum_sf.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "238e3af849dfdcb1faed544349f7025e533f9aab", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "99192c735ed4bfdff0d215ec85c8a87a677cb898", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "06a92f810df8037ca36157282ddcbefdcaf049b8", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "b5be6a0bb639d165c8418d8dddd8f322587be8be", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "a69752f1e5de817941a2ea0609254f6f25acd274", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "be54e6e0f93a39a9c00478d70d12956a5f3d5b9b", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "a0bd7dacbd51c632b8e2c0500b479af564afadf3", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "arch/s390/kernel/perf_cpum_sf.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.287", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cpum_sf: Handle CPU hotplug remove during sampling\n\nCPU hotplug remove handling triggers the following function\ncall sequence:\n\n CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu()\n ...\n CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu()\n\nThe s390 CPUMF sampling CPU hotplug handler invokes:\n\n s390_pmu_sf_offline_cpu()\n +--> cpusf_pmu_setup()\n +--> setup_pmc_cpu()\n +--> deallocate_buffers()\n\nThis function de-allocates all sampling data buffers (SDBs) allocated\nfor that CPU at event initialization. It also clears the\nPMU_F_RESERVED bit. The CPU is gone and can not be sampled.\n\nWith the event still being active on the removed CPU, the CPU event\nhotplug support in kernel performance subsystem triggers the\nfollowing function calls on the removed CPU:\n\n perf_event_exit_cpu()\n +--> perf_event_exit_cpu_context()\n +--> __perf_event_exit_context()\n\t +--> __perf_remove_from_context()\n\t +--> event_sched_out()\n\t +--> cpumsf_pmu_del()\n\t +--> cpumsf_pmu_stop()\n +--> hw_perf_event_update()\n\nto stop and remove the event. During removal of the event, the\nsampling device driver tries to read out the remaining samples from\nthe sample data buffers (SDBs). But they have already been freed\n(and may have been re-assigned). This may lead to a use after free\nsituation in which case the samples are most likely invalid. In the\nbest case the memory has not been reassigned and still contains\nvalid data.\n\nRemedy this situation and check if the CPU is still in reserved\nstate (bit PMU_F_RESERVED set). In this case the SDBs have not been\nreleased an contain valid data. This is always the case when\nthe event is removed (and no CPU hotplug off occured).\nIf the PMU_F_RESERVED bit is not set, the SDB buffers are gone.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:34.532Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/238e3af849dfdcb1faed544349f7025e533f9aab", }, { url: "https://git.kernel.org/stable/c/99192c735ed4bfdff0d215ec85c8a87a677cb898", }, { url: "https://git.kernel.org/stable/c/06a92f810df8037ca36157282ddcbefdcaf049b8", }, { url: "https://git.kernel.org/stable/c/b5be6a0bb639d165c8418d8dddd8f322587be8be", }, { url: "https://git.kernel.org/stable/c/a69752f1e5de817941a2ea0609254f6f25acd274", }, { url: "https://git.kernel.org/stable/c/be54e6e0f93a39a9c00478d70d12956a5f3d5b9b", }, { url: "https://git.kernel.org/stable/c/a0bd7dacbd51c632b8e2c0500b479af564afadf3", }, ], title: "s390/cpum_sf: Handle CPU hotplug remove during sampling", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57849", datePublished: "2025-01-11T14:30:58.365Z", dateReserved: "2025-01-11T12:33:33.699Z", dateUpdated: "2025-01-20T06:28:34.532Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-23126
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2025-01-11T14:41:09.170Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, rejectedReasons: [ { lang: "en", value: "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", }, ], }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2025-23126", datePublished: "2025-01-11T14:31:03.250Z", dateRejected: "2025-01-11T14:41:09.170Z", dateReserved: "2025-01-11T14:28:41.510Z", dateUpdated: "2025-01-11T14:41:09.170Z", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57792
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: gpio-charger: Fix set charge current limits
Fix set charge current limits for devices which allow to set the lowest
charge current limit to be greater zero. If requested charge current limit
is below lowest limit, the index equals current_limit_map_size which leads
to accessing memory beyond allocated memory.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/power/supply/gpio-charger.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "b29c7783ac1fe36d639c089cf471ac7a46df05f0", status: "affected", version: "be2919d8355e4651386ad2fb61ddb6efe4533b1b", versionType: "git", }, { lessThan: "c3703d9340ca2820e1ac63256f4b423ea8559831", status: "affected", version: "be2919d8355e4651386ad2fb61ddb6efe4533b1b", versionType: "git", }, { lessThan: "6abbbd8286b6f944eecf3c74444c138590135211", status: "affected", version: "be2919d8355e4651386ad2fb61ddb6efe4533b1b", versionType: "git", }, { lessThan: "13eb3cae1d8e23cce96c095abe34da8028c09ac5", status: "affected", version: "be2919d8355e4651386ad2fb61ddb6efe4533b1b", versionType: "git", }, { lessThan: "f6279a98db132da0cfff18712a1b06478c32007f", status: "affected", version: "be2919d8355e4651386ad2fb61ddb6efe4533b1b", versionType: "git", }, { lessThan: "afc6e39e824ad0e44b2af50a97885caec8d213d1", status: "affected", version: "be2919d8355e4651386ad2fb61ddb6efe4533b1b", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/power/supply/gpio-charger.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.10", }, { lessThan: "5.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.233", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.123", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.69", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.8", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: gpio-charger: Fix set charge current limits\n\nFix set charge current limits for devices which allow to set the lowest\ncharge current limit to be greater zero. If requested charge current limit\nis below lowest limit, the index equals current_limit_map_size which leads\nto accessing memory beyond allocated memory.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:13.786Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/b29c7783ac1fe36d639c089cf471ac7a46df05f0", }, { url: "https://git.kernel.org/stable/c/c3703d9340ca2820e1ac63256f4b423ea8559831", }, { url: "https://git.kernel.org/stable/c/6abbbd8286b6f944eecf3c74444c138590135211", }, { url: "https://git.kernel.org/stable/c/13eb3cae1d8e23cce96c095abe34da8028c09ac5", }, { url: "https://git.kernel.org/stable/c/f6279a98db132da0cfff18712a1b06478c32007f", }, { url: "https://git.kernel.org/stable/c/afc6e39e824ad0e44b2af50a97885caec8d213d1", }, ], title: "power: supply: gpio-charger: Fix set charge current limits", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57792", datePublished: "2025-01-11T12:39:46.397Z", dateReserved: "2025-01-11T12:33:33.683Z", dateUpdated: "2025-01-20T06:28:13.786Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-56369
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-21 10:55
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
drm_mode_vrefresh() is trying to avoid divide by zero
by checking whether htotal or vtotal are zero. But we may
still end up with a div-by-zero of vtotal*htotal*...
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 2f0e9d804935970a4ce0f58dd046b41881bfd8f3 Version: 2f0e9d804935970a4ce0f58dd046b41881bfd8f3 Version: 2f0e9d804935970a4ce0f58dd046b41881bfd8f3 Version: 2f0e9d804935970a4ce0f58dd046b41881bfd8f3 Version: 2f0e9d804935970a4ce0f58dd046b41881bfd8f3 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/gpu/drm/drm_modes.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "e7c7b48a0fc5ed83baae400a1b15e33978c25d7f", status: "affected", version: "2f0e9d804935970a4ce0f58dd046b41881bfd8f3", versionType: "git", }, { lessThan: "69fbb01e891701e6d04db1ddb5ad49e42c4dd963", status: "affected", version: "2f0e9d804935970a4ce0f58dd046b41881bfd8f3", versionType: "git", }, { lessThan: "b39de5a71bac5641d0fda33d1cf5682d82cf1ae5", status: "affected", version: "2f0e9d804935970a4ce0f58dd046b41881bfd8f3", versionType: "git", }, { lessThan: "47c8b6cf1d08f0ad40d7ea7b025442e51b35ee1f", status: "affected", version: "2f0e9d804935970a4ce0f58dd046b41881bfd8f3", versionType: "git", }, { lessThan: "9398332f23fab10c5ec57c168b44e72997d6318e", status: "affected", version: "2f0e9d804935970a4ce0f58dd046b41881bfd8f3", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/gpu/drm/drm_modes.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "4.17", }, { lessThan: "4.17", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.122", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/modes: Avoid divide by zero harder in drm_mode_vrefresh()\n\ndrm_mode_vrefresh() is trying to avoid divide by zero\nby checking whether htotal or vtotal are zero. But we may\nstill end up with a div-by-zero of vtotal*htotal*...", }, ], providerMetadata: { dateUpdated: "2025-01-21T10:55:22.492Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/e7c7b48a0fc5ed83baae400a1b15e33978c25d7f", }, { url: "https://git.kernel.org/stable/c/69fbb01e891701e6d04db1ddb5ad49e42c4dd963", }, { url: "https://git.kernel.org/stable/c/b39de5a71bac5641d0fda33d1cf5682d82cf1ae5", }, { url: "https://git.kernel.org/stable/c/47c8b6cf1d08f0ad40d7ea7b025442e51b35ee1f", }, { url: "https://git.kernel.org/stable/c/9398332f23fab10c5ec57c168b44e72997d6318e", }, ], title: "drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-56369", datePublished: "2025-01-11T12:35:46.439Z", dateReserved: "2025-01-11T12:34:02.670Z", dateUpdated: "2025-01-21T10:55:22.492Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57843
Vulnerability from cvelistv5
Published
2025-01-11 14:30
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix overflow inside virtnet_rq_alloc
When the frag just got a page, then may lead to regression on VM.
Specially if the sysctl net.core.high_order_alloc_disable value is 1,
then the frag always get a page when do refill.
Which could see reliable crashes or scp failure (scp a file 100M in size
to VM).
The issue is that the virtnet_rq_dma takes up 16 bytes at the beginning
of a new frag. When the frag size is larger than PAGE_SIZE,
everything is fine. However, if the frag is only one page and the
total size of the buffer and virtnet_rq_dma is larger than one page, an
overflow may occur.
The commit f9dac92ba908 ("virtio_ring: enable premapped mode whatever
use_dma_api") introduced this problem. And we reverted some commits to
fix this in last linux version. Now we try to enable it and fix this
bug directly.
Here, when the frag size is not enough, we reduce the buffer len to fix
this problem.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/net/virtio_net.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "a8f7d6963768b114ec9644ff0148dde4c104e84b", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "67a11de8965c2ab19e215fb6651d44847e068614", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "6aacd1484468361d1d04badfe75f264fa5314864", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/net/virtio_net.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix overflow inside virtnet_rq_alloc\n\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\n\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\n\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\n\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\n\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:32.224Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/a8f7d6963768b114ec9644ff0148dde4c104e84b", }, { url: "https://git.kernel.org/stable/c/67a11de8965c2ab19e215fb6651d44847e068614", }, { url: "https://git.kernel.org/stable/c/6aacd1484468361d1d04badfe75f264fa5314864", }, ], title: "virtio-net: fix overflow inside virtnet_rq_alloc", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57843", datePublished: "2025-01-11T14:30:57.255Z", dateReserved: "2025-01-11T12:32:49.621Z", dateUpdated: "2025-01-20T06:28:32.224Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-54191
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: iso: Fix circular lock in iso_conn_big_sync
This fixes the circular locking dependency warning below, by reworking
iso_sock_recvmsg, to ensure that the socket lock is always released
before calling a function that locks hdev.
[ 561.670344] ======================================================
[ 561.670346] WARNING: possible circular locking dependency detected
[ 561.670349] 6.12.0-rc6+ #26 Not tainted
[ 561.670351] ------------------------------------------------------
[ 561.670353] iso-tester/3289 is trying to acquire lock:
[ 561.670355] ffff88811f600078 (&hdev->lock){+.+.}-{3:3},
at: iso_conn_big_sync+0x73/0x260 [bluetooth]
[ 561.670405]
but task is already holding lock:
[ 561.670407] ffff88815af58258 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0},
at: iso_sock_recvmsg+0xbf/0x500 [bluetooth]
[ 561.670450]
which lock already depends on the new lock.
[ 561.670452]
the existing dependency chain (in reverse order) is:
[ 561.670453]
-> #2 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0}:
[ 561.670458] lock_acquire+0x7c/0xc0
[ 561.670463] lock_sock_nested+0x3b/0xf0
[ 561.670467] bt_accept_dequeue+0x1a5/0x4d0 [bluetooth]
[ 561.670510] iso_sock_accept+0x271/0x830 [bluetooth]
[ 561.670547] do_accept+0x3dd/0x610
[ 561.670550] __sys_accept4+0xd8/0x170
[ 561.670553] __x64_sys_accept+0x74/0xc0
[ 561.670556] x64_sys_call+0x17d6/0x25f0
[ 561.670559] do_syscall_64+0x87/0x150
[ 561.670563] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 561.670567]
-> #1 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}:
[ 561.670571] lock_acquire+0x7c/0xc0
[ 561.670574] lock_sock_nested+0x3b/0xf0
[ 561.670577] iso_sock_listen+0x2de/0xf30 [bluetooth]
[ 561.670617] __sys_listen_socket+0xef/0x130
[ 561.670620] __x64_sys_listen+0xe1/0x190
[ 561.670623] x64_sys_call+0x2517/0x25f0
[ 561.670626] do_syscall_64+0x87/0x150
[ 561.670629] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 561.670632]
-> #0 (&hdev->lock){+.+.}-{3:3}:
[ 561.670636] __lock_acquire+0x32ad/0x6ab0
[ 561.670639] lock_acquire.part.0+0x118/0x360
[ 561.670642] lock_acquire+0x7c/0xc0
[ 561.670644] __mutex_lock+0x18d/0x12f0
[ 561.670647] mutex_lock_nested+0x1b/0x30
[ 561.670651] iso_conn_big_sync+0x73/0x260 [bluetooth]
[ 561.670687] iso_sock_recvmsg+0x3e9/0x500 [bluetooth]
[ 561.670722] sock_recvmsg+0x1d5/0x240
[ 561.670725] sock_read_iter+0x27d/0x470
[ 561.670727] vfs_read+0x9a0/0xd30
[ 561.670731] ksys_read+0x1a8/0x250
[ 561.670733] __x64_sys_read+0x72/0xc0
[ 561.670736] x64_sys_call+0x1b12/0x25f0
[ 561.670738] do_syscall_64+0x87/0x150
[ 561.670741] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 561.670744]
other info that might help us debug this:
[ 561.670745] Chain exists of:
&hdev->lock --> sk_lock-AF_BLUETOOTH-BTPROTO_ISO --> sk_lock-AF_BLUETOOTH
[ 561.670751] Possible unsafe locking scenario:
[ 561.670753] CPU0 CPU1
[ 561.670754] ---- ----
[ 561.670756] lock(sk_lock-AF_BLUETOOTH);
[ 561.670758] lock(sk_lock
AF_BLUETOOTH-BTPROTO_ISO);
[ 561.670761] lock(sk_lock-AF_BLUETOOTH);
[ 561.670764] lock(&hdev->lock);
[ 561.670767]
*** DEADLOCK ***
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/bluetooth/iso.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "cbe640d6cae590b9a7d81ce86fe9a90e83eec1d5", status: "affected", version: "1360e5b6ce63d63d23223a659ca2bbafa30a53aa", versionType: "git", }, { lessThan: "7a17308c17880d259105f6e591eb1bc77b9612f0", status: "affected", version: "07a9342b94a91b306ed1cf6aa8254aea210764c9", versionType: "git", }, ], }, { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/bluetooth/iso.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "6.12.6", status: "affected", version: "6.12.2", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: iso: Fix circular lock in iso_conn_big_sync\n\nThis fixes the circular locking dependency warning below, by reworking\niso_sock_recvmsg, to ensure that the socket lock is always released\nbefore calling a function that locks hdev.\n\n[ 561.670344] ======================================================\n[ 561.670346] WARNING: possible circular locking dependency detected\n[ 561.670349] 6.12.0-rc6+ #26 Not tainted\n[ 561.670351] ------------------------------------------------------\n[ 561.670353] iso-tester/3289 is trying to acquire lock:\n[ 561.670355] ffff88811f600078 (&hdev->lock){+.+.}-{3:3},\n at: iso_conn_big_sync+0x73/0x260 [bluetooth]\n[ 561.670405]\n but task is already holding lock:\n[ 561.670407] ffff88815af58258 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0},\n at: iso_sock_recvmsg+0xbf/0x500 [bluetooth]\n[ 561.670450]\n which lock already depends on the new lock.\n\n[ 561.670452]\n the existing dependency chain (in reverse order) is:\n[ 561.670453]\n -> #2 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0}:\n[ 561.670458] lock_acquire+0x7c/0xc0\n[ 561.670463] lock_sock_nested+0x3b/0xf0\n[ 561.670467] bt_accept_dequeue+0x1a5/0x4d0 [bluetooth]\n[ 561.670510] iso_sock_accept+0x271/0x830 [bluetooth]\n[ 561.670547] do_accept+0x3dd/0x610\n[ 561.670550] __sys_accept4+0xd8/0x170\n[ 561.670553] __x64_sys_accept+0x74/0xc0\n[ 561.670556] x64_sys_call+0x17d6/0x25f0\n[ 561.670559] do_syscall_64+0x87/0x150\n[ 561.670563] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 561.670567]\n -> #1 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}:\n[ 561.670571] lock_acquire+0x7c/0xc0\n[ 561.670574] lock_sock_nested+0x3b/0xf0\n[ 561.670577] iso_sock_listen+0x2de/0xf30 [bluetooth]\n[ 561.670617] __sys_listen_socket+0xef/0x130\n[ 561.670620] __x64_sys_listen+0xe1/0x190\n[ 561.670623] x64_sys_call+0x2517/0x25f0\n[ 561.670626] do_syscall_64+0x87/0x150\n[ 561.670629] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 561.670632]\n -> #0 (&hdev->lock){+.+.}-{3:3}:\n[ 561.670636] __lock_acquire+0x32ad/0x6ab0\n[ 561.670639] lock_acquire.part.0+0x118/0x360\n[ 561.670642] lock_acquire+0x7c/0xc0\n[ 561.670644] __mutex_lock+0x18d/0x12f0\n[ 561.670647] mutex_lock_nested+0x1b/0x30\n[ 561.670651] iso_conn_big_sync+0x73/0x260 [bluetooth]\n[ 561.670687] iso_sock_recvmsg+0x3e9/0x500 [bluetooth]\n[ 561.670722] sock_recvmsg+0x1d5/0x240\n[ 561.670725] sock_read_iter+0x27d/0x470\n[ 561.670727] vfs_read+0x9a0/0xd30\n[ 561.670731] ksys_read+0x1a8/0x250\n[ 561.670733] __x64_sys_read+0x72/0xc0\n[ 561.670736] x64_sys_call+0x1b12/0x25f0\n[ 561.670738] do_syscall_64+0x87/0x150\n[ 561.670741] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 561.670744]\n other info that might help us debug this:\n\n[ 561.670745] Chain exists of:\n&hdev->lock --> sk_lock-AF_BLUETOOTH-BTPROTO_ISO --> sk_lock-AF_BLUETOOTH\n\n[ 561.670751] Possible unsafe locking scenario:\n\n[ 561.670753] CPU0 CPU1\n[ 561.670754] ---- ----\n[ 561.670756] lock(sk_lock-AF_BLUETOOTH);\n[ 561.670758] lock(sk_lock\n AF_BLUETOOTH-BTPROTO_ISO);\n[ 561.670761] lock(sk_lock-AF_BLUETOOTH);\n[ 561.670764] lock(&hdev->lock);\n[ 561.670767]\n *** DEADLOCK ***", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:05.499Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/cbe640d6cae590b9a7d81ce86fe9a90e83eec1d5", }, { url: "https://git.kernel.org/stable/c/7a17308c17880d259105f6e591eb1bc77b9612f0", }, ], title: "Bluetooth: iso: Fix circular lock in iso_conn_big_sync", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-54191", datePublished: "2025-01-11T12:29:52.753Z", dateReserved: "2025-01-09T09:49:29.716Z", dateUpdated: "2025-01-20T06:22:05.499Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-49568
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
When receiving proposal msg in server, the fields v2_ext_offset/
eid_cnt/ism_gid_cnt in proposal msg are from the remote client
and can not be fully trusted. Especially the field v2_ext_offset,
once exceed the max value, there has the chance to access wrong
address, and crash may happen.
This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt
before using them.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/smc/af_smc.c", "net/smc/smc_clc.c", "net/smc/smc_clc.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "295a92e3df32e72aff0f4bc25c310e349d07ffbf", status: "affected", version: "8c3dca341aea885249e08856c4380300b75d2cf5", versionType: "git", }, { lessThan: "42f6beb2d5779429417b5f8115a4e3fa695d2a6c", status: "affected", version: "8c3dca341aea885249e08856c4380300b75d2cf5", versionType: "git", }, { lessThan: "7863c9f3d24ba49dbead7e03dfbe40deb5888fdf", status: "affected", version: "8c3dca341aea885249e08856c4380300b75d2cf5", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/smc/af_smc.c", "net/smc/smc_clc.c", "net/smc/smc_clc.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.10", }, { lessThan: "5.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg\n\nWhen receiving proposal msg in server, the fields v2_ext_offset/\neid_cnt/ism_gid_cnt in proposal msg are from the remote client\nand can not be fully trusted. Especially the field v2_ext_offset,\nonce exceed the max value, there has the chance to access wrong\naddress, and crash may happen.\n\nThis patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt\nbefore using them.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:16.194Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/295a92e3df32e72aff0f4bc25c310e349d07ffbf", }, { url: "https://git.kernel.org/stable/c/42f6beb2d5779429417b5f8115a4e3fa695d2a6c", }, { url: "https://git.kernel.org/stable/c/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf", }, ], title: "net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-49568", datePublished: "2025-01-11T12:35:36.190Z", dateReserved: "2025-01-11T12:34:02.664Z", dateUpdated: "2025-01-20T06:19:16.194Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-48881
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in
node allocations") leads a NULL pointer deference in cache_set_flush().
1721 if (!IS_ERR_OR_NULL(c->root))
1722 list_add(&c->root->list, &c->btree_cache);
>From the above code in cache_set_flush(), if previous registration code
fails before allocating c->root, it is possible c->root is NULL as what
it is initialized. __bch_btree_node_alloc() never returns NULL but
c->root is possible to be NULL at above line 1721.
This patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 0729029e647234fa1a94376b6edffec5c2cd75f6 Version: db9439cef0b5efccf8021fe89f4953e0f901e85b Version: 991e9c186a8ac6ab272a86e0ddc6f9733c38b867 Version: 68118c339c6e1e16ae017bef160dbe28a27ae9c8 Version: 028ddcac477b691dd9205c92f991cc15259d033e Version: 028ddcac477b691dd9205c92f991cc15259d033e Version: 028ddcac477b691dd9205c92f991cc15259d033e |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/md/bcache/super.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "4379c5828492a4c2a651c8f826a01453bd2b80b0", status: "affected", version: "0729029e647234fa1a94376b6edffec5c2cd75f6", versionType: "git", }, { lessThan: "336e30f32ae7c043fde0f6fa21586ff30bea9fe2", status: "affected", version: "db9439cef0b5efccf8021fe89f4953e0f901e85b", versionType: "git", }, { lessThan: "fb5fee35bdd18316a84b5f30881a24e1415e1464", status: "affected", version: "991e9c186a8ac6ab272a86e0ddc6f9733c38b867", versionType: "git", }, { lessThan: "5202391970ffbf81975251b3526b890ba027b715", status: "affected", version: "68118c339c6e1e16ae017bef160dbe28a27ae9c8", versionType: "git", }, { lessThan: "cc05aa2c0117e20fa25a3c0d915f98b8f2e78667", status: "affected", version: "028ddcac477b691dd9205c92f991cc15259d033e", versionType: "git", }, { lessThan: "5e0e913624bcd24f3de414475018d3023f060ee1", status: "affected", version: "028ddcac477b691dd9205c92f991cc15259d033e", versionType: "git", }, { lessThan: "b2e382ae12a63560fca35050498e19e760adf8c0", status: "affected", version: "028ddcac477b691dd9205c92f991cc15259d033e", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/md/bcache/super.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.5", }, { lessThan: "6.5", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.287", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: revert replacing IS_ERR_OR_NULL with IS_ERR again\n\nCommit 028ddcac477b (\"bcache: Remove unnecessary NULL point check in\nnode allocations\") leads a NULL pointer deference in cache_set_flush().\n\n1721 if (!IS_ERR_OR_NULL(c->root))\n1722 list_add(&c->root->list, &c->btree_cache);\n\n>From the above code in cache_set_flush(), if previous registration code\nfails before allocating c->root, it is possible c->root is NULL as what\nit is initialized. __bch_btree_node_alloc() never returns NULL but\nc->root is possible to be NULL at above line 1721.\n\nThis patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:14.763Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/4379c5828492a4c2a651c8f826a01453bd2b80b0", }, { url: "https://git.kernel.org/stable/c/336e30f32ae7c043fde0f6fa21586ff30bea9fe2", }, { url: "https://git.kernel.org/stable/c/fb5fee35bdd18316a84b5f30881a24e1415e1464", }, { url: "https://git.kernel.org/stable/c/5202391970ffbf81975251b3526b890ba027b715", }, { url: "https://git.kernel.org/stable/c/cc05aa2c0117e20fa25a3c0d915f98b8f2e78667", }, { url: "https://git.kernel.org/stable/c/5e0e913624bcd24f3de414475018d3023f060ee1", }, { url: "https://git.kernel.org/stable/c/b2e382ae12a63560fca35050498e19e760adf8c0", }, ], title: "bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-48881", datePublished: "2025-01-11T12:25:18.614Z", dateReserved: "2025-01-09T09:50:31.739Z", dateUpdated: "2025-01-20T06:19:14.763Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57838
Vulnerability from cvelistv5
Published
2025-01-11 14:08
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/entry: Mark IRQ entries to fix stack depot warnings
The stack depot filters out everything outside of the top interrupt
context as an uninteresting or irrelevant part of the stack traces. This
helps with stack trace de-duplication, avoiding an explosion of saved
stack traces that share the same IRQ context code path but originate
from different randomly interrupted points, eventually exhausting the
stack depot.
Filtering uses in_irqentry_text() to identify functions within the
.irqentry.text and .softirqentry.text sections, which then become the
last stack trace entries being saved.
While __do_softirq() is placed into the .softirqentry.text section by
common code, populating .irqentry.text is architecture-specific.
Currently, the .irqentry.text section on s390 is empty, which prevents
stack depot filtering and de-duplication and could result in warnings
like:
Stack depot reached limit capacity
WARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8
with PREEMPT and KASAN enabled.
Fix this by moving the IO/EXT interrupt handlers from .kprobes.text into
the .irqentry.text section and updating the kprobes blacklist to include
the .irqentry.text section.
This is done only for asynchronous interrupts and explicitly not for
program checks, which are synchronous and where the context beyond the
program check is important to preserve. Despite machine checks being
somewhat in between, they are extremely rare, and preserving context
when possible is also of value.
SVCs and Restart Interrupts are not relevant, one being always at the
boundary to user space and the other being a one-time thing.
IRQ entries filtering is also optionally used in ftrace function graph,
where the same logic applies.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "arch/s390/kernel/entry.S", "arch/s390/kernel/kprobes.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "ca687fdce5b95f84d91d6e36ac77047771eb3dfc", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "5bb7a2c3afcf8732dc65ea49c09147b07da1d993", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "1af22528fee8072b7adc007b8ca49cc4ea62689e", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "473ffae3030188f1c6b80e1b3631a26b4adf7b32", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "45c9f2b856a075a34873d00788d2e8a250c1effd", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "arch/s390/kernel/entry.S", "arch/s390/kernel/kprobes.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.64", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.4", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/entry: Mark IRQ entries to fix stack depot warnings\n\nThe stack depot filters out everything outside of the top interrupt\ncontext as an uninteresting or irrelevant part of the stack traces. This\nhelps with stack trace de-duplication, avoiding an explosion of saved\nstack traces that share the same IRQ context code path but originate\nfrom different randomly interrupted points, eventually exhausting the\nstack depot.\n\nFiltering uses in_irqentry_text() to identify functions within the\n.irqentry.text and .softirqentry.text sections, which then become the\nlast stack trace entries being saved.\n\nWhile __do_softirq() is placed into the .softirqentry.text section by\ncommon code, populating .irqentry.text is architecture-specific.\n\nCurrently, the .irqentry.text section on s390 is empty, which prevents\nstack depot filtering and de-duplication and could result in warnings\nlike:\n\nStack depot reached limit capacity\nWARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8\n\nwith PREEMPT and KASAN enabled.\n\nFix this by moving the IO/EXT interrupt handlers from .kprobes.text into\nthe .irqentry.text section and updating the kprobes blacklist to include\nthe .irqentry.text section.\n\nThis is done only for asynchronous interrupts and explicitly not for\nprogram checks, which are synchronous and where the context beyond the\nprogram check is important to preserve. Despite machine checks being\nsomewhat in between, they are extremely rare, and preserving context\nwhen possible is also of value.\n\nSVCs and Restart Interrupts are not relevant, one being always at the\nboundary to user space and the other being a one-time thing.\n\nIRQ entries filtering is also optionally used in ftrace function graph,\nwhere the same logic applies.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:28.755Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/ca687fdce5b95f84d91d6e36ac77047771eb3dfc", }, { url: "https://git.kernel.org/stable/c/5bb7a2c3afcf8732dc65ea49c09147b07da1d993", }, { url: "https://git.kernel.org/stable/c/1af22528fee8072b7adc007b8ca49cc4ea62689e", }, { url: "https://git.kernel.org/stable/c/473ffae3030188f1c6b80e1b3631a26b4adf7b32", }, { url: "https://git.kernel.org/stable/c/45c9f2b856a075a34873d00788d2e8a250c1effd", }, ], title: "s390/entry: Mark IRQ entries to fix stack depot warnings", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57838", datePublished: "2025-01-11T14:08:56.951Z", dateReserved: "2025-01-11T12:32:49.349Z", dateUpdated: "2025-01-20T06:28:28.755Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-41935
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:18
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to shrink read extent node in batches
We use rwlock to protect core structure data of extent tree during
its shrink, however, if there is a huge number of extent nodes in
extent tree, during shrink of extent tree, it may hold rwlock for
a very long time, which may trigger kernel hang issue.
This patch fixes to shrink read extent node in batches, so that,
critical region of the rwlock can be shrunk to avoid its extreme
long time hold.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/f2fs/extent_cache.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "295b50e95e900da31ff237e46e04525fa799b2cf", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "924f7dd1e832e4e4530d14711db223d2803f7b61", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/f2fs/extent_cache.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to shrink read extent node in batches\n\nWe use rwlock to protect core structure data of extent tree during\nits shrink, however, if there is a huge number of extent nodes in\nextent tree, during shrink of extent tree, it may hold rwlock for\na very long time, which may trigger kernel hang issue.\n\nThis patch fixes to shrink read extent node in batches, so that,\ncritical region of the rwlock can be shrunk to avoid its extreme\nlong time hold.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:18:58.682Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/295b50e95e900da31ff237e46e04525fa799b2cf", }, { url: "https://git.kernel.org/stable/c/924f7dd1e832e4e4530d14711db223d2803f7b61", }, { url: "https://git.kernel.org/stable/c/3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343", }, ], title: "f2fs: fix to shrink read extent node in batches", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-41935", datePublished: "2025-01-11T12:25:09.701Z", dateReserved: "2025-01-09T09:49:29.702Z", dateUpdated: "2025-01-20T06:18:58.682Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-53685
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-02-26 14:26
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: give up on paths longer than PATH_MAX
If the full path to be built by ceph_mdsc_build_path() happens to be
longer than PATH_MAX, then this function will enter an endless (retry)
loop, effectively blocking the whole task. Most of the machine
becomes unusable, making this a very simple and effective DoS
vulnerability.
I cannot imagine why this retry was ever implemented, but it seems
rather useless and harmful to me. Let's remove it and fail with
ENAMETOOLONG instead.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 9030aaf9bf0a1eee47a154c316c789e959638b0f Version: 9030aaf9bf0a1eee47a154c316c789e959638b0f Version: 9030aaf9bf0a1eee47a154c316c789e959638b0f Version: 9030aaf9bf0a1eee47a154c316c789e959638b0f Version: 9030aaf9bf0a1eee47a154c316c789e959638b0f Version: 9030aaf9bf0a1eee47a154c316c789e959638b0f |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/ceph/mds_client.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "0f2b2d9e881c90402dbe28f9ba831775b7992e1f", status: "affected", version: "9030aaf9bf0a1eee47a154c316c789e959638b0f", versionType: "git", }, { lessThan: "d42ad3f161a5a487f81915c406f46943c7187a0a", status: "affected", version: "9030aaf9bf0a1eee47a154c316c789e959638b0f", versionType: "git", }, { lessThan: "e4b168c64da06954be5d520f6c16469b1cadc069", status: "affected", version: "9030aaf9bf0a1eee47a154c316c789e959638b0f", versionType: "git", }, { lessThan: "c47ed91156daf328601d02b58d52d9804da54108", status: "affected", version: "9030aaf9bf0a1eee47a154c316c789e959638b0f", versionType: "git", }, { lessThan: "99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa", status: "affected", version: "9030aaf9bf0a1eee47a154c316c789e959638b0f", versionType: "git", }, { lessThan: "550f7ca98ee028a606aa75705a7e77b1bd11720f", status: "affected", version: "9030aaf9bf0a1eee47a154c316c789e959638b0f", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/ceph/mds_client.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "2.6.34", }, { lessThan: "2.6.34", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.234", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.177", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.125", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.70", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: give up on paths longer than PATH_MAX\n\nIf the full path to be built by ceph_mdsc_build_path() happens to be\nlonger than PATH_MAX, then this function will enter an endless (retry)\nloop, effectively blocking the whole task. Most of the machine\nbecomes unusable, making this a very simple and effective DoS\nvulnerability.\n\nI cannot imagine why this retry was ever implemented, but it seems\nrather useless and harmful to me. Let's remove it and fail with\nENAMETOOLONG instead.", }, ], providerMetadata: { dateUpdated: "2025-02-26T14:26:00.609Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f", }, { url: "https://git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a", }, { url: "https://git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069", }, { url: "https://git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108", }, { url: "https://git.kernel.org/stable/c/99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa", }, { url: "https://git.kernel.org/stable/c/550f7ca98ee028a606aa75705a7e77b1bd11720f", }, ], title: "ceph: give up on paths longer than PATH_MAX", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-53685", datePublished: "2025-01-11T12:35:40.252Z", dateReserved: "2025-01-11T12:34:02.558Z", dateUpdated: "2025-02-26T14:26:00.609Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-48873
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-21 10:55
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
The return value of ieee80211_probereq_get() might be NULL, so check it
before using to avoid NULL pointer access.
Addresses-Coverity-ID: 1529805 ("Dereference null return value")
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/net/wireless/realtek/rtw89/fw.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "1a0f54cb3fea5d087440b2bae03202c445156a8d", status: "affected", version: "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0", versionType: "git", }, { lessThan: "7296e5611adb2c619bd7bd3817ddde7ba865ef17", status: "affected", version: "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0", versionType: "git", }, { lessThan: "630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c", status: "affected", version: "c6aa9a9c47252ac7b07ed6d10459027e2f2a2de0", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/net/wireless/realtek/rtw89/fw.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.4", }, { lessThan: "6.4", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: check return value of ieee80211_probereq_get() for RNR\n\nThe return value of ieee80211_probereq_get() might be NULL, so check it\nbefore using to avoid NULL pointer access.\n\nAddresses-Coverity-ID: 1529805 (\"Dereference null return value\")", }, ], providerMetadata: { dateUpdated: "2025-01-21T10:55:21.306Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/1a0f54cb3fea5d087440b2bae03202c445156a8d", }, { url: "https://git.kernel.org/stable/c/7296e5611adb2c619bd7bd3817ddde7ba865ef17", }, { url: "https://git.kernel.org/stable/c/630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c", }, ], title: "wifi: rtw89: check return value of ieee80211_probereq_get() for RNR", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-48873", datePublished: "2025-01-11T12:25:16.127Z", dateReserved: "2025-01-09T09:50:31.765Z", dateUpdated: "2025-01-21T10:55:21.306Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57791
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: check return value of sock_recvmsg when draining clc data
When receiving clc msg, the field length in smc_clc_msg_hdr indicates the
length of msg should be received from network and the value should not be
fully trusted as it is from the network. Once the value of length exceeds
the value of buflen in function smc_clc_wait_msg it may run into deadloop
when trying to drain the remaining data exceeding buflen.
This patch checks the return value of sock_recvmsg when draining data in
case of deadloop in draining.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 Version: fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 Version: fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 Version: fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 Version: fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 Version: fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/smc/smc_clc.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "82c7ad9ca09975aae737abffd66d1ad98874c13d", status: "affected", version: "fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1", versionType: "git", }, { lessThan: "6b80924af6216277892d5f091f5bfc7d1265fa28", status: "affected", version: "fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1", versionType: "git", }, { lessThan: "d7d1f986ebb284b1db8dafca7d1bdb6dd2445cf6", status: "affected", version: "fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1", versionType: "git", }, { lessThan: "7a6927814b4256d603e202ae7c5e38db3b338896", status: "affected", version: "fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1", versionType: "git", }, { lessThan: "df3dfe1a93c6298d8c09a18e4fba19ef5b17763b", status: "affected", version: "fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1", versionType: "git", }, { lessThan: "c5b8ee5022a19464783058dc6042e8eefa34e8cd", status: "affected", version: "fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/smc/smc_clc.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.8", }, { lessThan: "5.8", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.233", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.122", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check return value of sock_recvmsg when draining clc data\n\nWhen receiving clc msg, the field length in smc_clc_msg_hdr indicates the\nlength of msg should be received from network and the value should not be\nfully trusted as it is from the network. Once the value of length exceeds\nthe value of buflen in function smc_clc_wait_msg it may run into deadloop\nwhen trying to drain the remaining data exceeding buflen.\n\nThis patch checks the return value of sock_recvmsg when draining data in\ncase of deadloop in draining.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:12.638Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/82c7ad9ca09975aae737abffd66d1ad98874c13d", }, { url: "https://git.kernel.org/stable/c/6b80924af6216277892d5f091f5bfc7d1265fa28", }, { url: "https://git.kernel.org/stable/c/d7d1f986ebb284b1db8dafca7d1bdb6dd2445cf6", }, { url: "https://git.kernel.org/stable/c/7a6927814b4256d603e202ae7c5e38db3b338896", }, { url: "https://git.kernel.org/stable/c/df3dfe1a93c6298d8c09a18e4fba19ef5b17763b", }, { url: "https://git.kernel.org/stable/c/c5b8ee5022a19464783058dc6042e8eefa34e8cd", }, ], title: "net/smc: check return value of sock_recvmsg when draining clc data", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57791", datePublished: "2025-01-11T12:35:48.905Z", dateReserved: "2025-01-09T09:50:31.752Z", dateUpdated: "2025-01-20T06:28:12.638Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-41149
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-02-11 15:45
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: avoid to reuse `hctx` not removed from cpuhp callback list
If the 'hctx' isn't removed from cpuhp callback list, we can't reuse it,
otherwise use-after-free may be triggered.
References
Impacted products
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-41149", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2025-02-11T15:41:11.000102Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-416", description: "CWE-416 Use After Free", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-11T15:45:20.309Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "block/blk-mq.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "ee18012c80155f6809522804099621070c69ec72", status: "affected", version: "58bf93580fec30d84a46be41171c5fad98b5cc70", versionType: "git", }, { lessThan: "b5792c162dcf6197bf3d2de2be6c8169435b73d0", status: "affected", version: "c1291ea131d186296dc8d328a36c3caf38e8e159", versionType: "git", }, { lessThan: "85672ca9ceeaa1dcf2777a7048af5f4aee3fd02b", status: "affected", version: "22465bbac53c821319089016f268a2437de9b00a", versionType: "git", }, ], }, { defaultStatus: "unaffected", product: "Linux", programFiles: [ "block/blk-mq.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "6.12.7", status: "affected", version: "6.12.6", versionType: "semver", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: avoid to reuse `hctx` not removed from cpuhp callback list\n\nIf the 'hctx' isn't removed from cpuhp callback list, we can't reuse it,\notherwise use-after-free may be triggered.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:18:56.383Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/ee18012c80155f6809522804099621070c69ec72", }, { url: "https://git.kernel.org/stable/c/b5792c162dcf6197bf3d2de2be6c8169435b73d0", }, { url: "https://git.kernel.org/stable/c/85672ca9ceeaa1dcf2777a7048af5f4aee3fd02b", }, ], title: "block: avoid to reuse `hctx` not removed from cpuhp callback list", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-41149", datePublished: "2025-01-11T12:35:33.428Z", dateReserved: "2025-01-11T12:33:33.672Z", dateUpdated: "2025-02-11T15:45:20.309Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-50051
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-02-10 17:21
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: mpc52xx: Add cancel_work_sync before module remove
If we remove the module which will call mpc52xx_spi_remove
it will free 'ms' through spi_unregister_controller.
while the work ms->work will be used. The sequence of operations
that may lead to a UAF bug.
Fix it by ensuring that the work is canceled before proceeding with
the cleanup in mpc52xx_spi_remove.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: ca632f556697d45d67ed5cada7cedf3ddfe0db4b Version: ca632f556697d45d67ed5cada7cedf3ddfe0db4b Version: ca632f556697d45d67ed5cada7cedf3ddfe0db4b Version: ca632f556697d45d67ed5cada7cedf3ddfe0db4b Version: ca632f556697d45d67ed5cada7cedf3ddfe0db4b Version: ca632f556697d45d67ed5cada7cedf3ddfe0db4b Version: ca632f556697d45d67ed5cada7cedf3ddfe0db4b |
||||||
|
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-50051", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2025-02-10T17:12:07.926078Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-416", description: "CWE-416 Use After Free", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-10T17:21:06.363Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/spi/spi-mpc52xx.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1", status: "affected", version: "ca632f556697d45d67ed5cada7cedf3ddfe0db4b", versionType: "git", }, { lessThan: "e0c6ce8424095c2da32a063d3fc027494c689817", status: "affected", version: "ca632f556697d45d67ed5cada7cedf3ddfe0db4b", versionType: "git", }, { lessThan: "cd5106c77d6d6828aa82449f01f4eb436d602a21", status: "affected", version: "ca632f556697d45d67ed5cada7cedf3ddfe0db4b", versionType: "git", }, { lessThan: "373d55a47dc662e5e30d12ad5d334312f757c1f1", status: "affected", version: "ca632f556697d45d67ed5cada7cedf3ddfe0db4b", versionType: "git", }, { lessThan: "f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59", status: "affected", version: "ca632f556697d45d67ed5cada7cedf3ddfe0db4b", versionType: "git", }, { lessThan: "90b72189de2cddacb26250579da0510b29a8b82b", status: "affected", version: "ca632f556697d45d67ed5cada7cedf3ddfe0db4b", versionType: "git", }, { lessThan: "984836621aad98802d92c4a3047114cf518074c8", status: "affected", version: "ca632f556697d45d67ed5cada7cedf3ddfe0db4b", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/spi/spi-mpc52xx.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "3.1", }, { lessThan: "3.1", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.287", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: Add cancel_work_sync before module remove\n\nIf we remove the module which will call mpc52xx_spi_remove\nit will free 'ms' through spi_unregister_controller.\nwhile the work ms->work will be used. The sequence of operations\nthat may lead to a UAF bug.\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in mpc52xx_spi_remove.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:31.957Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1", }, { url: "https://git.kernel.org/stable/c/e0c6ce8424095c2da32a063d3fc027494c689817", }, { url: "https://git.kernel.org/stable/c/cd5106c77d6d6828aa82449f01f4eb436d602a21", }, { url: "https://git.kernel.org/stable/c/373d55a47dc662e5e30d12ad5d334312f757c1f1", }, { url: "https://git.kernel.org/stable/c/f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59", }, { url: "https://git.kernel.org/stable/c/90b72189de2cddacb26250579da0510b29a8b82b", }, { url: "https://git.kernel.org/stable/c/984836621aad98802d92c4a3047114cf518074c8", }, ], title: "spi: mpc52xx: Add cancel_work_sync before module remove", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-50051", datePublished: "2025-01-11T12:25:20.277Z", dateReserved: "2025-01-09T09:50:31.785Z", dateUpdated: "2025-02-10T17:21:06.363Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57872
Vulnerability from cvelistv5
Published
2025-01-11 14:31
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
This will ensure that the scsi host is cleaned up properly using
scsi_host_dev_release(). Otherwise, it may lead to memory leaks.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/ufs/host/ufshcd-pltfrm.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "cd188519d2467ab4c2141587b0551ba030abff0e", status: "affected", version: "03b1781aa978aab345b5a85d8596f8615281ba89", versionType: "git", }, { lessThan: "897df60c16d54ad515a3d0887edab5c63da06d1f", status: "affected", version: "03b1781aa978aab345b5a85d8596f8615281ba89", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/ufs/host/ufshcd-pltfrm.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "3.10", }, { lessThan: "3.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()\n\nThis will ensure that the scsi host is cleaned up properly using\nscsi_host_dev_release(). Otherwise, it may lead to memory leaks.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:38.144Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/cd188519d2467ab4c2141587b0551ba030abff0e", }, { url: "https://git.kernel.org/stable/c/897df60c16d54ad515a3d0887edab5c63da06d1f", }, ], title: "scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57872", datePublished: "2025-01-11T14:31:00.610Z", dateReserved: "2025-01-11T12:34:02.656Z", dateUpdated: "2025-01-20T06:28:38.144Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57878
Vulnerability from cvelistv5
Published
2025-01-11 14:49
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR
Currently fpmr_set() doesn't initialize the temporary 'fpmr' variable,
and a SETREGSET call with a length of zero will leave this
uninitialized. Consequently an arbitrary value will be written back to
target->thread.uw.fpmr, potentially leaking up to 64 bits of memory from
the kernel stack. The read is limited to a specific slot on the stack,
and the issue does not provide a write mechanism.
Fix this by initializing the temporary value before copying the regset
from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,
NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing
contents of FPMR will be retained.
Before this patch:
| # ./fpmr-test
| Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d
| SETREGSET(nt=0x40e, len=8) wrote 8 bytes
|
| Attempting to read NT_ARM_FPMR::fpmr
| GETREGSET(nt=0x40e, len=8) read 8 bytes
| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d
|
| Attempting to write NT_ARM_FPMR (zero length)
| SETREGSET(nt=0x40e, len=0) wrote 0 bytes
|
| Attempting to read NT_ARM_FPMR::fpmr
| GETREGSET(nt=0x40e, len=8) read 8 bytes
| Read NT_ARM_FPMR::fpmr = 0xffff800083963d50
After this patch:
| # ./fpmr-test
| Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d
| SETREGSET(nt=0x40e, len=8) wrote 8 bytes
|
| Attempting to read NT_ARM_FPMR::fpmr
| GETREGSET(nt=0x40e, len=8) read 8 bytes
| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d
|
| Attempting to write NT_ARM_FPMR (zero length)
| SETREGSET(nt=0x40e, len=0) wrote 0 bytes
|
| Attempting to read NT_ARM_FPMR::fpmr
| GETREGSET(nt=0x40e, len=8) read 8 bytes
| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "arch/arm64/kernel/ptrace.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "8ab73c34e3c5b580721696665eabd799346bc50b", status: "affected", version: "4035c22ef7d43a6c00d6a6584c60e902b95b46af", versionType: "git", }, { lessThan: "f5d71291841aecfe5d8435da2dfa7f58ccd18bc8", status: "affected", version: "4035c22ef7d43a6c00d6a6584c60e902b95b46af", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "arch/arm64/kernel/ptrace.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.9", }, { lessThan: "6.9", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR\n\nCurrently fpmr_set() doesn't initialize the temporary 'fpmr' variable,\nand a SETREGSET call with a length of zero will leave this\nuninitialized. Consequently an arbitrary value will be written back to\ntarget->thread.uw.fpmr, potentially leaking up to 64 bits of memory from\nthe kernel stack. The read is limited to a specific slot on the stack,\nand the issue does not provide a write mechanism.\n\nFix this by initializing the temporary value before copying the regset\nfrom userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,\nNT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing\ncontents of FPMR will be retained.\n\nBefore this patch:\n\n| # ./fpmr-test\n| Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d\n| SETREGSET(nt=0x40e, len=8) wrote 8 bytes\n|\n| Attempting to read NT_ARM_FPMR::fpmr\n| GETREGSET(nt=0x40e, len=8) read 8 bytes\n| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d\n|\n| Attempting to write NT_ARM_FPMR (zero length)\n| SETREGSET(nt=0x40e, len=0) wrote 0 bytes\n|\n| Attempting to read NT_ARM_FPMR::fpmr\n| GETREGSET(nt=0x40e, len=8) read 8 bytes\n| Read NT_ARM_FPMR::fpmr = 0xffff800083963d50\n\nAfter this patch:\n\n| # ./fpmr-test\n| Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d\n| SETREGSET(nt=0x40e, len=8) wrote 8 bytes\n|\n| Attempting to read NT_ARM_FPMR::fpmr\n| GETREGSET(nt=0x40e, len=8) read 8 bytes\n| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d\n|\n| Attempting to write NT_ARM_FPMR (zero length)\n| SETREGSET(nt=0x40e, len=0) wrote 0 bytes\n|\n| Attempting to read NT_ARM_FPMR::fpmr\n| GETREGSET(nt=0x40e, len=8) read 8 bytes\n| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:44.017Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/8ab73c34e3c5b580721696665eabd799346bc50b", }, { url: "https://git.kernel.org/stable/c/f5d71291841aecfe5d8435da2dfa7f58ccd18bc8", }, ], title: "arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57878", datePublished: "2025-01-11T14:49:04.088Z", dateReserved: "2025-01-11T14:45:42.023Z", dateUpdated: "2025-01-20T06:28:44.017Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-47794
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Prevent tailcall infinite loop caused by freplace
There is a potential infinite loop issue that can occur when using a
combination of tail calls and freplace.
In an upcoming selftest, the attach target for entry_freplace of
tailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in
entry_freplace leads to entry_tc. This results in an infinite loop:
entry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc.
The problem arises because the tail_call_cnt in entry_freplace resets to
zero each time entry_freplace is executed, causing the tail call mechanism
to never terminate, eventually leading to a kernel panic.
To fix this issue, the solution is twofold:
1. Prevent updating a program extended by an freplace program to a
prog_array map.
2. Prevent extending a program that is already part of a prog_array map
with an freplace program.
This ensures that:
* If a program or its subprogram has been extended by an freplace program,
it can no longer be updated to a prog_array map.
* If a program has been added to a prog_array map, neither it nor its
subprograms can be extended by an freplace program.
Moreover, an extension program should not be tailcalled. As such, return
-EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a
prog_array map.
Additionally, fix a minor code style issue by replacing eight spaces with a
tab for proper formatting.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "include/linux/bpf.h", "kernel/bpf/arraymap.c", "kernel/bpf/core.c", "kernel/bpf/syscall.c", "kernel/bpf/trampoline.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "987aa730bad3e1ef66d9f30182294daa78f6387d", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "d6083f040d5d8f8d748462c77e90547097df936e", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "include/linux/bpf.h", "kernel/bpf/arraymap.c", "kernel/bpf/core.c", "kernel/bpf/syscall.c", "kernel/bpf/trampoline.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent tailcall infinite loop caused by freplace\n\nThere is a potential infinite loop issue that can occur when using a\ncombination of tail calls and freplace.\n\nIn an upcoming selftest, the attach target for entry_freplace of\ntailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in\nentry_freplace leads to entry_tc. This results in an infinite loop:\n\nentry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc.\n\nThe problem arises because the tail_call_cnt in entry_freplace resets to\nzero each time entry_freplace is executed, causing the tail call mechanism\nto never terminate, eventually leading to a kernel panic.\n\nTo fix this issue, the solution is twofold:\n\n1. Prevent updating a program extended by an freplace program to a\n prog_array map.\n2. Prevent extending a program that is already part of a prog_array map\n with an freplace program.\n\nThis ensures that:\n\n* If a program or its subprogram has been extended by an freplace program,\n it can no longer be updated to a prog_array map.\n* If a program has been added to a prog_array map, neither it nor its\n subprograms can be extended by an freplace program.\n\nMoreover, an extension program should not be tailcalled. As such, return\n-EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a\nprog_array map.\n\nAdditionally, fix a minor code style issue by replacing eight spaces with a\ntab for proper formatting.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:06.802Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/987aa730bad3e1ef66d9f30182294daa78f6387d", }, { url: "https://git.kernel.org/stable/c/d6083f040d5d8f8d748462c77e90547097df936e", }, ], title: "bpf: Prevent tailcall infinite loop caused by freplace", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-47794", datePublished: "2025-01-11T12:25:14.419Z", dateReserved: "2025-01-09T09:49:29.737Z", dateUpdated: "2025-01-20T06:19:06.802Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-56372
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: tun: fix tun_napi_alloc_frags()
syzbot reported the following crash [1]
Issue came with the blamed commit. Instead of going through
all the iov components, we keep using the first one
and end up with a malformed skb.
[1]
kernel BUG at net/core/skbuff.c:2849 !
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 6230 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00407-g96b6fcc0ee41 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
RIP: 0010:__pskb_pull_tail+0x1568/0x1570 net/core/skbuff.c:2848
Code: 38 c1 0f 8c 32 f1 ff ff 4c 89 f7 e8 92 96 74 f8 e9 25 f1 ff ff e8 e8 ae 09 f8 48 8b 5c 24 08 e9 eb fb ff ff e8 d9 ae 09 f8 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90004cbef30 EFLAGS: 00010293
RAX: ffffffff8995c347 RBX: 00000000fffffff2 RCX: ffff88802cf45a00
RDX: 0000000000000000 RSI: 00000000fffffff2 RDI: 0000000000000000
RBP: ffff88807df0c06a R08: ffffffff8995b084 R09: 1ffff1100fbe185c
R10: dffffc0000000000 R11: ffffed100fbe185d R12: ffff888076e85d50
R13: ffff888076e85c80 R14: ffff888076e85cf4 R15: ffff888076e85c80
FS: 00007f0dca6ea6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0dca6ead58 CR3: 00000000119da000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
skb_cow_data+0x2da/0xcb0 net/core/skbuff.c:5284
tipc_aead_decrypt net/tipc/crypto.c:894 [inline]
tipc_crypto_rcv+0x402/0x24e0 net/tipc/crypto.c:1844
tipc_rcv+0x57e/0x12a0 net/tipc/node.c:2109
tipc_l2_rcv_msg+0x2bd/0x450 net/tipc/bearer.c:668
__netif_receive_skb_list_ptype net/core/dev.c:5720 [inline]
__netif_receive_skb_list_core+0x8b7/0x980 net/core/dev.c:5762
__netif_receive_skb_list net/core/dev.c:5814 [inline]
netif_receive_skb_list_internal+0xa51/0xe30 net/core/dev.c:5905
gro_normal_list include/net/gro.h:515 [inline]
napi_complete_done+0x2b5/0x870 net/core/dev.c:6256
napi_complete include/linux/netdevice.h:567 [inline]
tun_get_user+0x2ea0/0x4890 drivers/net/tun.c:1982
tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2057
do_iter_readv_writev+0x600/0x880
vfs_writev+0x376/0xba0 fs/read_write.c:1050
do_writev+0x1b6/0x360 fs/read_write.c:1096
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/net/tun.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "efe74dd58a72bd987b158142c904b7ef2ad132e2", status: "affected", version: "de4f5fed3f231a8ff4790bf52975f847b95b85ea", versionType: "git", }, { lessThan: "4f393ea1e2f9c3b646d00572dd92c48b1869c65f", status: "affected", version: "de4f5fed3f231a8ff4790bf52975f847b95b85ea", versionType: "git", }, { lessThan: "429fde2d81bcef0ebab002215358955704586457", status: "affected", version: "de4f5fed3f231a8ff4790bf52975f847b95b85ea", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/net/tun.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.4", }, { lessThan: "6.4", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: fix tun_napi_alloc_frags()\n\nsyzbot reported the following crash [1]\n\nIssue came with the blamed commit. Instead of going through\nall the iov components, we keep using the first one\nand end up with a malformed skb.\n\n[1]\n\nkernel BUG at net/core/skbuff.c:2849 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 6230 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00407-g96b6fcc0ee41 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024\n RIP: 0010:__pskb_pull_tail+0x1568/0x1570 net/core/skbuff.c:2848\nCode: 38 c1 0f 8c 32 f1 ff ff 4c 89 f7 e8 92 96 74 f8 e9 25 f1 ff ff e8 e8 ae 09 f8 48 8b 5c 24 08 e9 eb fb ff ff e8 d9 ae 09 f8 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90\nRSP: 0018:ffffc90004cbef30 EFLAGS: 00010293\nRAX: ffffffff8995c347 RBX: 00000000fffffff2 RCX: ffff88802cf45a00\nRDX: 0000000000000000 RSI: 00000000fffffff2 RDI: 0000000000000000\nRBP: ffff88807df0c06a R08: ffffffff8995b084 R09: 1ffff1100fbe185c\nR10: dffffc0000000000 R11: ffffed100fbe185d R12: ffff888076e85d50\nR13: ffff888076e85c80 R14: ffff888076e85cf4 R15: ffff888076e85c80\nFS: 00007f0dca6ea6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f0dca6ead58 CR3: 00000000119da000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n skb_cow_data+0x2da/0xcb0 net/core/skbuff.c:5284\n tipc_aead_decrypt net/tipc/crypto.c:894 [inline]\n tipc_crypto_rcv+0x402/0x24e0 net/tipc/crypto.c:1844\n tipc_rcv+0x57e/0x12a0 net/tipc/node.c:2109\n tipc_l2_rcv_msg+0x2bd/0x450 net/tipc/bearer.c:668\n __netif_receive_skb_list_ptype net/core/dev.c:5720 [inline]\n __netif_receive_skb_list_core+0x8b7/0x980 net/core/dev.c:5762\n __netif_receive_skb_list net/core/dev.c:5814 [inline]\n netif_receive_skb_list_internal+0xa51/0xe30 net/core/dev.c:5905\n gro_normal_list include/net/gro.h:515 [inline]\n napi_complete_done+0x2b5/0x870 net/core/dev.c:6256\n napi_complete include/linux/netdevice.h:567 [inline]\n tun_get_user+0x2ea0/0x4890 drivers/net/tun.c:1982\n tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2057\n do_iter_readv_writev+0x600/0x880\n vfs_writev+0x376/0xba0 fs/read_write.c:1050\n do_writev+0x1b6/0x360 fs/read_write.c:1096\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:20.565Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/efe74dd58a72bd987b158142c904b7ef2ad132e2", }, { url: "https://git.kernel.org/stable/c/4f393ea1e2f9c3b646d00572dd92c48b1869c65f", }, { url: "https://git.kernel.org/stable/c/429fde2d81bcef0ebab002215358955704586457", }, ], title: "net: tun: fix tun_napi_alloc_frags()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-56372", datePublished: "2025-01-11T12:35:47.256Z", dateReserved: "2025-01-11T12:34:02.635Z", dateUpdated: "2025-01-20T06:22:20.565Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-23128
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2025-01-11T14:42:18.272Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, rejectedReasons: [ { lang: "en", value: "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", }, ], }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2025-23128", datePublished: "2025-01-11T14:31:04.696Z", dateRejected: "2025-01-11T14:42:18.272Z", dateReserved: "2025-01-11T14:28:41.510Z", dateUpdated: "2025-01-11T14:42:18.272Z", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57879
Vulnerability from cvelistv5
Published
2025-01-11 15:05
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: iso: Always release hdev at the end of iso_listen_bis
Since hci_get_route holds the device before returning, the hdev
should be released with hci_dev_put at the end of iso_listen_bis
even if the function returns with an error.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/bluetooth/iso.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "4ca50db1c567d658d173c5ef3ee6c52b0b03603c", status: "affected", version: "02171da6e86a73e1b343b36722f5d9d5c04b3539", versionType: "git", }, { lessThan: "9c76fff747a73ba01d1d87ed53dd9c00cb40ba05", status: "affected", version: "02171da6e86a73e1b343b36722f5d9d5c04b3539", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/bluetooth/iso.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.9", }, { lessThan: "6.9", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: iso: Always release hdev at the end of iso_listen_bis\n\nSince hci_get_route holds the device before returning, the hdev\nshould be released with hci_dev_put at the end of iso_listen_bis\neven if the function returns with an error.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:45.278Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/4ca50db1c567d658d173c5ef3ee6c52b0b03603c", }, { url: "https://git.kernel.org/stable/c/9c76fff747a73ba01d1d87ed53dd9c00cb40ba05", }, ], title: "Bluetooth: iso: Always release hdev at the end of iso_listen_bis", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57879", datePublished: "2025-01-11T15:05:22.760Z", dateReserved: "2025-01-11T14:45:42.023Z", dateUpdated: "2025-01-20T06:28:45.278Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-48876
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
stackdepot: fix stack_depot_save_flags() in NMI context
Per documentation, stack_depot_save_flags() was meant to be usable from
NMI context if STACK_DEPOT_FLAG_CAN_ALLOC is unset. However, it still
would try to take the pool_lock in an attempt to save a stack trace in the
current pool (if space is available).
This could result in deadlock if an NMI is handled while pool_lock is
already held. To avoid deadlock, only try to take the lock in NMI context
and give up if unsuccessful.
The documentation is fixed to clearly convey this.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "include/linux/stackdepot.h", "lib/stackdepot.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "9bfeeeff2c92b9dd261198b601b45bde4c529841", status: "affected", version: "4434a56ec20925333d6cf4d4093641d063abd35b", versionType: "git", }, { lessThan: "031e04bdc834cda3b054ef6b698503b2b97e8186", status: "affected", version: "4434a56ec20925333d6cf4d4093641d063abd35b", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "include/linux/stackdepot.h", "lib/stackdepot.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.8", }, { lessThan: "6.8", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nstackdepot: fix stack_depot_save_flags() in NMI context\n\nPer documentation, stack_depot_save_flags() was meant to be usable from\nNMI context if STACK_DEPOT_FLAG_CAN_ALLOC is unset. However, it still\nwould try to take the pool_lock in an attempt to save a stack trace in the\ncurrent pool (if space is available).\n\nThis could result in deadlock if an NMI is handled while pool_lock is\nalready held. To avoid deadlock, only try to take the lock in NMI context\nand give up if unsuccessful.\n\nThe documentation is fixed to clearly convey this.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:13.331Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/9bfeeeff2c92b9dd261198b601b45bde4c529841", }, { url: "https://git.kernel.org/stable/c/031e04bdc834cda3b054ef6b698503b2b97e8186", }, ], title: "stackdepot: fix stack_depot_save_flags() in NMI context", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-48876", datePublished: "2025-01-11T12:25:17.819Z", dateReserved: "2025-01-09T09:51:32.384Z", dateUpdated: "2025-01-20T06:19:13.331Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-56368
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix overflow in __rb_map_vma
An overflow occurred when performing the following calculation:
nr_pages = ((nr_subbufs + 1) << subbuf_order) - pgoff;
Add a check before the calculation to avoid this problem.
syzbot reported this as a slab-out-of-bounds in __rb_map_vma:
BUG: KASAN: slab-out-of-bounds in __rb_map_vma+0x9ab/0xae0 kernel/trace/ring_buffer.c:7058
Read of size 8 at addr ffff8880767dd2b8 by task syz-executor187/5836
CPU: 0 UID: 0 PID: 5836 Comm: syz-executor187 Not tainted 6.13.0-rc2-syzkaller-00159-gf932fb9b4074 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:489
kasan_report+0xd9/0x110 mm/kasan/report.c:602
__rb_map_vma+0x9ab/0xae0 kernel/trace/ring_buffer.c:7058
ring_buffer_map+0x56e/0x9b0 kernel/trace/ring_buffer.c:7138
tracing_buffers_mmap+0xa6/0x120 kernel/trace/trace.c:8482
call_mmap include/linux/fs.h:2183 [inline]
mmap_file mm/internal.h:124 [inline]
__mmap_new_file_vma mm/vma.c:2291 [inline]
__mmap_new_vma mm/vma.c:2355 [inline]
__mmap_region+0x1786/0x2670 mm/vma.c:2456
mmap_region+0x127/0x320 mm/mmap.c:1348
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:580
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The reproducer for this bug is:
------------------------8<-------------------------
#include <fcntl.h>
#include <stdlib.h>
#include <unistd.h>
#include <asm/types.h>
#include <sys/mman.h>
int main(int argc, char **argv)
{
int page_size = getpagesize();
int fd;
void *meta;
system("echo 1 > /sys/kernel/tracing/buffer_size_kb");
fd = open("/sys/kernel/tracing/per_cpu/cpu0/trace_pipe_raw", O_RDONLY);
meta = mmap(NULL, page_size, PROT_READ, MAP_SHARED, fd, page_size * 5);
}
------------------------>8-------------------------
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "kernel/trace/ring_buffer.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "ec12f30fe54234dd40ffee50dda8d2df10bd0871", status: "affected", version: "117c39200d9d760cbd5944bb89efb7b9c51965aa", versionType: "git", }, { lessThan: "c58a812c8e49ad688f94f4b050ad5c5b388fc5d2", status: "affected", version: "117c39200d9d760cbd5944bb89efb7b9c51965aa", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "kernel/trace/ring_buffer.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.10", }, { lessThan: "6.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix overflow in __rb_map_vma\n\nAn overflow occurred when performing the following calculation:\n\n nr_pages = ((nr_subbufs + 1) << subbuf_order) - pgoff;\n\nAdd a check before the calculation to avoid this problem.\n\nsyzbot reported this as a slab-out-of-bounds in __rb_map_vma:\n\nBUG: KASAN: slab-out-of-bounds in __rb_map_vma+0x9ab/0xae0 kernel/trace/ring_buffer.c:7058\nRead of size 8 at addr ffff8880767dd2b8 by task syz-executor187/5836\n\nCPU: 0 UID: 0 PID: 5836 Comm: syz-executor187 Not tainted 6.13.0-rc2-syzkaller-00159-gf932fb9b4074 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:489\n kasan_report+0xd9/0x110 mm/kasan/report.c:602\n __rb_map_vma+0x9ab/0xae0 kernel/trace/ring_buffer.c:7058\n ring_buffer_map+0x56e/0x9b0 kernel/trace/ring_buffer.c:7138\n tracing_buffers_mmap+0xa6/0x120 kernel/trace/trace.c:8482\n call_mmap include/linux/fs.h:2183 [inline]\n mmap_file mm/internal.h:124 [inline]\n __mmap_new_file_vma mm/vma.c:2291 [inline]\n __mmap_new_vma mm/vma.c:2355 [inline]\n __mmap_region+0x1786/0x2670 mm/vma.c:2456\n mmap_region+0x127/0x320 mm/mmap.c:1348\n do_mmap+0xc00/0xfc0 mm/mmap.c:496\n vm_mmap_pgoff+0x1ba/0x360 mm/util.c:580\n ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542\n __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]\n __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]\n __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe reproducer for this bug is:\n\n------------------------8<-------------------------\n #include <fcntl.h>\n #include <stdlib.h>\n #include <unistd.h>\n #include <asm/types.h>\n #include <sys/mman.h>\n\n int main(int argc, char **argv)\n {\n\tint page_size = getpagesize();\n\tint fd;\n\tvoid *meta;\n\n\tsystem(\"echo 1 > /sys/kernel/tracing/buffer_size_kb\");\n\tfd = open(\"/sys/kernel/tracing/per_cpu/cpu0/trace_pipe_raw\", O_RDONLY);\n\n\tmeta = mmap(NULL, page_size, PROT_READ, MAP_SHARED, fd, page_size * 5);\n }\n------------------------>8-------------------------", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:18.217Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/ec12f30fe54234dd40ffee50dda8d2df10bd0871", }, { url: "https://git.kernel.org/stable/c/c58a812c8e49ad688f94f4b050ad5c5b388fc5d2", }, ], title: "ring-buffer: Fix overflow in __rb_map_vma", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-56368", datePublished: "2025-01-11T12:35:45.719Z", dateReserved: "2025-01-09T09:49:29.671Z", dateUpdated: "2025-01-20T06:22:18.217Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57876
Vulnerability from cvelistv5
Published
2025-01-11 14:49
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/dp_mst: Fix resetting msg rx state after topology removal
If the MST topology is removed during the reception of an MST down reply
or MST up request sideband message, the
drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset
from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with
the reading/parsing of the message from another thread via
drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is
possible since the reader/parser doesn't hold any lock while accessing
the reception state. This in turn can lead to a memory corruption in the
reader/parser as described by commit bd2fccac61b4 ("drm/dp_mst: Fix MST
sideband message body length check").
Fix the above by resetting the message reception state if needed before
reading/parsing a message. Another solution would be to hold the
drm_dp_mst_topology_mgr::lock for the whole duration of the message
reception/parsing in drm_dp_mst_handle_down_rep() and
drm_dp_mst_handle_up_req(), however this would require a bigger change.
Since the fix is also needed for stable, opting for the simpler solution
in this patch.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/gpu/drm/display/drm_dp_mst_topology.c", "include/drm/display/drm_dp_mst_helper.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "94b33b2d7640e807869451384eb88321dd0ffbd4", status: "affected", version: "b30fcedeba643ca16eaa6212c1245598b7cd830d", versionType: "git", }, { lessThan: "d834d20d2e86c52ed5cab41763fa61e6071680ef", status: "affected", version: "1d082618bbf3b6755b8cc68c0a8122af2842d593", versionType: "git", }, { lessThan: "be826b4451fd187a7c0b04be4f8243d5df6e0450", status: "affected", version: "1d082618bbf3b6755b8cc68c0a8122af2842d593", versionType: "git", }, { lessThan: "a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7", status: "affected", version: "1d082618bbf3b6755b8cc68c0a8122af2842d593", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/gpu/drm/display/drm_dp_mst_topology.c", "include/drm/display/drm_dp_mst_helper.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.3", }, { lessThan: "6.3", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp_mst: Fix resetting msg rx state after topology removal\n\nIf the MST topology is removed during the reception of an MST down reply\nor MST up request sideband message, the\ndrm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset\nfrom one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with\nthe reading/parsing of the message from another thread via\ndrm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is\npossible since the reader/parser doesn't hold any lock while accessing\nthe reception state. This in turn can lead to a memory corruption in the\nreader/parser as described by commit bd2fccac61b4 (\"drm/dp_mst: Fix MST\nsideband message body length check\").\n\nFix the above by resetting the message reception state if needed before\nreading/parsing a message. Another solution would be to hold the\ndrm_dp_mst_topology_mgr::lock for the whole duration of the message\nreception/parsing in drm_dp_mst_handle_down_rep() and\ndrm_dp_mst_handle_up_req(), however this would require a bigger change.\nSince the fix is also needed for stable, opting for the simpler solution\nin this patch.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:41.699Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/94b33b2d7640e807869451384eb88321dd0ffbd4", }, { url: "https://git.kernel.org/stable/c/d834d20d2e86c52ed5cab41763fa61e6071680ef", }, { url: "https://git.kernel.org/stable/c/be826b4451fd187a7c0b04be4f8243d5df6e0450", }, { url: "https://git.kernel.org/stable/c/a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7", }, ], title: "drm/dp_mst: Fix resetting msg rx state after topology removal", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57876", datePublished: "2025-01-11T14:49:02.550Z", dateReserved: "2025-01-11T14:45:42.023Z", dateUpdated: "2025-01-20T06:28:41.699Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-49573
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/fair: Fix NEXT_BUDDY
Adam reports that enabling NEXT_BUDDY insta triggers a WARN in
pick_next_entity().
Moving clear_buddies() up before the delayed dequeue bits ensures
no ->next buddy becomes delayed. Further ensure no new ->next buddy
ever starts as delayed.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "kernel/sched/fair.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "5dbe6816c49197677a5ecce749bd99929da147da", status: "affected", version: "152e11f6df293e816a6a37c69757033cdc72667d", versionType: "git", }, { lessThan: "493afbd187c4c9cc1642792c0d9ba400c3d6d90d", status: "affected", version: "152e11f6df293e816a6a37c69757033cdc72667d", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "kernel/sched/fair.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.12", }, { lessThan: "6.12", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/fair: Fix NEXT_BUDDY\n\nAdam reports that enabling NEXT_BUDDY insta triggers a WARN in\npick_next_entity().\n\nMoving clear_buddies() up before the delayed dequeue bits ensures\nno ->next buddy becomes delayed. Further ensure no new ->next buddy\never starts as delayed.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:20.697Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/5dbe6816c49197677a5ecce749bd99929da147da", }, { url: "https://git.kernel.org/stable/c/493afbd187c4c9cc1642792c0d9ba400c3d6d90d", }, ], title: "sched/fair: Fix NEXT_BUDDY", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-49573", datePublished: "2025-01-11T12:35:37.625Z", dateReserved: "2025-01-11T12:32:49.536Z", dateUpdated: "2025-01-20T06:19:20.697Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-49571
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
When receiving proposal msg in server, the field iparea_offset
and the field ipv6_prefixes_cnt in proposal msg are from the
remote client and can not be fully trusted. Especially the
field iparea_offset, once exceed the max value, there has the
chance to access wrong address, and crash may happen.
This patch checks iparea_offset and ipv6_prefixes_cnt before using them.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: e7b7a64a8493d47433fd003efbe6543e3f676294 Version: e7b7a64a8493d47433fd003efbe6543e3f676294 Version: e7b7a64a8493d47433fd003efbe6543e3f676294 Version: e7b7a64a8493d47433fd003efbe6543e3f676294 Version: e7b7a64a8493d47433fd003efbe6543e3f676294 Version: e7b7a64a8493d47433fd003efbe6543e3f676294 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/smc/af_smc.c", "net/smc/smc_clc.c", "net/smc/smc_clc.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "846bada23bfcdeb83621b045ed85dc06c7833ff0", status: "affected", version: "e7b7a64a8493d47433fd003efbe6543e3f676294", versionType: "git", }, { lessThan: "f10635268a0a49ee902a3b63b5dbb76f4fed498e", status: "affected", version: "e7b7a64a8493d47433fd003efbe6543e3f676294", versionType: "git", }, { lessThan: "62056d1592e63d85e82357ee2ae6a6a294f440b0", status: "affected", version: "e7b7a64a8493d47433fd003efbe6543e3f676294", versionType: "git", }, { lessThan: "91a7c27c1444ed4677b83fd5308d2cf03f5f0851", status: "affected", version: "e7b7a64a8493d47433fd003efbe6543e3f676294", versionType: "git", }, { lessThan: "47ce46349672a7e0c361bfe39ed0b22e824ef4fb", status: "affected", version: "e7b7a64a8493d47433fd003efbe6543e3f676294", versionType: "git", }, { lessThan: "a29e220d3c8edbf0e1beb0f028878a4a85966556", status: "affected", version: "e7b7a64a8493d47433fd003efbe6543e3f676294", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/smc/af_smc.c", "net/smc/smc_clc.c", "net/smc/smc_clc.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "4.16", }, { lessThan: "4.16", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.233", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.122", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg\n\nWhen receiving proposal msg in server, the field iparea_offset\nand the field ipv6_prefixes_cnt in proposal msg are from the\nremote client and can not be fully trusted. Especially the\nfield iparea_offset, once exceed the max value, there has the\nchance to access wrong address, and crash may happen.\n\nThis patch checks iparea_offset and ipv6_prefixes_cnt before using them.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:19.302Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/846bada23bfcdeb83621b045ed85dc06c7833ff0", }, { url: "https://git.kernel.org/stable/c/f10635268a0a49ee902a3b63b5dbb76f4fed498e", }, { url: "https://git.kernel.org/stable/c/62056d1592e63d85e82357ee2ae6a6a294f440b0", }, { url: "https://git.kernel.org/stable/c/91a7c27c1444ed4677b83fd5308d2cf03f5f0851", }, { url: "https://git.kernel.org/stable/c/47ce46349672a7e0c361bfe39ed0b22e824ef4fb", }, { url: "https://git.kernel.org/stable/c/a29e220d3c8edbf0e1beb0f028878a4a85966556", }, ], title: "net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-49571", datePublished: "2025-01-11T12:35:36.957Z", dateReserved: "2025-01-11T12:33:33.704Z", dateUpdated: "2025-01-20T06:19:19.302Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57875
Vulnerability from cvelistv5
Published
2025-01-11 14:49
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: RCU protect disk->conv_zones_bitmap
Ensure that a disk revalidation changing the conventional zones bitmap
of a disk does not cause invalid memory references when using the
disk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap
pointer.
disk_zone_is_conv() is modified to operate under the RCU read lock and
the function disk_set_conv_zones_bitmap() is added to update a disk
conv_zones_bitmap pointer using rcu_replace_pointer() with the disk
zone_wplugs_lock spinlock held.
disk_free_zone_resources() is modified to call
disk_update_zone_resources() with a NULL bitmap pointer to free the disk
conv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in
disk_update_zone_resources() to set the new (revalidated) bitmap and
free the old one.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "block/blk-zoned.c", "include/linux/blkdev.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "493326c4f10cc71a42c27fdc97ce112182ee4cbc", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "d7cb6d7414ea1b33536fa6d11805cb8dceec1f97", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "block/blk-zoned.c", "include/linux/blkdev.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: RCU protect disk->conv_zones_bitmap\n\nEnsure that a disk revalidation changing the conventional zones bitmap\nof a disk does not cause invalid memory references when using the\ndisk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap\npointer.\n\ndisk_zone_is_conv() is modified to operate under the RCU read lock and\nthe function disk_set_conv_zones_bitmap() is added to update a disk\nconv_zones_bitmap pointer using rcu_replace_pointer() with the disk\nzone_wplugs_lock spinlock held.\n\ndisk_free_zone_resources() is modified to call\ndisk_update_zone_resources() with a NULL bitmap pointer to free the disk\nconv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in\ndisk_update_zone_resources() to set the new (revalidated) bitmap and\nfree the old one.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:40.511Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/493326c4f10cc71a42c27fdc97ce112182ee4cbc", }, { url: "https://git.kernel.org/stable/c/d7cb6d7414ea1b33536fa6d11805cb8dceec1f97", }, ], title: "block: RCU protect disk->conv_zones_bitmap", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57875", datePublished: "2025-01-11T14:49:01.655Z", dateReserved: "2025-01-11T14:45:42.023Z", dateUpdated: "2025-01-20T06:28:40.511Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-47143
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dma-debug: fix a possible deadlock on radix_lock
radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock
otherwise, there's a possible deadlock scenario when
dma debug API is called holding rq_lock():
CPU0 CPU1 CPU2
dma_free_attrs()
check_unmap() add_dma_entry() __schedule() //out
(A) rq_lock()
get_hash_bucket()
(A) dma_entry_hash
check_sync()
(A) radix_lock() (W) dma_entry_hash
dma_entry_free()
(W) radix_lock()
// CPU2's one
(W) rq_lock()
CPU1 situation can happen when it extending radix tree and
it tries to wake up kswapd via wake_all_kswapd().
CPU2 situation can happen while perf_event_task_sched_out()
(i.e. dma sync operation is called while deleting perf_event using
etm and etr tmc which are Arm Coresight hwtracing driver backends).
To remove this possible situation, call dma_entry_free() after
put_hash_bucket() in check_unmap().
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "kernel/dma/debug.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "3ccce34a5c3f5c9541108a451657ade621524b32", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "efe1b9bbf356357fdff0399af361133d6e3ba18e", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "8c1b4fea8d62285f5e1a8194889b39661608bd8a", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "c212d91070beca0d03fef7bf988baf4ff4b3eee4", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "f2b95248a16c5186d1c658fc0aeb2f3bd95e5259", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "7543c3e3b9b88212fcd0aaf5cab5588797bdc7de", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "kernel/dma/debug.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: fix a possible deadlock on radix_lock\n\nradix_lock() shouldn't be held while holding dma_hash_entry[idx].lock\notherwise, there's a possible deadlock scenario when\ndma debug API is called holding rq_lock():\n\nCPU0 CPU1 CPU2\ndma_free_attrs()\ncheck_unmap() add_dma_entry() __schedule() //out\n (A) rq_lock()\nget_hash_bucket()\n(A) dma_entry_hash\n check_sync()\n (A) radix_lock() (W) dma_entry_hash\ndma_entry_free()\n(W) radix_lock()\n // CPU2's one\n (W) rq_lock()\n\nCPU1 situation can happen when it extending radix tree and\nit tries to wake up kswapd via wake_all_kswapd().\n\nCPU2 situation can happen while perf_event_task_sched_out()\n(i.e. dma sync operation is called while deleting perf_event using\n etm and etr tmc which are Arm Coresight hwtracing driver backends).\n\nTo remove this possible situation, call dma_entry_free() after\nput_hash_bucket() in check_unmap().", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:04.493Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/3ccce34a5c3f5c9541108a451657ade621524b32", }, { url: "https://git.kernel.org/stable/c/efe1b9bbf356357fdff0399af361133d6e3ba18e", }, { url: "https://git.kernel.org/stable/c/8c1b4fea8d62285f5e1a8194889b39661608bd8a", }, { url: "https://git.kernel.org/stable/c/c212d91070beca0d03fef7bf988baf4ff4b3eee4", }, { url: "https://git.kernel.org/stable/c/f2b95248a16c5186d1c658fc0aeb2f3bd95e5259", }, { url: "https://git.kernel.org/stable/c/7543c3e3b9b88212fcd0aaf5cab5588797bdc7de", }, ], title: "dma-debug: fix a possible deadlock on radix_lock", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-47143", datePublished: "2025-01-11T12:25:13.561Z", dateReserved: "2025-01-09T09:49:29.749Z", dateUpdated: "2025-01-20T06:19:04.493Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-51729
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: use aligned address in copy_user_gigantic_page()
In current kernel, hugetlb_wp() calls copy_user_large_folio() with the
fault address. Where the fault address may be not aligned with the huge
page size. Then, copy_user_large_folio() may call
copy_user_gigantic_page() with the address, while
copy_user_gigantic_page() requires the address to be huge page size
aligned. So, this may cause memory corruption or information leak,
addtional, use more obvious naming 'addr_hint' instead of 'addr' for
copy_user_gigantic_page().
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "mm/hugetlb.c", "mm/memory.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "cb12d61361ce769672c7c7bd32107252598cdd8b", status: "affected", version: "530dd9926dc16220d2fae0997f45cda94f5f0864", versionType: "git", }, { lessThan: "f5d09de9f1bf9674c6418ff10d0a40cfe29268e1", status: "affected", version: "530dd9926dc16220d2fae0997f45cda94f5f0864", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "mm/hugetlb.c", "mm/memory.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.11", }, { lessThan: "6.11", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: use aligned address in copy_user_gigantic_page()\n\nIn current kernel, hugetlb_wp() calls copy_user_large_folio() with the\nfault address. Where the fault address may be not aligned with the huge\npage size. Then, copy_user_large_folio() may call\ncopy_user_gigantic_page() with the address, while\ncopy_user_gigantic_page() requires the address to be huge page size\naligned. So, this may cause memory corruption or information leak,\naddtional, use more obvious naming 'addr_hint' instead of 'addr' for\ncopy_user_gigantic_page().", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:33.127Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/cb12d61361ce769672c7c7bd32107252598cdd8b", }, { url: "https://git.kernel.org/stable/c/f5d09de9f1bf9674c6418ff10d0a40cfe29268e1", }, ], title: "mm: use aligned address in copy_user_gigantic_page()", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-51729", datePublished: "2025-01-11T12:35:38.375Z", dateReserved: "2025-01-11T12:33:33.687Z", dateUpdated: "2025-01-20T06:19:33.127Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-43098
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:18
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
A deadlock may happen since the i3c_master_register() acquires
&i3cbus->lock twice. See the log below.
Use i3cdev->desc->info instead of calling i3c_device_info() to
avoid acquiring the lock twice.
v2:
- Modified the title and commit message
============================================
WARNING: possible recursive locking detected
6.11.0-mainline
--------------------------------------------
init/1 is trying to acquire lock:
f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock
but task is already holding lock:
f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&i3cbus->lock);
lock(&i3cbus->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
2 locks held by init/1:
#0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach
#1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register
stack backtrace:
CPU: 6 UID: 0 PID: 1 Comm: init
Call trace:
dump_backtrace+0xfc/0x17c
show_stack+0x18/0x28
dump_stack_lvl+0x40/0xc0
dump_stack+0x18/0x24
print_deadlock_bug+0x388/0x390
__lock_acquire+0x18bc/0x32ec
lock_acquire+0x134/0x2b0
down_read+0x50/0x19c
i3c_bus_normaluse_lock+0x14/0x24
i3c_device_get_info+0x24/0x58
i3c_device_uevent+0x34/0xa4
dev_uevent+0x310/0x384
kobject_uevent_env+0x244/0x414
kobject_uevent+0x14/0x20
device_add+0x278/0x460
device_register+0x20/0x34
i3c_master_register_new_i3c_devs+0x78/0x154
i3c_master_register+0x6a0/0x6d4
mtk_i3c_master_probe+0x3b8/0x4d8
platform_probe+0xa0/0xe0
really_probe+0x114/0x454
__driver_probe_device+0xa0/0x15c
driver_probe_device+0x3c/0x1ac
__driver_attach+0xc4/0x1f0
bus_for_each_dev+0x104/0x160
driver_attach+0x24/0x34
bus_add_driver+0x14c/0x294
driver_register+0x68/0x104
__platform_driver_register+0x20/0x30
init_module+0x20/0xfe4
do_one_initcall+0x184/0x464
do_init_module+0x58/0x1ec
load_module+0xefc/0x10c8
__arm64_sys_finit_module+0x238/0x33c
invoke_syscall+0x58/0x10c
el0_svc_common+0xa8/0xdc
do_el0_svc+0x1c/0x28
el0_svc+0x50/0xac
el0t_64_sync_handler+0x70/0xbc
el0t_64_sync+0x1a8/0x1ac
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/i3c/master.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "9a2173660ee53d5699744f02e6ab7bf89fcd0b1a", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "5ac1dd51aaa0ce8b5421d1137e857955a4b6f55e", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "2d98fa2a50b8058de52ada168fa5dbabb574711b", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "816187b1833908941286e71b0041059a4acd52ed", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "ffe19e363c6f8b992ba835a361542568dea17409", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "1f51ae217d09c361ede900b94735a6d2df6c0344", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, { lessThan: "6cf7b65f7029914dc0cd7db86fac9ee5159008c6", status: "affected", version: "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/i3c/master.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "5.0", }, { lessThan: "5.0", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.287", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock\n\nA deadlock may happen since the i3c_master_register() acquires\n&i3cbus->lock twice. See the log below.\nUse i3cdev->desc->info instead of calling i3c_device_info() to\navoid acquiring the lock twice.\n\nv2:\n - Modified the title and commit message\n\n============================================\nWARNING: possible recursive locking detected\n6.11.0-mainline\n--------------------------------------------\ninit/1 is trying to acquire lock:\nf1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock\n\nbut task is already holding lock:\nf1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(&i3cbus->lock);\n lock(&i3cbus->lock);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n2 locks held by init/1:\n #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach\n #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register\n\nstack backtrace:\nCPU: 6 UID: 0 PID: 1 Comm: init\nCall trace:\n dump_backtrace+0xfc/0x17c\n show_stack+0x18/0x28\n dump_stack_lvl+0x40/0xc0\n dump_stack+0x18/0x24\n print_deadlock_bug+0x388/0x390\n __lock_acquire+0x18bc/0x32ec\n lock_acquire+0x134/0x2b0\n down_read+0x50/0x19c\n i3c_bus_normaluse_lock+0x14/0x24\n i3c_device_get_info+0x24/0x58\n i3c_device_uevent+0x34/0xa4\n dev_uevent+0x310/0x384\n kobject_uevent_env+0x244/0x414\n kobject_uevent+0x14/0x20\n device_add+0x278/0x460\n device_register+0x20/0x34\n i3c_master_register_new_i3c_devs+0x78/0x154\n i3c_master_register+0x6a0/0x6d4\n mtk_i3c_master_probe+0x3b8/0x4d8\n platform_probe+0xa0/0xe0\n really_probe+0x114/0x454\n __driver_probe_device+0xa0/0x15c\n driver_probe_device+0x3c/0x1ac\n __driver_attach+0xc4/0x1f0\n bus_for_each_dev+0x104/0x160\n driver_attach+0x24/0x34\n bus_add_driver+0x14c/0x294\n driver_register+0x68/0x104\n __platform_driver_register+0x20/0x30\n init_module+0x20/0xfe4\n do_one_initcall+0x184/0x464\n do_init_module+0x58/0x1ec\n load_module+0xefc/0x10c8\n __arm64_sys_finit_module+0x238/0x33c\n invoke_syscall+0x58/0x10c\n el0_svc_common+0xa8/0xdc\n do_el0_svc+0x1c/0x28\n el0_svc+0x50/0xac\n el0t_64_sync_handler+0x70/0xbc\n el0t_64_sync+0x1a8/0x1ac", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:18:59.826Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/9a2173660ee53d5699744f02e6ab7bf89fcd0b1a", }, { url: "https://git.kernel.org/stable/c/5ac1dd51aaa0ce8b5421d1137e857955a4b6f55e", }, { url: "https://git.kernel.org/stable/c/2d98fa2a50b8058de52ada168fa5dbabb574711b", }, { url: "https://git.kernel.org/stable/c/816187b1833908941286e71b0041059a4acd52ed", }, { url: "https://git.kernel.org/stable/c/ffe19e363c6f8b992ba835a361542568dea17409", }, { url: "https://git.kernel.org/stable/c/1f51ae217d09c361ede900b94735a6d2df6c0344", }, { url: "https://git.kernel.org/stable/c/6cf7b65f7029914dc0cd7db86fac9ee5159008c6", }, ], title: "i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-43098", datePublished: "2025-01-11T12:25:10.587Z", dateReserved: "2025-01-09T09:51:32.424Z", dateUpdated: "2025-01-20T06:18:59.826Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-53689
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2025-02-13T15:26:42.688Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, rejectedReasons: [ { lang: "en", value: "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", }, ], }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-53689", datePublished: "2025-01-11T12:29:51.716Z", dateRejected: "2025-02-13T15:26:42.688Z", dateReserved: "2025-01-09T09:50:31.780Z", dateUpdated: "2025-02-13T15:26:42.688Z", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2025-23124
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ containers: { cna: { providerMetadata: { dateUpdated: "2025-01-11T14:39:31.449Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, rejectedReasons: [ { lang: "en", value: "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", }, ], }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2025-23124", datePublished: "2025-01-11T14:31:01.507Z", dateRejected: "2025-01-11T14:39:31.449Z", dateReserved: "2025-01-11T14:28:41.510Z", dateUpdated: "2025-01-11T14:39:31.449Z", state: "REJECTED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-48875
Vulnerability from cvelistv5
Published
2025-01-11 12:25
Modified
2025-01-20 06:19
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't take dev_replace rwsem on task already holding it
Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of
the RAID stripe-tree, we get the following splat from lockdep:
BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started
============================================
WARNING: possible recursive locking detected
6.11.0-rc3-btrfs-for-next #599 Not tainted
--------------------------------------------
btrfs/2326 is trying to acquire lock:
ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
but task is already holding lock:
ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&fs_info->dev_replace.rwsem);
lock(&fs_info->dev_replace.rwsem);
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by btrfs/2326:
#0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
stack backtrace:
CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl+0x5b/0x80
__lock_acquire+0x2798/0x69d0
? __pfx___lock_acquire+0x10/0x10
? __pfx___lock_acquire+0x10/0x10
lock_acquire+0x19d/0x4a0
? btrfs_map_block+0x39f/0x2250
? __pfx_lock_acquire+0x10/0x10
? find_held_lock+0x2d/0x110
? lock_is_held_type+0x8f/0x100
down_read+0x8e/0x440
? btrfs_map_block+0x39f/0x2250
? __pfx_down_read+0x10/0x10
? do_raw_read_unlock+0x44/0x70
? _raw_read_unlock+0x23/0x40
btrfs_map_block+0x39f/0x2250
? btrfs_dev_replace_by_ioctl+0xd69/0x1d00
? btrfs_bio_counter_inc_blocked+0xd9/0x2e0
? __kasan_slab_alloc+0x6e/0x70
? __pfx_btrfs_map_block+0x10/0x10
? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10
? kmem_cache_alloc_noprof+0x1f2/0x300
? mempool_alloc_noprof+0xed/0x2b0
btrfs_submit_chunk+0x28d/0x17e0
? __pfx_btrfs_submit_chunk+0x10/0x10
? bvec_alloc+0xd7/0x1b0
? bio_add_folio+0x171/0x270
? __pfx_bio_add_folio+0x10/0x10
? __kasan_check_read+0x20/0x20
btrfs_submit_bio+0x37/0x80
read_extent_buffer_pages+0x3df/0x6c0
btrfs_read_extent_buffer+0x13e/0x5f0
read_tree_block+0x81/0xe0
read_block_for_search+0x4bd/0x7a0
? __pfx_read_block_for_search+0x10/0x10
btrfs_search_slot+0x78d/0x2720
? __pfx_btrfs_search_slot+0x10/0x10
? lock_is_held_type+0x8f/0x100
? kasan_save_track+0x14/0x30
? __kasan_slab_alloc+0x6e/0x70
? kmem_cache_alloc_noprof+0x1f2/0x300
btrfs_get_raid_extent_offset+0x181/0x820
? __pfx_lock_acquire+0x10/0x10
? __pfx_btrfs_get_raid_extent_offset+0x10/0x10
? down_read+0x194/0x440
? __pfx_down_read+0x10/0x10
? do_raw_read_unlock+0x44/0x70
? _raw_read_unlock+0x23/0x40
btrfs_map_block+0x5b5/0x2250
? __pfx_btrfs_map_block+0x10/0x10
scrub_submit_initial_read+0x8fe/0x11b0
? __pfx_scrub_submit_initial_read+0x10/0x10
submit_initial_group_read+0x161/0x3a0
? lock_release+0x20e/0x710
? __pfx_submit_initial_group_read+0x10/0x10
? __pfx_lock_release+0x10/0x10
scrub_simple_mirror.isra.0+0x3eb/0x580
scrub_stripe+0xe4d/0x1440
? lock_release+0x20e/0x710
? __pfx_scrub_stripe+0x10/0x10
? __pfx_lock_release+0x10/0x10
? do_raw_read_unlock+0x44/0x70
? _raw_read_unlock+0x23/0x40
scrub_chunk+0x257/0x4a0
scrub_enumerate_chunks+0x64c/0xf70
? __mutex_unlock_slowpath+0x147/0x5f0
? __pfx_scrub_enumerate_chunks+0x10/0x10
? bit_wait_timeout+0xb0/0x170
? __up_read+0x189/0x700
? scrub_workers_get+0x231/0x300
? up_write+0x490/0x4f0
btrfs_scrub_dev+0x52e/0xcd0
? create_pending_snapshots+0x230/0x250
? __pfx_btrfs_scrub_dev+0x10/0x10
btrfs_dev_replace_by_ioctl+0xd69/0x1d00
? lock_acquire+0x19d/0x4a0
? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10
?
---truncated---
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/btrfs/dev-replace.c", "fs/btrfs/fs.h", "fs/btrfs/volumes.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "a5bc4e030f50fdbb1fbc69acc1e0c5f57c79d044", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "8cca35cb29f81eba3e96ec44dad8696c8a2f9138", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/btrfs/dev-replace.c", "fs/btrfs/fs.h", "fs/btrfs/volumes.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't take dev_replace rwsem on task already holding it\n\nRunning fstests btrfs/011 with MKFS_OPTIONS=\"-O rst\" to force the usage of\nthe RAID stripe-tree, we get the following splat from lockdep:\n\n BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started\n\n ============================================\n WARNING: possible recursive locking detected\n 6.11.0-rc3-btrfs-for-next #599 Not tainted\n --------------------------------------------\n btrfs/2326 is trying to acquire lock:\n ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n but task is already holding lock:\n ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n other info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(&fs_info->dev_replace.rwsem);\n lock(&fs_info->dev_replace.rwsem);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n 1 lock held by btrfs/2326:\n #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n stack backtrace:\n CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n <TASK>\n dump_stack_lvl+0x5b/0x80\n __lock_acquire+0x2798/0x69d0\n ? __pfx___lock_acquire+0x10/0x10\n ? __pfx___lock_acquire+0x10/0x10\n lock_acquire+0x19d/0x4a0\n ? btrfs_map_block+0x39f/0x2250\n ? __pfx_lock_acquire+0x10/0x10\n ? find_held_lock+0x2d/0x110\n ? lock_is_held_type+0x8f/0x100\n down_read+0x8e/0x440\n ? btrfs_map_block+0x39f/0x2250\n ? __pfx_down_read+0x10/0x10\n ? do_raw_read_unlock+0x44/0x70\n ? _raw_read_unlock+0x23/0x40\n btrfs_map_block+0x39f/0x2250\n ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00\n ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0\n ? __kasan_slab_alloc+0x6e/0x70\n ? __pfx_btrfs_map_block+0x10/0x10\n ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10\n ? kmem_cache_alloc_noprof+0x1f2/0x300\n ? mempool_alloc_noprof+0xed/0x2b0\n btrfs_submit_chunk+0x28d/0x17e0\n ? __pfx_btrfs_submit_chunk+0x10/0x10\n ? bvec_alloc+0xd7/0x1b0\n ? bio_add_folio+0x171/0x270\n ? __pfx_bio_add_folio+0x10/0x10\n ? __kasan_check_read+0x20/0x20\n btrfs_submit_bio+0x37/0x80\n read_extent_buffer_pages+0x3df/0x6c0\n btrfs_read_extent_buffer+0x13e/0x5f0\n read_tree_block+0x81/0xe0\n read_block_for_search+0x4bd/0x7a0\n ? __pfx_read_block_for_search+0x10/0x10\n btrfs_search_slot+0x78d/0x2720\n ? __pfx_btrfs_search_slot+0x10/0x10\n ? lock_is_held_type+0x8f/0x100\n ? kasan_save_track+0x14/0x30\n ? __kasan_slab_alloc+0x6e/0x70\n ? kmem_cache_alloc_noprof+0x1f2/0x300\n btrfs_get_raid_extent_offset+0x181/0x820\n ? __pfx_lock_acquire+0x10/0x10\n ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10\n ? down_read+0x194/0x440\n ? __pfx_down_read+0x10/0x10\n ? do_raw_read_unlock+0x44/0x70\n ? _raw_read_unlock+0x23/0x40\n btrfs_map_block+0x5b5/0x2250\n ? __pfx_btrfs_map_block+0x10/0x10\n scrub_submit_initial_read+0x8fe/0x11b0\n ? __pfx_scrub_submit_initial_read+0x10/0x10\n submit_initial_group_read+0x161/0x3a0\n ? lock_release+0x20e/0x710\n ? __pfx_submit_initial_group_read+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n scrub_simple_mirror.isra.0+0x3eb/0x580\n scrub_stripe+0xe4d/0x1440\n ? lock_release+0x20e/0x710\n ? __pfx_scrub_stripe+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n ? do_raw_read_unlock+0x44/0x70\n ? _raw_read_unlock+0x23/0x40\n scrub_chunk+0x257/0x4a0\n scrub_enumerate_chunks+0x64c/0xf70\n ? __mutex_unlock_slowpath+0x147/0x5f0\n ? __pfx_scrub_enumerate_chunks+0x10/0x10\n ? bit_wait_timeout+0xb0/0x170\n ? __up_read+0x189/0x700\n ? scrub_workers_get+0x231/0x300\n ? up_write+0x490/0x4f0\n btrfs_scrub_dev+0x52e/0xcd0\n ? create_pending_snapshots+0x230/0x250\n ? __pfx_btrfs_scrub_dev+0x10/0x10\n btrfs_dev_replace_by_ioctl+0xd69/0x1d00\n ? lock_acquire+0x19d/0x4a0\n ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10\n ?\n---truncated---", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:19:11.699Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/a5bc4e030f50fdbb1fbc69acc1e0c5f57c79d044", }, { url: "https://git.kernel.org/stable/c/a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2", }, { url: "https://git.kernel.org/stable/c/8cca35cb29f81eba3e96ec44dad8696c8a2f9138", }, ], title: "btrfs: don't take dev_replace rwsem on task already holding it", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-48875", datePublished: "2025-01-11T12:25:16.981Z", dateReserved: "2025-01-09T09:51:32.472Z", dateUpdated: "2025-01-20T06:19:11.699Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-54683
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: IDLETIMER: Fix for possible ABBA deadlock
Deletion of the last rule referencing a given idletimer may happen at
the same time as a read of its file in sysfs:
| ======================================================
| WARNING: possible circular locking dependency detected
| 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted
| ------------------------------------------------------
| iptables/3303 is trying to acquire lock:
| ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20
|
| but task is already holding lock:
| ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v]
|
| which lock already depends on the new lock.
A simple reproducer is:
| #!/bin/bash
|
| while true; do
| iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
| iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
| done &
| while true; do
| cat /sys/class/xt_idletimer/timers/testme >/dev/null
| done
Avoid this by freeing list_mutex right after deleting the element from
the list, then continuing with the teardown.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "net/netfilter/xt_IDLETIMER.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "8c2c8445cda8f59c38dec7dc10509bcb23ae26a0", status: "affected", version: "0902b469bd25065aa0688c3cee6f11744c817e7c", versionType: "git", }, { lessThan: "45fe76573a2557f632e248cc141342233f422b9a", status: "affected", version: "0902b469bd25065aa0688c3cee6f11744c817e7c", versionType: "git", }, { lessThan: "f36b01994d68ffc253c8296e2228dfe6e6431c03", status: "affected", version: "0902b469bd25065aa0688c3cee6f11744c817e7c", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "net/netfilter/xt_IDLETIMER.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "2.6.36", }, { lessThan: "2.6.36", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.67", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: IDLETIMER: Fix for possible ABBA deadlock\n\nDeletion of the last rule referencing a given idletimer may happen at\nthe same time as a read of its file in sysfs:\n\n| ======================================================\n| WARNING: possible circular locking dependency detected\n| 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted\n| ------------------------------------------------------\n| iptables/3303 is trying to acquire lock:\n| ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20\n|\n| but task is already holding lock:\n| ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v]\n|\n| which lock already depends on the new lock.\n\nA simple reproducer is:\n\n| #!/bin/bash\n|\n| while true; do\n| iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label \"testme\"\n| iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label \"testme\"\n| done &\n| while true; do\n| cat /sys/class/xt_idletimer/timers/testme >/dev/null\n| done\n\nAvoid this by freeing list_mutex right after deleting the element from\nthe list, then continuing with the teardown.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:11.262Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/8c2c8445cda8f59c38dec7dc10509bcb23ae26a0", }, { url: "https://git.kernel.org/stable/c/45fe76573a2557f632e248cc141342233f422b9a", }, { url: "https://git.kernel.org/stable/c/f36b01994d68ffc253c8296e2228dfe6e6431c03", }, ], title: "netfilter: IDLETIMER: Fix for possible ABBA deadlock", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-54683", datePublished: "2025-01-11T12:29:54.407Z", dateReserved: "2025-01-09T09:49:29.693Z", dateUpdated: "2025-01-20T06:22:11.262Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-57850
Vulnerability from cvelistv5
Published
2025-01-11 14:30
Modified
2025-01-20 06:28
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
jffs2: Prevent rtime decompress memory corruption
The rtime decompression routine does not fully check bounds during the
entirety of the decompression pass and can corrupt memory outside the
decompression buffer if the compressed data is corrupted. This adds the
required check to prevent this failure mode.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/jffs2/compr_rtime.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "421f9e9f0fae9f8e721ffa07f22d9765fa1214d5", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "f6fc251baefc3cdc4f41f2f5a47940d7d4a67332", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "bd384b04ad1995441b18fe6c1366d02de8c5d5eb", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "47c9a7f81027a78afea9d2e9a54bfd8fabb6b3d0", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "6808a1812a3419542223e7fe9e2de577e99e45d1", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "dc39b08fcc3831b0bc46add91ba93cd2aab50716", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, { lessThan: "fe051552f5078fa02d593847529a3884305a6ffe", status: "affected", version: "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/jffs2/compr_rtime.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.287", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.231", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.174", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.120", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.66", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.5", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: Prevent rtime decompress memory corruption\n\nThe rtime decompression routine does not fully check bounds during the\nentirety of the decompression pass and can corrupt memory outside the\ndecompression buffer if the compressed data is corrupted. This adds the\nrequired check to prevent this failure mode.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:28:35.685Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/421f9e9f0fae9f8e721ffa07f22d9765fa1214d5", }, { url: "https://git.kernel.org/stable/c/f6fc251baefc3cdc4f41f2f5a47940d7d4a67332", }, { url: "https://git.kernel.org/stable/c/bd384b04ad1995441b18fe6c1366d02de8c5d5eb", }, { url: "https://git.kernel.org/stable/c/47c9a7f81027a78afea9d2e9a54bfd8fabb6b3d0", }, { url: "https://git.kernel.org/stable/c/6808a1812a3419542223e7fe9e2de577e99e45d1", }, { url: "https://git.kernel.org/stable/c/dc39b08fcc3831b0bc46add91ba93cd2aab50716", }, { url: "https://git.kernel.org/stable/c/fe051552f5078fa02d593847529a3884305a6ffe", }, ], title: "jffs2: Prevent rtime decompress memory corruption", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-57850", datePublished: "2025-01-11T14:30:59.271Z", dateReserved: "2025-01-11T12:32:49.525Z", dateUpdated: "2025-01-20T06:28:35.685Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-53690
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: prevent use of deleted inode
syzbot reported a WARNING in nilfs_rmdir. [1]
Because the inode bitmap is corrupted, an inode with an inode number that
should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0",
causing an inode duplication during execution. And this causes an
underflow of i_nlink in rmdir operations.
The inode is used twice by the same task to unmount and remove directories
".nilfs" and "file0", it trigger warning in nilfs_rmdir.
Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means
that this inode has been deleted, and iput is executed to reclaim it.
[1]
WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407
...
Call Trace:
<TASK>
nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342
vfs_rmdir+0x3a3/0x510 fs/namei.c:4394
do_rmdir+0x3b5/0x580 fs/namei.c:4453
__do_sys_rmdir fs/namei.c:4472 [inline]
__se_sys_rmdir fs/namei.c:4470 [inline]
__x64_sys_rmdir+0x47/0x50 fs/namei.c:4470
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: d25006523d0b9e49fd097b2e974e7c8c05bd7f54 Version: d25006523d0b9e49fd097b2e974e7c8c05bd7f54 Version: d25006523d0b9e49fd097b2e974e7c8c05bd7f54 Version: d25006523d0b9e49fd097b2e974e7c8c05bd7f54 Version: d25006523d0b9e49fd097b2e974e7c8c05bd7f54 Version: d25006523d0b9e49fd097b2e974e7c8c05bd7f54 Version: d25006523d0b9e49fd097b2e974e7c8c05bd7f54 |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "fs/nilfs2/inode.c", "fs/nilfs2/namei.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "55e4baa0d32f0530ddc64c26620e1f2f8fa2724c", status: "affected", version: "d25006523d0b9e49fd097b2e974e7c8c05bd7f54", versionType: "git", }, { lessThan: "5d4ed71327b0b5f3b179a19dc3c06be9509ab3db", status: "affected", version: "d25006523d0b9e49fd097b2e974e7c8c05bd7f54", versionType: "git", }, { lessThan: "912188316a8c9e41b8c1603c2276a05043b14f96", status: "affected", version: "d25006523d0b9e49fd097b2e974e7c8c05bd7f54", versionType: "git", }, { lessThan: "ef942d233643777f7b2a5deef620e82942983143", status: "affected", version: "d25006523d0b9e49fd097b2e974e7c8c05bd7f54", versionType: "git", }, { lessThan: "284760b320a0bac411b18108316939707dccb12b", status: "affected", version: "d25006523d0b9e49fd097b2e974e7c8c05bd7f54", versionType: "git", }, { lessThan: "ff561987ff12b6a3233431ff659b5d332e22f153", status: "affected", version: "d25006523d0b9e49fd097b2e974e7c8c05bd7f54", versionType: "git", }, { lessThan: "901ce9705fbb9f330ff1f19600e5daf9770b0175", status: "affected", version: "d25006523d0b9e49fd097b2e974e7c8c05bd7f54", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "fs/nilfs2/inode.c", "fs/nilfs2/namei.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "2.6.30", }, { lessThan: "2.6.30", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.289", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.233", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.122", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: prevent use of deleted inode\n\nsyzbot reported a WARNING in nilfs_rmdir. [1]\n\nBecause the inode bitmap is corrupted, an inode with an inode number that\nshould exist as a \".nilfs\" file was reassigned by nilfs_mkdir for \"file0\",\ncausing an inode duplication during execution. And this causes an\nunderflow of i_nlink in rmdir operations.\n\nThe inode is used twice by the same task to unmount and remove directories\n\".nilfs\" and \"file0\", it trigger warning in nilfs_rmdir.\n\nAvoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means\nthat this inode has been deleted, and iput is executed to reclaim it.\n\n[1]\nWARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407\n...\nCall Trace:\n <TASK>\n nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342\n vfs_rmdir+0x3a3/0x510 fs/namei.c:4394\n do_rmdir+0x3b5/0x580 fs/namei.c:4453\n __do_sys_rmdir fs/namei.c:4472 [inline]\n __se_sys_rmdir fs/namei.c:4470 [inline]\n __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:03.170Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/55e4baa0d32f0530ddc64c26620e1f2f8fa2724c", }, { url: "https://git.kernel.org/stable/c/5d4ed71327b0b5f3b179a19dc3c06be9509ab3db", }, { url: "https://git.kernel.org/stable/c/912188316a8c9e41b8c1603c2276a05043b14f96", }, { url: "https://git.kernel.org/stable/c/ef942d233643777f7b2a5deef620e82942983143", }, { url: "https://git.kernel.org/stable/c/284760b320a0bac411b18108316939707dccb12b", }, { url: "https://git.kernel.org/stable/c/ff561987ff12b6a3233431ff659b5d332e22f153", }, { url: "https://git.kernel.org/stable/c/901ce9705fbb9f330ff1f19600e5daf9770b0175", }, ], title: "nilfs2: prevent use of deleted inode", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-53690", datePublished: "2025-01-11T12:35:40.934Z", dateReserved: "2025-01-11T12:34:02.678Z", dateUpdated: "2025-01-20T06:22:03.170Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-55642
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: Prevent potential deadlocks in zone write plug error recovery
Zone write plugging for handling writes to zones of a zoned block
device always execute a zone report whenever a write BIO to a zone
fails. The intent of this is to ensure that the tracking of a zone write
pointer is always correct to ensure that the alignment to a zone write
pointer of write BIOs can be checked on submission and that we can
always correctly emulate zone append operations using regular write
BIOs.
However, this error recovery scheme introduces a potential deadlock if a
device queue freeze is initiated while BIOs are still plugged in a zone
write plug and one of these write operation fails. In such case, the
disk zone write plug error recovery work is scheduled and executes a
report zone. This in turn can result in a request allocation in the
underlying driver to issue the report zones command to the device. But
with the device queue freeze already started, this allocation will
block, preventing the report zone execution and the continuation of the
processing of the plugged BIOs. As plugged BIOs hold a queue usage
reference, the queue freeze itself will never complete, resulting in a
deadlock.
Avoid this problem by completely removing from the zone write plugging
code the use of report zones operations after a failed write operation,
instead relying on the device user to either execute a report zones,
reset the zone, finish the zone, or give up writing to the device (which
is a fairly common pattern for file systems which degrade to read-only
after write failures). This is not an unreasonnable requirement as all
well-behaved applications, FSes and device mapper already use report
zones to recover from write errors whenever possible by comparing the
current position of a zone write pointer with what their assumption
about the position is.
The changes to remove the automatic error recovery are as follows:
- Completely remove the error recovery work and its associated
resources (zone write plug list head, disk error list, and disk
zone_wplugs_work work struct). This also removes the functions
disk_zone_wplug_set_error() and disk_zone_wplug_clear_error().
- Change the BLK_ZONE_WPLUG_ERROR zone write plug flag into
BLK_ZONE_WPLUG_NEED_WP_UPDATE. This new flag is set for a zone write
plug whenever a write opration targetting the zone of the zone write
plug fails. This flag indicates that the zone write pointer offset is
not reliable and that it must be updated when the next report zone,
reset zone, finish zone or disk revalidation is executed.
- Modify blk_zone_write_plug_bio_endio() to set the
BLK_ZONE_WPLUG_NEED_WP_UPDATE flag for the target zone of a failed
write BIO.
- Modify the function disk_zone_wplug_set_wp_offset() to clear this
new flag, thus implementing recovery of a correct write pointer
offset with the reset (all) zone and finish zone operations.
- Modify blkdev_report_zones() to always use the disk_report_zones_cb()
callback so that disk_zone_wplug_sync_wp_offset() can be called for
any zone marked with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag.
This implements recovery of a correct write pointer offset for zone
write plugs marked with BLK_ZONE_WPLUG_NEED_WP_UPDATE and within
the range of the report zones operation executed by the user.
- Modify blk_revalidate_seq_zone() to call
disk_zone_wplug_sync_wp_offset() for all sequential write required
zones when a zoned block device is revalidated, thus always resolving
any inconsistency between the write pointer offset of zone write
plugs and the actual write pointer position of sequential zones.
References
Impacted products
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "block/blk-zoned.c", "include/linux/blkdev.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "7fa80134cf266325fa61139320091001c9b3c477", status: "affected", version: "dd291d77cc90eb6a86e9860ba8e6e38eebd57d12", versionType: "git", }, { lessThan: "fe0418eb9bd69a19a948b297c8de815e05f3cde1", status: "affected", version: "dd291d77cc90eb6a86e9860ba8e6e38eebd57d12", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "block/blk-zoned.c", "include/linux/blkdev.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "6.10", }, { lessThan: "6.10", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.6", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Prevent potential deadlocks in zone write plug error recovery\n\nZone write plugging for handling writes to zones of a zoned block\ndevice always execute a zone report whenever a write BIO to a zone\nfails. The intent of this is to ensure that the tracking of a zone write\npointer is always correct to ensure that the alignment to a zone write\npointer of write BIOs can be checked on submission and that we can\nalways correctly emulate zone append operations using regular write\nBIOs.\n\nHowever, this error recovery scheme introduces a potential deadlock if a\ndevice queue freeze is initiated while BIOs are still plugged in a zone\nwrite plug and one of these write operation fails. In such case, the\ndisk zone write plug error recovery work is scheduled and executes a\nreport zone. This in turn can result in a request allocation in the\nunderlying driver to issue the report zones command to the device. But\nwith the device queue freeze already started, this allocation will\nblock, preventing the report zone execution and the continuation of the\nprocessing of the plugged BIOs. As plugged BIOs hold a queue usage\nreference, the queue freeze itself will never complete, resulting in a\ndeadlock.\n\nAvoid this problem by completely removing from the zone write plugging\ncode the use of report zones operations after a failed write operation,\ninstead relying on the device user to either execute a report zones,\nreset the zone, finish the zone, or give up writing to the device (which\nis a fairly common pattern for file systems which degrade to read-only\nafter write failures). This is not an unreasonnable requirement as all\nwell-behaved applications, FSes and device mapper already use report\nzones to recover from write errors whenever possible by comparing the\ncurrent position of a zone write pointer with what their assumption\nabout the position is.\n\nThe changes to remove the automatic error recovery are as follows:\n - Completely remove the error recovery work and its associated\n resources (zone write plug list head, disk error list, and disk\n zone_wplugs_work work struct). This also removes the functions\n disk_zone_wplug_set_error() and disk_zone_wplug_clear_error().\n\n - Change the BLK_ZONE_WPLUG_ERROR zone write plug flag into\n BLK_ZONE_WPLUG_NEED_WP_UPDATE. This new flag is set for a zone write\n plug whenever a write opration targetting the zone of the zone write\n plug fails. This flag indicates that the zone write pointer offset is\n not reliable and that it must be updated when the next report zone,\n reset zone, finish zone or disk revalidation is executed.\n\n - Modify blk_zone_write_plug_bio_endio() to set the\n BLK_ZONE_WPLUG_NEED_WP_UPDATE flag for the target zone of a failed\n write BIO.\n\n - Modify the function disk_zone_wplug_set_wp_offset() to clear this\n new flag, thus implementing recovery of a correct write pointer\n offset with the reset (all) zone and finish zone operations.\n\n - Modify blkdev_report_zones() to always use the disk_report_zones_cb()\n callback so that disk_zone_wplug_sync_wp_offset() can be called for\n any zone marked with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag.\n This implements recovery of a correct write pointer offset for zone\n write plugs marked with BLK_ZONE_WPLUG_NEED_WP_UPDATE and within\n the range of the report zones operation executed by the user.\n\n - Modify blk_revalidate_seq_zone() to call\n disk_zone_wplug_sync_wp_offset() for all sequential write required\n zones when a zoned block device is revalidated, thus always resolving\n any inconsistency between the write pointer offset of zone write\n plugs and the actual write pointer position of sequential zones.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:14.759Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/7fa80134cf266325fa61139320091001c9b3c477", }, { url: "https://git.kernel.org/stable/c/fe0418eb9bd69a19a948b297c8de815e05f3cde1", }, ], title: "block: Prevent potential deadlocks in zone write plug error recovery", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-55642", datePublished: "2025-01-11T12:29:56.848Z", dateReserved: "2025-01-09T09:49:29.657Z", dateUpdated: "2025-01-20T06:22:14.759Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-55916
Vulnerability from cvelistv5
Published
2025-01-11 12:35
Modified
2025-01-20 06:22
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is
fully initialized, we can hit the panic below:
hv_utils: Registering HyperV Utility Driver
hv_vmbus: registering driver hv_utils
...
BUG: kernel NULL pointer dereference, address: 0000000000000000
CPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1
RIP: 0010:hv_pkt_iter_first+0x12/0xd0
Call Trace:
...
vmbus_recvpacket
hv_kvp_onchannelcallback
vmbus_on_event
tasklet_action_common
tasklet_action
handle_softirqs
irq_exit_rcu
sysvec_hyperv_stimer0
</IRQ>
<TASK>
asm_sysvec_hyperv_stimer0
...
kvp_register_done
hvt_op_read
vfs_read
ksys_read
__x64_sys_read
This can happen because the KVP/VSS channel callback can be invoked
even before the channel is fully opened:
1) as soon as hv_kvp_init() -> hvutil_transport_init() creates
/dev/vmbus/hv_kvp, the kvp daemon can open the device file immediately and
register itself to the driver by writing a message KVP_OP_REGISTER1 to the
file (which is handled by kvp_on_msg() ->kvp_handle_handshake()) and
reading the file for the driver's response, which is handled by
hvt_op_read(), which calls hvt->on_read(), i.e. kvp_register_done().
2) the problem with kvp_register_done() is that it can cause the
channel callback to be called even before the channel is fully opened,
and when the channel callback is starting to run, util_probe()->
vmbus_open() may have not initialized the ringbuffer yet, so the
callback can hit the panic of NULL pointer dereference.
To reproduce the panic consistently, we can add a "ssleep(10)" for KVP in
__vmbus_open(), just before the first hv_ringbuffer_init(), and then we
unload and reload the driver hv_utils, and run the daemon manually within
the 10 seconds.
Fix the panic by reordering the steps in util_probe() so the char dev
entry used by the KVP or VSS daemon is not created until after
vmbus_open() has completed. This reordering prevents the race condition
from happening.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c Version: e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c Version: e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c Version: e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c Version: e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c Version: e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c Version: e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c |
||||||
|
{ containers: { cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/hv/hv_kvp.c", "drivers/hv/hv_snapshot.c", "drivers/hv/hv_util.c", "drivers/hv/hyperv_vmbus.h", "include/linux/hyperv.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "f091a224a2c82f1e302b1768d73bb6332f687321", status: "affected", version: "e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c", versionType: "git", }, { lessThan: "d81f4e73aff9b861671df60e5100ad25cc16fbf8", status: "affected", version: "e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c", versionType: "git", }, { lessThan: "042253c57be901bfd19f15b68267442b70f510d5", status: "affected", version: "e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c", versionType: "git", }, { lessThan: "718fe694a334be9d1a89eed22602369ac18d6583", status: "affected", version: "e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c", versionType: "git", }, { lessThan: "89fcec5e466b3ac9b376e0d621c71effa1a7983f", status: "affected", version: "e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c", versionType: "git", }, { lessThan: "3dd7a30c6d7f90afcf19e9b072f572ba524d7ec6", status: "affected", version: "e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c", versionType: "git", }, { lessThan: "07a756a49f4b4290b49ea46e089cbe6f79ff8d26", status: "affected", version: "e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/hv/hv_kvp.c", "drivers/hv/hv_snapshot.c", "drivers/hv/hv_util.c", "drivers/hv/hyperv_vmbus.h", "include/linux/hyperv.h", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "4.9", }, { lessThan: "4.9", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.289", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.233", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.176", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.122", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.68", versionType: "semver", }, { lessThanOrEqual: "6.12.*", status: "unaffected", version: "6.12.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.13", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: util: Avoid accessing a ringbuffer not initialized yet\n\nIf the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is\nfully initialized, we can hit the panic below:\n\nhv_utils: Registering HyperV Utility Driver\nhv_vmbus: registering driver hv_utils\n...\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1\nRIP: 0010:hv_pkt_iter_first+0x12/0xd0\nCall Trace:\n...\n vmbus_recvpacket\n hv_kvp_onchannelcallback\n vmbus_on_event\n tasklet_action_common\n tasklet_action\n handle_softirqs\n irq_exit_rcu\n sysvec_hyperv_stimer0\n </IRQ>\n <TASK>\n asm_sysvec_hyperv_stimer0\n...\n kvp_register_done\n hvt_op_read\n vfs_read\n ksys_read\n __x64_sys_read\n\nThis can happen because the KVP/VSS channel callback can be invoked\neven before the channel is fully opened:\n1) as soon as hv_kvp_init() -> hvutil_transport_init() creates\n/dev/vmbus/hv_kvp, the kvp daemon can open the device file immediately and\nregister itself to the driver by writing a message KVP_OP_REGISTER1 to the\nfile (which is handled by kvp_on_msg() ->kvp_handle_handshake()) and\nreading the file for the driver's response, which is handled by\nhvt_op_read(), which calls hvt->on_read(), i.e. kvp_register_done().\n\n2) the problem with kvp_register_done() is that it can cause the\nchannel callback to be called even before the channel is fully opened,\nand when the channel callback is starting to run, util_probe()->\nvmbus_open() may have not initialized the ringbuffer yet, so the\ncallback can hit the panic of NULL pointer dereference.\n\nTo reproduce the panic consistently, we can add a \"ssleep(10)\" for KVP in\n__vmbus_open(), just before the first hv_ringbuffer_init(), and then we\nunload and reload the driver hv_utils, and run the daemon manually within\nthe 10 seconds.\n\nFix the panic by reordering the steps in util_probe() so the char dev\nentry used by the KVP or VSS daemon is not created until after\nvmbus_open() has completed. This reordering prevents the race condition\nfrom happening.", }, ], providerMetadata: { dateUpdated: "2025-01-20T06:22:17.025Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/f091a224a2c82f1e302b1768d73bb6332f687321", }, { url: "https://git.kernel.org/stable/c/d81f4e73aff9b861671df60e5100ad25cc16fbf8", }, { url: "https://git.kernel.org/stable/c/042253c57be901bfd19f15b68267442b70f510d5", }, { url: "https://git.kernel.org/stable/c/718fe694a334be9d1a89eed22602369ac18d6583", }, { url: "https://git.kernel.org/stable/c/89fcec5e466b3ac9b376e0d621c71effa1a7983f", }, { url: "https://git.kernel.org/stable/c/3dd7a30c6d7f90afcf19e9b072f572ba524d7ec6", }, { url: "https://git.kernel.org/stable/c/07a756a49f4b4290b49ea46e089cbe6f79ff8d26", }, ], title: "Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-55916", datePublished: "2025-01-11T12:35:44.800Z", dateReserved: "2025-01-09T09:49:29.678Z", dateUpdated: "2025-01-20T06:22:17.025Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.