diff --git a/advisories/unreviewed/2024/09/GHSA-grj2-m3x4-7f2m/GHSA-grj2-m3x4-7f2m.json b/advisories/unreviewed/2024/09/GHSA-grj2-m3x4-7f2m/GHSA-grj2-m3x4-7f2m.json index 33cf8761c8e..1b149126dbc 100644 --- a/advisories/unreviewed/2024/09/GHSA-grj2-m3x4-7f2m/GHSA-grj2-m3x4-7f2m.json +++ b/advisories/unreviewed/2024/09/GHSA-grj2-m3x4-7f2m/GHSA-grj2-m3x4-7f2m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-grj2-m3x4-7f2m", - "modified": "2024-09-30T18:31:36Z", + "modified": "2024-11-13T15:31:36Z", "published": "2024-09-30T18:31:36Z", "aliases": [ "CVE-2024-46869" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: Allocate memory for driver private data\n\nFix driver not allocating memory for struct btintel_data which is used\nto store internal data.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-30T16:15:09Z" diff --git a/advisories/unreviewed/2024/10/GHSA-2gvh-vj62-qjmp/GHSA-2gvh-vj62-qjmp.json b/advisories/unreviewed/2024/10/GHSA-2gvh-vj62-qjmp/GHSA-2gvh-vj62-qjmp.json index b14f26102f0..670d801f777 100644 --- a/advisories/unreviewed/2024/10/GHSA-2gvh-vj62-qjmp/GHSA-2gvh-vj62-qjmp.json +++ b/advisories/unreviewed/2024/10/GHSA-2gvh-vj62-qjmp/GHSA-2gvh-vj62-qjmp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2gvh-vj62-qjmp", - "modified": "2024-11-08T18:30:45Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49926" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()\n\nFor kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is\ndefined as NR_CPUS instead of the number of possible cpus, this\nwill cause the following system panic:\n\nsmpboot: Allowing 4 CPUs, 0 hotplug CPUs\n...\nsetup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:512 nr_node_ids:1\n...\nBUG: unable to handle page fault for address: ffffffff9911c8c8\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 15 Comm: rcu_tasks_trace Tainted: G W\n6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6\nRIP: 0010:rcu_tasks_need_gpcb+0x25d/0x2c0\nRSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082\nCR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0\nCall Trace:\n\n? __die+0x23/0x80\n? page_fault_oops+0xa4/0x180\n? exc_page_fault+0x152/0x180\n? asm_exc_page_fault+0x26/0x40\n? rcu_tasks_need_gpcb+0x25d/0x2c0\n? __pfx_rcu_tasks_kthread+0x40/0x40\nrcu_tasks_one_gp+0x69/0x180\nrcu_tasks_kthread+0x94/0xc0\nkthread+0xe8/0x140\n? __pfx_kthread+0x40/0x40\nret_from_fork+0x34/0x80\n? __pfx_kthread+0x40/0x40\nret_from_fork_asm+0x1b/0x80\n\n\nConsidering that there may be holes in the CPU numbers, use the\nmaximum possible cpu number, instead of nr_cpu_ids, for configuring\nenqueue and dequeue limits.\n\n[ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ]", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -39,7 +42,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-2h93-g5hm-9qcv/GHSA-2h93-g5hm-9qcv.json b/advisories/unreviewed/2024/10/GHSA-2h93-g5hm-9qcv/GHSA-2h93-g5hm-9qcv.json index dfb93f09b57..0319b956328 100644 --- a/advisories/unreviewed/2024/10/GHSA-2h93-g5hm-9qcv/GHSA-2h93-g5hm-9qcv.json +++ b/advisories/unreviewed/2024/10/GHSA-2h93-g5hm-9qcv/GHSA-2h93-g5hm-9qcv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2h93-g5hm-9qcv", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-11-13T15:31:36Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49885" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, slub: avoid zeroing kmalloc redzone\n\nSince commit 946fa0dbf2d8 (\"mm/slub: extend redzone check to extra\nallocated kmalloc space than requested\"), setting orig_size treats\nthe wasted space (object_size - orig_size) as a redzone. However with\ninit_on_free=1 we clear the full object->size, including the redzone.\n\nAdditionally we clear the object metadata, including the stored orig_size,\nmaking it zero, which makes check_object() treat the whole object as a\nredzone.\n\nThese issues lead to the following BUG report with \"slub_debug=FUZ\ninit_on_free=1\":\n\n[ 0.000000] =============================================================================\n[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten\n[ 0.000000] -----------------------------------------------------------------------------\n[ 0.000000]\n[ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc\n[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc\n[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)\n[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8\n[ 0.000000]\n[ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........\n[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........\n[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........\n[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............\n[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144\n[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)\n[ 0.000000] Call trace:\n[ 0.000000] dump_backtrace+0x90/0xe8\n[ 0.000000] show_stack+0x18/0x24\n[ 0.000000] dump_stack_lvl+0x74/0x8c\n[ 0.000000] dump_stack+0x18/0x24\n[ 0.000000] print_trailer+0x150/0x218\n[ 0.000000] check_object+0xe4/0x454\n[ 0.000000] free_to_partial_list+0x2f8/0x5ec\n\nTo address the issue, use orig_size to clear the used area. And restore\nthe value of orig_size after clear the remaining area.\n\nWhen CONFIG_SLUB_DEBUG not defined, (get_orig_size()' directly returns\ns->object_size. So when using memset to init the area, the size can simply\nbe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG not\nenabled. And orig_size can never be bigger than object_size.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-66x6-php2-c8mm/GHSA-66x6-php2-c8mm.json b/advisories/unreviewed/2024/10/GHSA-66x6-php2-c8mm/GHSA-66x6-php2-c8mm.json index ce195467de8..d9806e581a3 100644 --- a/advisories/unreviewed/2024/10/GHSA-66x6-php2-c8mm/GHSA-66x6-php2-c8mm.json +++ b/advisories/unreviewed/2024/10/GHSA-66x6-php2-c8mm/GHSA-66x6-php2-c8mm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-66x6-php2-c8mm", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49933" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk_iocost: fix more out of bound shifts\n\nRecently running UBSAN caught few out of bound shifts in the\nioc_forgive_debts() function:\n\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38\nshift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long\nlong')\n...\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30\nshift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long\nlong')\n...\nCall Trace:\n\ndump_stack_lvl+0xca/0x130\n__ubsan_handle_shift_out_of_bounds+0x22c/0x280\n? __lock_acquire+0x6441/0x7c10\nioc_timer_fn+0x6cec/0x7750\n? blk_iocost_init+0x720/0x720\n? call_timer_fn+0x5d/0x470\ncall_timer_fn+0xfa/0x470\n? blk_iocost_init+0x720/0x720\n__run_timer_base+0x519/0x700\n...\n\nActual impact of this issue was not identified but I propose to fix the\nundefined behaviour.\nThe proposed fix to prevent those out of bound shifts consist of\nprecalculating exponent before using it the shift operations by taking\nmin value from the actual exponent and maximum possible number of bits.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -51,7 +54,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-72p3-695j-v465/GHSA-72p3-695j-v465.json b/advisories/unreviewed/2024/10/GHSA-72p3-695j-v465/GHSA-72p3-695j-v465.json index 8e675d4c9de..e506fc8aeab 100644 --- a/advisories/unreviewed/2024/10/GHSA-72p3-695j-v465/GHSA-72p3-695j-v465.json +++ b/advisories/unreviewed/2024/10/GHSA-72p3-695j-v465/GHSA-72p3-695j-v465.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/10/GHSA-8r8w-7pvp-9gqf/GHSA-8r8w-7pvp-9gqf.json b/advisories/unreviewed/2024/10/GHSA-8r8w-7pvp-9gqf/GHSA-8r8w-7pvp-9gqf.json index 23745dcc45d..f8e7c2471c6 100644 --- a/advisories/unreviewed/2024/10/GHSA-8r8w-7pvp-9gqf/GHSA-8r8w-7pvp-9gqf.json +++ b/advisories/unreviewed/2024/10/GHSA-8r8w-7pvp-9gqf/GHSA-8r8w-7pvp-9gqf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8r8w-7pvp-9gqf", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49927" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ioapic: Handle allocation failures gracefully\n\nBreno observed panics when using failslab under certain conditions during\nruntime:\n\n can not alloc irq_pin_list (-1,0,20)\n Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can not proceed\n\n panic+0x4e9/0x590\n mp_irqdomain_alloc+0x9ab/0xa80\n irq_domain_alloc_irqs_locked+0x25d/0x8d0\n __irq_domain_alloc_irqs+0x80/0x110\n mp_map_pin_to_irq+0x645/0x890\n acpi_register_gsi_ioapic+0xe6/0x150\n hpet_open+0x313/0x480\n\nThat's a pointless panic which is a leftover of the historic IO/APIC code\nwhich panic'ed during early boot when the interrupt allocation failed.\n\nThe only place which might justify panic is the PIT/HPET timer_check() code\nwhich tries to figure out whether the timer interrupt is delivered through\nthe IO/APIC. But that code does not require to handle interrupt allocation\nfailures. If the interrupt cannot be allocated then timer delivery fails\nand it either panics due to that or falls back to legacy mode.\n\nCure this by removing the panic wrapper around __add_pin_to_irq_node() and\nmaking mp_irqdomain_alloc() aware of the failure condition and handle it as\nany other failure in this function gracefully.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -47,7 +50,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-9hcm-hr65-2825/GHSA-9hcm-hr65-2825.json b/advisories/unreviewed/2024/10/GHSA-9hcm-hr65-2825/GHSA-9hcm-hr65-2825.json index f3a3bfee892..61f6686b65b 100644 --- a/advisories/unreviewed/2024/10/GHSA-9hcm-hr65-2825/GHSA-9hcm-hr65-2825.json +++ b/advisories/unreviewed/2024/10/GHSA-9hcm-hr65-2825/GHSA-9hcm-hr65-2825.json @@ -32,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-203" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/10/GHSA-c3cx-mm7p-wgj8/GHSA-c3cx-mm7p-wgj8.json b/advisories/unreviewed/2024/10/GHSA-c3cx-mm7p-wgj8/GHSA-c3cx-mm7p-wgj8.json index 67a531660e2..ac46d42d628 100644 --- a/advisories/unreviewed/2024/10/GHSA-c3cx-mm7p-wgj8/GHSA-c3cx-mm7p-wgj8.json +++ b/advisories/unreviewed/2024/10/GHSA-c3cx-mm7p-wgj8/GHSA-c3cx-mm7p-wgj8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-c3cx-mm7p-wgj8", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49887" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to don't panic system for no free segment fault injection\n\nf2fs: fix to don't panic system for no free segment fault injection\n\nsyzbot reports a f2fs bug as below:\n\nF2FS-fs (loop0): inject no free segment in get_new_segment of __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3167\nF2FS-fs (loop0): Stopped filesystem due to reason: 7\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/segment.c:2748!\nCPU: 0 UID: 0 PID: 5109 Comm: syz-executor304 Not tainted 6.11.0-rc6-syzkaller-00363-g89f5e14d05b4 #0\nRIP: 0010:get_new_segment fs/f2fs/segment.c:2748 [inline]\nRIP: 0010:new_curseg+0x1f61/0x1f70 fs/f2fs/segment.c:2836\nCall Trace:\n __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3167\n f2fs_allocate_new_section fs/f2fs/segment.c:3181 [inline]\n f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3195\n f2fs_expand_inode_data+0x5d6/0xbb0 fs/f2fs/file.c:1799\n f2fs_fallocate+0x448/0x960 fs/f2fs/file.c:1903\n vfs_fallocate+0x553/0x6c0 fs/open.c:334\n do_vfs_ioctl+0x2592/0x2e50 fs/ioctl.c:886\n __do_sys_ioctl fs/ioctl.c:905 [inline]\n __se_sys_ioctl+0x81/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0010:get_new_segment fs/f2fs/segment.c:2748 [inline]\nRIP: 0010:new_curseg+0x1f61/0x1f70 fs/f2fs/segment.c:2836\n\nThe root cause is when we inject no free segment fault into f2fs,\nwe should not panic system, fix it.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-c4vm-rj4p-m3c8/GHSA-c4vm-rj4p-m3c8.json b/advisories/unreviewed/2024/10/GHSA-c4vm-rj4p-m3c8/GHSA-c4vm-rj4p-m3c8.json index 9b6ff373f52..533afd2ef1e 100644 --- a/advisories/unreviewed/2024/10/GHSA-c4vm-rj4p-m3c8/GHSA-c4vm-rj4p-m3c8.json +++ b/advisories/unreviewed/2024/10/GHSA-c4vm-rj4p-m3c8/GHSA-c4vm-rj4p-m3c8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-c4vm-rj4p-m3c8", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49888" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a sdiv overflow issue\n\nZac Ecob reported a problem where a bpf program may cause kernel crash due\nto the following error:\n Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI\n\nThe failure is due to the below signed divide:\n LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808.\nLLONG_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808,\nbut it is impossible since for 64-bit system, the maximum positive\nnumber is 9,223,372,036,854,775,807. On x86_64, LLONG_MIN/-1 will\ncause a kernel exception. On arm64, the result for LLONG_MIN/-1 is\nLLONG_MIN.\n\nFurther investigation found all the following sdiv/smod cases may trigger\nan exception when bpf program is running on x86_64 platform:\n - LLONG_MIN/-1 for 64bit operation\n - INT_MIN/-1 for 32bit operation\n - LLONG_MIN%-1 for 64bit operation\n - INT_MIN%-1 for 32bit operation\nwhere -1 can be an immediate or in a register.\n\nOn arm64, there are no exceptions:\n - LLONG_MIN/-1 = LLONG_MIN\n - INT_MIN/-1 = INT_MIN\n - LLONG_MIN%-1 = 0\n - INT_MIN%-1 = 0\nwhere -1 can be an immediate or in a register.\n\nInsn patching is needed to handle the above cases and the patched codes\nproduced results aligned with above arm64 result. The below are pseudo\ncodes to handle sdiv/smod exceptions including both divisor -1 and divisor 0\nand the divisor is stored in a register.\n\nsdiv:\n tmp = rX\n tmp += 1 /* [-1, 0] -> [0, 1]\n if tmp >(unsigned) 1 goto L2\n if tmp == 0 goto L1\n rY = 0\n L1:\n rY = -rY;\n goto L3\n L2:\n rY /= rX\n L3:\n\nsmod:\n tmp = rX\n tmp += 1 /* [-1, 0] -> [0, 1]\n if tmp >(unsigned) 1 goto L1\n if tmp == 1 (is64 ? goto L2 : goto L3)\n rY = 0;\n goto L2\n L1:\n rY %= rX\n L2:\n goto L4 // only when !is64\n L3:\n wY = wY // only when !is64\n L4:\n\n [1] https://lore.kernel.org/bpf/tPJLTEh7S_DxFEqAI2Ji5MBSoZVg7_G-Py2iaZpAaWtM961fFTWtsnlzwvTbzBzaUzwQAoNATXKUlt0LZOFgnDcIyKCswAnAGdUF3LBrhGQ=@protonmail.com/", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-190" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-cx67-p8xc-qwg4/GHSA-cx67-p8xc-qwg4.json b/advisories/unreviewed/2024/10/GHSA-cx67-p8xc-qwg4/GHSA-cx67-p8xc-qwg4.json index be0646597af..1930be87169 100644 --- a/advisories/unreviewed/2024/10/GHSA-cx67-p8xc-qwg4/GHSA-cx67-p8xc-qwg4.json +++ b/advisories/unreviewed/2024/10/GHSA-cx67-p8xc-qwg4/GHSA-cx67-p8xc-qwg4.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-cx67-p8xc-qwg4", - "modified": "2024-10-21T18:30:56Z", + "modified": "2024-11-13T15:31:36Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49864" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix a race between socket set up and I/O thread creation\n\nIn rxrpc_open_socket(), it sets up the socket and then sets up the I/O\nthread that will handle it. This is a problem, however, as there's a gap\nbetween the two phases in which a packet may come into rxrpc_encap_rcv()\nfrom the UDP packet but we oops when trying to wake the not-yet created I/O\nthread.\n\nAs a quick fix, just make rxrpc_encap_rcv() discard the packet if there's\nno I/O thread yet.\n\nA better, but more intrusive fix would perhaps be to rearrange things such\nthat the socket creation is done by the I/O thread.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-362" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:06Z" diff --git a/advisories/unreviewed/2024/10/GHSA-f3xx-63r9-v2cp/GHSA-f3xx-63r9-v2cp.json b/advisories/unreviewed/2024/10/GHSA-f3xx-63r9-v2cp/GHSA-f3xx-63r9-v2cp.json index 18674f8c6b9..661347158f1 100644 --- a/advisories/unreviewed/2024/10/GHSA-f3xx-63r9-v2cp/GHSA-f3xx-63r9-v2cp.json +++ b/advisories/unreviewed/2024/10/GHSA-f3xx-63r9-v2cp/GHSA-f3xx-63r9-v2cp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f3xx-63r9-v2cp", - "modified": "2024-11-08T18:30:44Z", + "modified": "2024-11-13T15:31:36Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49878" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nresource: fix region_intersects() vs add_memory_driver_managed()\n\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\nCXL memory may look like something as follows.\n\n490000000-50fffffff : CXL Window 0\n 490000000-50fffffff : region0\n 490000000-50fffffff : dax0.0\n 490000000-50fffffff : System RAM (kmem)\n\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\nonlining CXL memory, which makes \"System RAM (kmem)\" a descendant of \"CXL\nWindow X\". This confuses region_intersects(), which expects all \"System\nRAM\" resources to be at the top level of iomem_resource. This can lead to\nbugs.\n\nFor example, when the following command line is executed to write some\nmemory in CXL memory range via /dev/mem,\n\n $ dd if=data of=/dev/mem bs=$((1 << 10)) seek=$((0x490000000 >> 10)) count=1\n dd: error writing '/dev/mem': Bad address\n 1+0 records in\n 0+0 records out\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\n\nthe command fails as expected. However, the error code is wrong. It\nshould be \"Operation not permitted\" instead of \"Bad address\". More\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\nincorrectly. Although the accessing is prevented later because ioremap()\nisn't allowed to map system RAM, it is a potential security issue. During\ncommand executing, the following warning is reported in the kernel log for\ncalling ioremap() on system RAM.\n\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\n Call Trace:\n memremap+0xcb/0x184\n xlate_dev_mem_ptr+0x25/0x2f\n write_mem+0x94/0xfb\n vfs_write+0x128/0x26d\n ksys_write+0xac/0xfe\n do_syscall_64+0x9a/0xfd\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe details of command execution process are as follows. In the above\nresource tree, \"System RAM\" is a descendant of \"CXL Window 0\" instead of a\ntop level resource. So, region_intersects() will report no System RAM\nresources in the CXL memory region incorrectly, because it only checks the\ntop level resources. Consequently, devmem_is_allowed() will return 1\n(allow access via /dev/mem) for CXL memory region incorrectly. \nFortunately, ioremap() doesn't allow to map System RAM and reject the\naccess.\n\nSo, region_intersects() needs to be fixed to work correctly with the\nresource tree with \"System RAM\" not at top level as above. To fix it, if\nwe found a unmatched resource in the top level, we will continue to search\nmatched resources in its descendant resources. So, we will not miss any\nmatched resources in resource tree anymore.\n\nIn the new implementation, an example resource tree\n\n|------------- \"CXL Window 0\" ------------|\n|-- \"System RAM\" --|\n\nwill behave similar as the following fake resource tree for\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\n\n|-- \"System RAM\" --||-- \"CXL Window 0a\" --|\n\nWhere \"CXL Window 0a\" is part of the original \"CXL Window 0\" that\nisn't covered by \"System RAM\".", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -55,7 +58,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:09Z" diff --git a/advisories/unreviewed/2024/10/GHSA-ggxf-hwrw-c5q2/GHSA-ggxf-hwrw-c5q2.json b/advisories/unreviewed/2024/10/GHSA-ggxf-hwrw-c5q2/GHSA-ggxf-hwrw-c5q2.json index a29cb144fa7..6f90f112ab0 100644 --- a/advisories/unreviewed/2024/10/GHSA-ggxf-hwrw-c5q2/GHSA-ggxf-hwrw-c5q2.json +++ b/advisories/unreviewed/2024/10/GHSA-ggxf-hwrw-c5q2/GHSA-ggxf-hwrw-c5q2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-ggxf-hwrw-c5q2", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49932" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't readahead the relocation inode on RST\n\nOn relocation we're doing readahead on the relocation inode, but if the\nfilesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to\npreallocated extents not being mapped in the RST) from the lookup.\n\nBut readahead doesn't handle the error and submits invalid reads to the\ndevice, causing an assertion in the scatter-gather list code:\n\n BTRFS info (device nvme1n1): balance: start -d -m -s\n BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0\n BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0\n ------------[ cut here ]------------\n kernel BUG at include/linux/scatterlist.h:115!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567\n RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0\n Call Trace:\n \n ? __die_body.cold+0x14/0x25\n ? die+0x2e/0x50\n ? do_trap+0xca/0x110\n ? do_error_trap+0x65/0x80\n ? __blk_rq_map_sg+0x339/0x4a0\n ? exc_invalid_op+0x50/0x70\n ? __blk_rq_map_sg+0x339/0x4a0\n ? asm_exc_invalid_op+0x1a/0x20\n ? __blk_rq_map_sg+0x339/0x4a0\n nvme_prep_rq.part.0+0x9d/0x770\n nvme_queue_rq+0x7d/0x1e0\n __blk_mq_issue_directly+0x2a/0x90\n ? blk_mq_get_budget_and_tag+0x61/0x90\n blk_mq_try_issue_list_directly+0x56/0xf0\n blk_mq_flush_plug_list.part.0+0x52b/0x5d0\n __blk_flush_plug+0xc6/0x110\n blk_finish_plug+0x28/0x40\n read_pages+0x160/0x1c0\n page_cache_ra_unbounded+0x109/0x180\n relocate_file_extent_cluster+0x611/0x6a0\n ? btrfs_search_slot+0xba4/0xd20\n ? balance_dirty_pages_ratelimited_flags+0x26/0xb00\n relocate_data_extent.constprop.0+0x134/0x160\n relocate_block_group+0x3f2/0x500\n btrfs_relocate_block_group+0x250/0x430\n btrfs_relocate_chunk+0x3f/0x130\n btrfs_balance+0x71b/0xef0\n ? kmalloc_trace_noprof+0x13b/0x280\n btrfs_ioctl+0x2c2e/0x3030\n ? kvfree_call_rcu+0x1e6/0x340\n ? list_lru_add_obj+0x66/0x80\n ? mntput_no_expire+0x3a/0x220\n __x64_sys_ioctl+0x96/0xc0\n do_syscall_64+0x54/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7fcc04514f9b\n Code: Unable to access opcode bytes at 0x7fcc04514f71.\n RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b\n RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003\n RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001\n R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5\n R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0\n \n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0\n Kernel p\n---truncated---", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-617" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-h9jc-p2cr-c4rx/GHSA-h9jc-p2cr-c4rx.json b/advisories/unreviewed/2024/10/GHSA-h9jc-p2cr-c4rx/GHSA-h9jc-p2cr-c4rx.json index b14bac35456..90ed438c08a 100644 --- a/advisories/unreviewed/2024/10/GHSA-h9jc-p2cr-c4rx/GHSA-h9jc-p2cr-c4rx.json +++ b/advisories/unreviewed/2024/10/GHSA-h9jc-p2cr-c4rx/GHSA-h9jc-p2cr-c4rx.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-h9jc-p2cr-c4rx", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49940" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-h9pq-rfrf-6f7p/GHSA-h9pq-rfrf-6f7p.json b/advisories/unreviewed/2024/10/GHSA-h9pq-rfrf-6f7p/GHSA-h9pq-rfrf-6f7p.json index 0149801d01d..a96a23aa0b2 100644 --- a/advisories/unreviewed/2024/10/GHSA-h9pq-rfrf-6f7p/GHSA-h9pq-rfrf-6f7p.json +++ b/advisories/unreviewed/2024/10/GHSA-h9pq-rfrf-6f7p/GHSA-h9pq-rfrf-6f7p.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-h9pq-rfrf-6f7p", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49886" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug\n\nAttaching SST PCI device to VM causes \"BUG: KASAN: slab-out-of-bounds\".\nkasan report:\n[ 19.411889] ==================================================================\n[ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113\n[ 19.417368]\n[ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10\n[ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022\n[ 19.422687] Call Trace:\n[ 19.424091] \n[ 19.425448] dump_stack_lvl+0x5d/0x80\n[ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.428694] print_report+0x19d/0x52e\n[ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.433539] kasan_report+0xf0/0x170\n[ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10\n[ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common]\n[ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]\n[ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360\n[ 19.444797] cpuhp_invoke_callback+0x221/0xec0\n[ 19.446337] cpuhp_thread_fun+0x21b/0x610\n[ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10\n[ 19.449354] smpboot_thread_fn+0x2e7/0x6e0\n[ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10\n[ 19.452405] kthread+0x29c/0x350\n[ 19.453817] ? __pfx_kthread+0x10/0x10\n[ 19.455253] ret_from_fork+0x31/0x70\n[ 19.456685] ? __pfx_kthread+0x10/0x10\n[ 19.458114] ret_from_fork_asm+0x1a/0x30\n[ 19.459573] \n[ 19.460853]\n[ 19.462055] Allocated by task 1198:\n[ 19.463410] kasan_save_stack+0x30/0x50\n[ 19.464788] kasan_save_track+0x14/0x30\n[ 19.466139] __kasan_kmalloc+0xaa/0xb0\n[ 19.467465] __kmalloc+0x1cd/0x470\n[ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common]\n[ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]\n[ 19.471670] do_one_initcall+0xa4/0x380\n[ 19.472903] do_init_module+0x238/0x760\n[ 19.474105] load_module+0x5239/0x6f00\n[ 19.475285] init_module_from_file+0xd1/0x130\n[ 19.476506] idempotent_init_module+0x23b/0x650\n[ 19.477725] __x64_sys_finit_module+0xbe/0x130\n[ 19.476506] idempotent_init_module+0x23b/0x650\n[ 19.477725] __x64_sys_finit_module+0xbe/0x130\n[ 19.478920] do_syscall_64+0x82/0x160\n[ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 19.481292]\n[ 19.482205] The buggy address belongs to the object at ffff888829e65000\n which belongs to the cache kmalloc-512 of size 512\n[ 19.484818] The buggy address is located 0 bytes to the right of\n allocated 512-byte region [ffff888829e65000, ffff888829e65200)\n[ 19.487447]\n[ 19.488328] The buggy address belongs to the physical page:\n[ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60\n[ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)\n[ 19.493914] page_type: 0xffffffff()\n[ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff\n[ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000\n[ 19.503784] page dumped because: k\n---truncated---", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -47,7 +50,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-hpqg-3xxv-rhj6/GHSA-hpqg-3xxv-rhj6.json b/advisories/unreviewed/2024/10/GHSA-hpqg-3xxv-rhj6/GHSA-hpqg-3xxv-rhj6.json index df3e42d4ee5..d8be7912423 100644 --- a/advisories/unreviewed/2024/10/GHSA-hpqg-3xxv-rhj6/GHSA-hpqg-3xxv-rhj6.json +++ b/advisories/unreviewed/2024/10/GHSA-hpqg-3xxv-rhj6/GHSA-hpqg-3xxv-rhj6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hpqg-3xxv-rhj6", - "modified": "2024-11-08T18:30:45Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49938" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit\n\nSyzbot points out that skb_trim() has a sanity check on the existing length of\nthe skb, which can be uninitialised in some error paths. The intent here is\nclearly just to reset the length to zero before resubmitting, so switch to\ncalling __skb_set_length(skb, 0) directly. In addition, __skb_set_length()\nalready contains a call to skb_reset_tail_pointer(), so remove the redundant\ncall.\n\nThe syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar\nusage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -57,9 +60,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-824" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-jww8-jcqp-pmjm/GHSA-jww8-jcqp-pmjm.json b/advisories/unreviewed/2024/10/GHSA-jww8-jcqp-pmjm/GHSA-jww8-jcqp-pmjm.json index 2ec555ce3dc..1d405c892ad 100644 --- a/advisories/unreviewed/2024/10/GHSA-jww8-jcqp-pmjm/GHSA-jww8-jcqp-pmjm.json +++ b/advisories/unreviewed/2024/10/GHSA-jww8-jcqp-pmjm/GHSA-jww8-jcqp-pmjm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jww8-jcqp-pmjm", - "modified": "2024-11-08T18:30:45Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49944" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start\n\nIn sctp_listen_start() invoked by sctp_inet_listen(), it should set the\nsk_state back to CLOSED if sctp_autobind() fails due to whatever reason.\n\nOtherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse\nis already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will\nbe dereferenced as sk_state is LISTENING, which causes a crash as bind_hash\nis NULL.\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617\n Call Trace:\n \n __sys_listen_socket net/socket.c:1883 [inline]\n __sys_listen+0x1b7/0x230 net/socket.c:1894\n __do_sys_listen net/socket.c:1902 [inline]", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -59,7 +62,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-p8wj-q5fw-6q9q/GHSA-p8wj-q5fw-6q9q.json b/advisories/unreviewed/2024/10/GHSA-p8wj-q5fw-6q9q/GHSA-p8wj-q5fw-6q9q.json index 3a08eae9b51..4e639d17596 100644 --- a/advisories/unreviewed/2024/10/GHSA-p8wj-q5fw-6q9q/GHSA-p8wj-q5fw-6q9q.json +++ b/advisories/unreviewed/2024/10/GHSA-p8wj-q5fw-6q9q/GHSA-p8wj-q5fw-6q9q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p8wj-q5fw-6q9q", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49935" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: PAD: fix crash in exit_round_robin()\n\nThe kernel occasionally crashes in cpumask_clear_cpu(), which is called\nwithin exit_round_robin(), because when executing clear_bit(nr, addr) with\nnr set to 0xffffffff, the address calculation may cause misalignment within\nthe memory, leading to access to an invalid memory address.\n\n----------\nBUG: unable to handle kernel paging request at ffffffffe0740618\n ...\nCPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G OE X --------- - - 4.18.0-425.19.2.el8_7.x86_64 #1\n ...\nRIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]\nCode: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31\nRSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202\nRAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\nRBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e\nR13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e\nFS: 0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n ? acpi_pad_add+0x120/0x120 [acpi_pad]\n kthread+0x10b/0x130\n ? set_kthread_struct+0x50/0x50\n ret_from_fork+0x1f/0x40\n ...\nCR2: ffffffffe0740618\n\ncrash> dis -lr ffffffffc0726923\n ...\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114\n0xffffffffc0726918 :\tmov %r12d,%r12d\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325\n0xffffffffc072691b :\tmov -0x3f8d7de0(,%r12,4),%eax\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80\n0xffffffffc0726923 :\tlock btr %rax,0x19cf4(%rip) # 0xffffffffc0740620 \n\ncrash> px tsk_in_cpu[14]\n$66 = 0xffffffff\n\ncrash> px 0xffffffffc072692c+0x19cf4\n$99 = 0xffffffffc0740620\n\ncrash> sym 0xffffffffc0740620\nffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]\n\ncrash> px pad_busy_cpus_bits[0]\n$42 = 0xfffc0\n----------\n\nTo fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling\ncpumask_clear_cpu() in exit_round_robin(), just as it is done in\nround_robin_cpu().\n\n[ rjw: Subject edit, avoid updates to the same value ]", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -47,7 +50,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-q2x4-35qf-p4qw/GHSA-q2x4-35qf-p4qw.json b/advisories/unreviewed/2024/10/GHSA-q2x4-35qf-p4qw/GHSA-q2x4-35qf-p4qw.json index 0644e4da84c..02aaac9ee96 100644 --- a/advisories/unreviewed/2024/10/GHSA-q2x4-35qf-p4qw/GHSA-q2x4-35qf-p4qw.json +++ b/advisories/unreviewed/2024/10/GHSA-q2x4-35qf-p4qw/GHSA-q2x4-35qf-p4qw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-q2x4-35qf-p4qw", - "modified": "2024-11-08T18:30:45Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49902" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: check if leafidx greater than num leaves per dmap tree\n\nsyzbot report a out of bounds in dbSplit, it because dmt_leafidx greater\nthan num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.\n\nShaggy:\nModified sanity check to apply to control pages as well as leaf pages.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -59,7 +62,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:12Z" diff --git a/advisories/unreviewed/2024/10/GHSA-rrh5-rfhq-mff2/GHSA-rrh5-rfhq-mff2.json b/advisories/unreviewed/2024/10/GHSA-rrh5-rfhq-mff2/GHSA-rrh5-rfhq-mff2.json index 24fabcd2323..00dcc593317 100644 --- a/advisories/unreviewed/2024/10/GHSA-rrh5-rfhq-mff2/GHSA-rrh5-rfhq-mff2.json +++ b/advisories/unreviewed/2024/10/GHSA-rrh5-rfhq-mff2/GHSA-rrh5-rfhq-mff2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rrh5-rfhq-mff2", - "modified": "2024-10-21T18:30:56Z", + "modified": "2024-11-13T15:31:36Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49872" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/gup: fix memfd_pin_folios alloc race panic\n\nIf memfd_pin_folios tries to create a hugetlb page, but someone else\nalready did, then folio gets the value -EEXIST here:\n\n folio = memfd_alloc_folio(memfd, start_idx);\n if (IS_ERR(folio)) {\n ret = PTR_ERR(folio);\n if (ret != -EEXIST)\n goto err;\n\nthen on the next trip through the \"while start_idx\" loop we panic here:\n\n if (folio) {\n folio_put(folio);\n\nTo fix, set the folio to NULL on error.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-362" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:08Z" diff --git a/advisories/unreviewed/2024/10/GHSA-v3jw-p9pj-m453/GHSA-v3jw-p9pj-m453.json b/advisories/unreviewed/2024/10/GHSA-v3jw-p9pj-m453/GHSA-v3jw-p9pj-m453.json index 576f54618a6..b043296897b 100644 --- a/advisories/unreviewed/2024/10/GHSA-v3jw-p9pj-m453/GHSA-v3jw-p9pj-m453.json +++ b/advisories/unreviewed/2024/10/GHSA-v3jw-p9pj-m453/GHSA-v3jw-p9pj-m453.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v3jw-p9pj-m453", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49934" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name\n\nIt's observed that a crash occurs during hot-remove a memory device,\nin which user is accessing the hugetlb. See calltrace as following:\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 14045 at arch/x86/mm/fault.c:1278 do_user_addr_fault+0x2a0/0x790\nModules linked in: kmem device_dax cxl_mem cxl_pmem cxl_port cxl_pci dax_hmem dax_pmem nd_pmem cxl_acpi nd_btt cxl_core crc32c_intel nvme virtiofs fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc s\nmirror dm_region_hash dm_log dm_mod\nCPU: 1 PID: 14045 Comm: daxctl Not tainted 6.10.0-rc2-lizhijian+ #492\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:do_user_addr_fault+0x2a0/0x790\nCode: 48 8b 00 a8 04 0f 84 b5 fe ff ff e9 1c ff ff ff 4c 89 e9 4c 89 e2 be 01 00 00 00 bf 02 00 00 00 e8 b5 ef 24 00 e9 42 fe ff ff <0f> 0b 48 83 c4 08 4c 89 ea 48 89 ee 4c 89 e7 5b 5d 41 5c 41 5d 41\nRSP: 0000:ffffc90000a575f0 EFLAGS: 00010046\nRAX: ffff88800c303600 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000001000 RSI: ffffffff82504162 RDI: ffffffff824b2c36\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a57658\nR13: 0000000000001000 R14: ffff88800bc2e040 R15: 0000000000000000\nFS: 00007f51cb57d880(0000) GS:ffff88807fd00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000001000 CR3: 00000000072e2004 CR4: 00000000001706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n ? __warn+0x8d/0x190\n ? do_user_addr_fault+0x2a0/0x790\n ? report_bug+0x1c3/0x1d0\n ? handle_bug+0x3c/0x70\n ? exc_invalid_op+0x14/0x70\n ? asm_exc_invalid_op+0x16/0x20\n ? do_user_addr_fault+0x2a0/0x790\n ? exc_page_fault+0x31/0x200\n exc_page_fault+0x68/0x200\n<...snip...>\nBUG: unable to handle page fault for address: 0000000000001000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n ---[ end trace 0000000000000000 ]---\n BUG: unable to handle page fault for address: 0000000000001000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 PID: 14045 Comm: daxctl Kdump: loaded Tainted: G W 6.10.0-rc2-lizhijian+ #492\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:dentry_name+0x1f4/0x440\n<...snip...>\n? dentry_name+0x2fa/0x440\nvsnprintf+0x1f3/0x4f0\nvprintk_store+0x23a/0x540\nvprintk_emit+0x6d/0x330\n_printk+0x58/0x80\ndump_mapping+0x10b/0x1a0\n? __pfx_free_object_rcu+0x10/0x10\n__dump_page+0x26b/0x3e0\n? vprintk_emit+0xe0/0x330\n? _printk+0x58/0x80\n? dump_page+0x17/0x50\ndump_page+0x17/0x50\ndo_migrate_range+0x2f7/0x7f0\n? do_migrate_range+0x42/0x7f0\n? offline_pages+0x2f4/0x8c0\noffline_pages+0x60a/0x8c0\nmemory_subsys_offline+0x9f/0x1c0\n? lockdep_hardirqs_on+0x77/0x100\n? _raw_spin_unlock_irqrestore+0x38/0x60\ndevice_offline+0xe3/0x110\nstate_store+0x6e/0xc0\nkernfs_fop_write_iter+0x143/0x200\nvfs_write+0x39f/0x560\nksys_write+0x65/0xf0\ndo_syscall_64+0x62/0x130\n\nPreviously, some sanity check have been done in dump_mapping() before\nthe print facility parsing '%pd' though, it's still possible to run into\nan invalid dentry.d_name.name.\n\nSince dump_mapping() only needs to dump the filename only, retrieve it\nby itself in a safer way to prevent an unnecessary crash.\n\nNote that either retrieving the filename with '%pd' or\nstrncpy_from_kernel_nofault(), the filename could be unreliable.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/11/GHSA-46pf-6w9r-96r9/GHSA-46pf-6w9r-96r9.json b/advisories/unreviewed/2024/11/GHSA-46pf-6w9r-96r9/GHSA-46pf-6w9r-96r9.json new file mode 100644 index 00000000000..2cb9a7cb3df --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-46pf-6w9r-96r9/GHSA-46pf-6w9r-96r9.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-46pf-6w9r-96r9", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-49504" + ], + "details": "grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49504" + }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49504" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7ch5-p674-p2hp/GHSA-7ch5-p674-p2hp.json b/advisories/unreviewed/2024/11/GHSA-7ch5-p674-p2hp/GHSA-7ch5-p674-p2hp.json new file mode 100644 index 00000000000..a4677813853 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7ch5-p674-p2hp/GHSA-7ch5-p674-p2hp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7ch5-p674-p2hp", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-11165" + ], + "details": "An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leakage within the yb_backup log files, exposing the SAS token in plaintext. The leakage occurs during the backup procedure, leading to potential unauthorized access to resources associated with the SAS token. This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11165" + }, + { + "type": "WEB", + "url": "https://github.com/yugabyte/yugabyte-db/commit/920989b6c0db0222bb7a0cce46febc76cf72d438" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-fwfj-54vh-4r92/GHSA-fwfj-54vh-4r92.json b/advisories/unreviewed/2024/11/GHSA-fwfj-54vh-4r92/GHSA-fwfj-54vh-4r92.json index 54de2d84bb4..af0f12282e5 100644 --- a/advisories/unreviewed/2024/11/GHSA-fwfj-54vh-4r92/GHSA-fwfj-54vh-4r92.json +++ b/advisories/unreviewed/2024/11/GHSA-fwfj-54vh-4r92/GHSA-fwfj-54vh-4r92.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fwfj-54vh-4r92", - "modified": "2024-11-08T18:30:49Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-11-07T12:30:35Z", "aliases": [ "CVE-2024-50153" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix null-ptr-deref in target_alloc_device()\n\nThere is a null-ptr-deref issue reported by KASAN:\n\nBUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod]\n...\n kasan_report+0xb9/0xf0\n target_alloc_device+0xbc4/0xbe0 [target_core_mod]\n core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod]\n target_core_init_configfs+0x205/0x420 [target_core_mod]\n do_one_initcall+0xdd/0x4e0\n...\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nIn target_alloc_device(), if allocing memory for dev queues fails, then\ndev will be freed by dev->transport->free_device(), but dev->transport\nis not initialized at that time, which will lead to a null pointer\nreference problem.\n\nFixing this bug by freeing dev with hba->backend->ops->free_device().", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -45,9 +48,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-07T10:15:06Z" diff --git a/advisories/unreviewed/2024/11/GHSA-g8r3-2v89-j6r5/GHSA-g8r3-2v89-j6r5.json b/advisories/unreviewed/2024/11/GHSA-g8r3-2v89-j6r5/GHSA-g8r3-2v89-j6r5.json new file mode 100644 index 00000000000..45707189bdf --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-g8r3-2v89-j6r5/GHSA-g8r3-2v89-j6r5.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g8r3-2v89-j6r5", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-48900" + ], + "details": "A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48900" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318818" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gj54-gm86-gx9p/GHSA-gj54-gm86-gx9p.json b/advisories/unreviewed/2024/11/GHSA-gj54-gm86-gx9p/GHSA-gj54-gm86-gx9p.json new file mode 100644 index 00000000000..dd376aa77fe --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gj54-gm86-gx9p/GHSA-gj54-gm86-gx9p.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gj54-gm86-gx9p", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-50853" + ], + "details": "Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50853" + }, + { + "type": "WEB", + "url": "https://github.com/zp9080/Tenda/blob/main/Tenda-G3v3.0%20V15.11.0.20-formSetDebugCfg/overview.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-jfp4-pv53-rv88/GHSA-jfp4-pv53-rv88.json b/advisories/unreviewed/2024/11/GHSA-jfp4-pv53-rv88/GHSA-jfp4-pv53-rv88.json index 6cd16a52b24..a4994988d58 100644 --- a/advisories/unreviewed/2024/11/GHSA-jfp4-pv53-rv88/GHSA-jfp4-pv53-rv88.json +++ b/advisories/unreviewed/2024/11/GHSA-jfp4-pv53-rv88/GHSA-jfp4-pv53-rv88.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jfp4-pv53-rv88", - "modified": "2024-11-08T21:33:57Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-11-07T12:30:35Z", "aliases": [ "CVE-2024-50152" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix possible double free in smb2_set_ea()\n\nClang static checker(scan-build) warning：\nfs/smb/client/smb2ops.c:1304:2: Attempt to free released memory.\n 1304 | kfree(ea);\n | ^~~~~~~~~\n\nThere is a double free in such case:\n'ea is initialized to NULL' -> 'first successful memory allocation for\nea' -> 'something failed, goto sea_exit' -> 'first memory release for ea'\n-> 'goto replay_again' -> 'second goto sea_exit before allocate memory\nfor ea' -> 'second memory release for ea resulted in double free'.\n\nRe-initialie 'ea' to NULL near to the replay_again label, it can fix this\ndouble free problem.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-415" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-07T10:15:06Z" diff --git a/advisories/unreviewed/2024/11/GHSA-jm4h-wwjv-4q5c/GHSA-jm4h-wwjv-4q5c.json b/advisories/unreviewed/2024/11/GHSA-jm4h-wwjv-4q5c/GHSA-jm4h-wwjv-4q5c.json new file mode 100644 index 00000000000..a91b7093664 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-jm4h-wwjv-4q5c/GHSA-jm4h-wwjv-4q5c.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jm4h-wwjv-4q5c", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-11159" + ], + "details": "Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11159" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1925929" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-61" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-62" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T14:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-m87c-pc83-wrfv/GHSA-m87c-pc83-wrfv.json b/advisories/unreviewed/2024/11/GHSA-m87c-pc83-wrfv/GHSA-m87c-pc83-wrfv.json index 6db54c6d560..242e3a300ed 100644 --- a/advisories/unreviewed/2024/11/GHSA-m87c-pc83-wrfv/GHSA-m87c-pc83-wrfv.json +++ b/advisories/unreviewed/2024/11/GHSA-m87c-pc83-wrfv/GHSA-m87c-pc83-wrfv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-m87c-pc83-wrfv", - "modified": "2024-11-08T18:30:49Z", + "modified": "2024-11-13T15:31:37Z", "published": "2024-11-07T12:30:35Z", "aliases": [ "CVE-2024-50167" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbe2net: fix potential memory leak in be_xmit()\n\nThe be_xmit() returns NETDEV_TX_OK without freeing skb\nin case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-07T10:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-pgcx-464w-5gq2/GHSA-pgcx-464w-5gq2.json b/advisories/unreviewed/2024/11/GHSA-pgcx-464w-5gq2/GHSA-pgcx-464w-5gq2.json new file mode 100644 index 00000000000..93f1b754fc7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pgcx-464w-5gq2/GHSA-pgcx-464w-5gq2.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pgcx-464w-5gq2", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-50852" + ], + "details": "Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50852" + }, + { + "type": "WEB", + "url": "https://github.com/zp9080/Tenda/blob/main/Tenda-G3v3.0%20V15.11.0.20-formSetUSBPartitionUmount/overview.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r29r-jxx6-7ff5/GHSA-r29r-jxx6-7ff5.json b/advisories/unreviewed/2024/11/GHSA-r29r-jxx6-7ff5/GHSA-r29r-jxx6-7ff5.json new file mode 100644 index 00000000000..df73eadbcf6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r29r-jxx6-7ff5/GHSA-r29r-jxx6-7ff5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r29r-jxx6-7ff5", + "modified": "2024-11-13T15:31:38Z", + "published": "2024-11-13T15:31:38Z", + "aliases": [ + "CVE-2024-9477" + ], + "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting (XSS).This issue affects Air4443 Firmware: through 14102024.\n\n\nNOTE: The vendor was contacted and it was learned that the product classified as End-of-Life and End-of-Support.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9477" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1851" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r44r-7g3x-49c3/GHSA-r44r-7g3x-49c3.json b/advisories/unreviewed/2024/11/GHSA-r44r-7g3x-49c3/GHSA-r44r-7g3x-49c3.json new file mode 100644 index 00000000000..d0a2870c0e6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r44r-7g3x-49c3/GHSA-r44r-7g3x-49c3.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r44r-7g3x-49c3", + "modified": "2024-11-13T15:31:38Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-50854" + ], + "details": "Tenda G3 v3.0 v15.11.0.20 was discovered to contain a stack overflow via the formSetPortMapping function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50854" + }, + { + "type": "WEB", + "url": "https://github.com/zp9080/Tenda/blob/main/Tenda-G3v3.0%20V15.11.0.20-formSetPortMapping/overview.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r8pg-c8jf-gm8p/GHSA-r8pg-c8jf-gm8p.json b/advisories/unreviewed/2024/11/GHSA-r8pg-c8jf-gm8p/GHSA-r8pg-c8jf-gm8p.json new file mode 100644 index 00000000000..78e2b8cd9cd --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r8pg-c8jf-gm8p/GHSA-r8pg-c8jf-gm8p.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r8pg-c8jf-gm8p", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-49505" + ], + "details": "A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the  REGEX and P parameters.\nThis issue affects MirrorCache before 1.083.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49505" + }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49505" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w26w-xhj2-cfxj/GHSA-w26w-xhj2-cfxj.json b/advisories/unreviewed/2024/11/GHSA-w26w-xhj2-cfxj/GHSA-w26w-xhj2-cfxj.json new file mode 100644 index 00000000000..ad0ea171e2a --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w26w-xhj2-cfxj/GHSA-w26w-xhj2-cfxj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w26w-xhj2-cfxj", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-48989" + ], + "details": "A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, rendering the device unresponsive by sending arbitrary UDP messages.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48989" + }, + { + "type": "WEB", + "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-315415.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T14:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w9xp-hq72-9j37/GHSA-w9xp-hq72-9j37.json b/advisories/unreviewed/2024/11/GHSA-w9xp-hq72-9j37/GHSA-w9xp-hq72-9j37.json new file mode 100644 index 00000000000..c66c7da612e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w9xp-hq72-9j37/GHSA-w9xp-hq72-9j37.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9xp-hq72-9j37", + "modified": "2024-11-13T15:31:38Z", + "published": "2024-11-13T15:31:38Z", + "aliases": [ + "CVE-2024-49506" + ], + "details": "Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49506" + }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49506" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-377" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json b/advisories/unreviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json new file mode 100644 index 00000000000..870f231a9e8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xhg6-9j5j-w4vf/GHSA-xhg6-9j5j-w4vf.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xhg6-9j5j-w4vf", + "modified": "2024-11-13T15:31:37Z", + "published": "2024-11-13T15:31:37Z", + "aliases": [ + "CVE-2024-48510" + ], + "details": "Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48510" + }, + { + "type": "WEB", + "url": "https://gist.github.com/thomas-chauchefoin-bentley-systems/855218959116f870f08857cce2aec731" + }, + { + "type": "WEB", + "url": "https://github.com/haf/DotNetZip.Semverd" + }, + { + "type": "WEB", + "url": "https://github.com/haf/DotNetZip.Semverd/blob/e487179b33a9a0f2631eed5fb04d2c952ea5377a/src/Zip.Shared/ZipEntry.Extract.cs#L1365-L1410" + }, + { + "type": "WEB", + "url": "https://www.nuget.org/packages/DotNetZip" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T15:15:07Z" + } +} \ No newline at end of file