Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-05-21 15:33:14 +00:00
parent bd36f6c4f6
commit 8fd0de42c9
228 changed files with 11192 additions and 7 deletions
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5gqj-6vcf-6f45",
-  "modified": "2022-05-24T17:45:27Z",
+  "modified": "2024-05-21T15:31:37Z",
  "published": "2022-05-24T17:45:27Z",
  "aliases": [
    "CVE-2021-29098"
  ],
  "details": "Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-22"
+      "CWE-22",
+      "CWE-23"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8vhv-h63p-g472",
-  "modified": "2022-05-24T17:45:27Z",
+  "modified": "2024-05-21T15:31:37Z",
  "published": "2022-05-24T17:45:27Z",
  "aliases": [
    "CVE-2021-29096"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wr7p-7f4r-37fr",
-  "modified": "2022-05-24T17:45:27Z",
+  "modified": "2024-05-21T15:31:37Z",
  "published": "2022-05-24T17:45:27Z",
  "aliases": [
    "CVE-2021-29097"
  ],
  "details": "Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -57,7 +60,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-121"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2277-9x7j-58f3",
+  "modified": "2024-05-21T15:31:41Z",
+  "published": "2024-05-21T15:31:41Z",
+  "aliases": [
+    "CVE-2021-47283"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet:sfc: fix non-freed irq in legacy irq mode\n\nSFC driver can be configured via modparam to work using MSI-X, MSI or\nlegacy IRQ interrupts. In the last one, the interrupt was not properly\nreleased on module remove.\n\nIt was not freed because the flag irqs_hooked was not set during\ninitialization in the case of using legacy IRQ.\n\nExample of (trimmed) trace during module remove without this fix:\n\nremove_proc_entry: removing non-empty directory 'irq/125', leaking at least '0000:3b:00.1'\nWARNING: CPU: 39 PID: 3658 at fs/proc/generic.c:715 remove_proc_entry+0x15c/0x170\n...trimmed...\nCall Trace:\n unregister_irq_proc+0xe3/0x100\n free_desc+0x29/0x70\n irq_free_descs+0x47/0x70\n mp_unmap_irq+0x58/0x60\n acpi_unregister_gsi_ioapic+0x2a/0x40\n acpi_pci_irq_disable+0x78/0xb0\n pci_disable_device+0xd1/0x100\n efx_pci_remove+0xa1/0x1e0 [sfc]\n pci_device_remove+0x38/0xa0\n __device_release_driver+0x177/0x230\n driver_detach+0xcb/0x110\n bus_remove_driver+0x58/0xd0\n pci_unregister_driver+0x2a/0xb0\n efx_exit_module+0x24/0xf40 [sfc]\n __do_sys_delete_module.constprop.0+0x171/0x280\n ? exit_to_user_mode_prepare+0x83/0x1d0\n do_syscall_64+0x3d/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f9f9385800b\n...trimmed...",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47283"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/81c4d1d83f88e15b26f4522a35cba6ffd8c5dfdd"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8d717c9135a3340ae62d1699484850bfb4112b0c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8f03eeb6e0a0a0b8d617ee0a4bce729e47130036"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:16Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-24r3-rx3r-wgvw",
+  "modified": "2024-05-21T15:31:45Z",
+  "published": "2024-05-21T15:31:45Z",
+  "aliases": [
+    "CVE-2024-33528"
+  ],
+  "details": "A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33528"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:29Z"
+  }
+}
@@ -0,0 +1,51 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-28c9-mq9x-7pcr",
+  "modified": "2024-05-21T15:31:42Z",
+  "published": "2024-05-21T15:31:42Z",
+  "aliases": [
+    "CVE-2021-47296"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n\nvcpu_put is not called if the user copy fails. This can result in preempt\nnotifier corruption and crashes, among other issues.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47296"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:17Z"
+  }
+}
@@ -0,0 +1,47 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-29rx-6chj-44xc",
+  "modified": "2024-05-21T15:31:41Z",
+  "published": "2024-05-21T15:31:41Z",
+  "aliases": [
+    "CVE-2021-47291"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions\n\nWhile running the self-tests on a KASAN enabled kernel, I observed a\nslab-out-of-bounds splat very similar to the one reported in\ncommit 821bbf79fe46 (\"ipv6: Fix KASAN: slab-out-of-bounds Read in\n fib6_nh_flush_exceptions\").\n\nWe additionally need to take care of fib6_metrics initialization\nfailure when the caller provides an nh.\n\nThe fix is similar, explicitly free the route instead of calling\nfib6_info_release on a half-initialized object.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47291"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/115784bcccf135c3a3548098153413d76f16aae0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/830251361425c5be044db4d826aaf304ea3d14c6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8fb4792f091e608a0a1d353dfdf07ef55a719db5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/ce8fafb68051fba52546f8bbe8621f7641683680"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:17Z"
+  }
+}
@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2hq2-46wf-3mhv",
+  "modified": "2024-05-21T15:31:42Z",
+  "published": "2024-05-21T15:31:42Z",
+  "aliases": [
+    "CVE-2021-47311"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qcom/emac: fix UAF in emac_remove\n\nadpt is netdev private data and it cannot be\nused after free_netdev() call. Using adpt after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47311"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/11e9d163d631198bb3eb41a677a61b499516c0f7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/2b70ca92847c619d6264c7372ef74fcbfd1e048c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/4d04a42b926e682140776e54188f4a44f1f01a81"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8a225a6e07a57a1538d53637cb3d82bd3e477839"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/ad297cd2db8953e2202970e9504cab247b6c7cb4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/b1e091331920f8fbfc747dcbd16263fcd71abb2d"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/b560521eca03d0a2db6093a5a632cbdd0a0cf833"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:18Z"
+  }
+}
@@ -0,0 +1,51 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2jpv-mgvf-9659",
+  "modified": "2024-05-21T15:31:43Z",
+  "published": "2024-05-21T15:31:43Z",
+  "aliases": [
+    "CVE-2021-47351"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix races between xattr_{set|get} and listxattr operations\n\nUBIFS may occur some problems with concurrent xattr_{set|get} and\nlistxattr operations, such as assertion failure, memory corruption,\nstale xattr value[1].\n\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\noperations on xattr, concurrent read operations are still effective,\njust like ext4.\n\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47351"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:21Z"
+  }
+}
@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2p2c-qgqr-9ghc",
+  "modified": "2024-05-21T15:31:42Z",
+  "published": "2024-05-21T15:31:42Z",
+  "aliases": [
+    "CVE-2021-47317"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/bpf: Fix detecting BPF atomic instructions\n\nCommit 91c960b0056672 (\"bpf: Rename BPF_XADD and prepare to encode other\natomics in .imm\") converted BPF_XADD to BPF_ATOMIC and added a way to\ndistinguish instructions based on the immediate field. Existing JIT\nimplementations were updated to check for the immediate field and to\nreject programs utilizing anything more than BPF_ADD (such as BPF_FETCH)\nin the immediate field.\n\nHowever, the check added to powerpc64 JIT did not look at the correct\nBPF instruction. Due to this, such programs would be accepted and\nincorrectly JIT'ed resulting in soft lockups, as seen with the atomic\nbounds test. Fix this by looking at the correct immediate value.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47317"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:19Z"
+  }
+}
@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2pp7-rwqg-2gcx",
+  "modified": "2024-05-21T15:31:45Z",
+  "published": "2024-05-21T15:31:45Z",
+  "aliases": [
+    "CVE-2021-47409"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47409"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/2754fa3b73df7d0ae042f3ed6cfd9df9042f6262"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/337f00a0bc62d7cb7d10ec0b872c79009a1641df"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/4b7f4a0eb92bf37bea4cd838c7f83ea42823ca8b"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/856e6e8e0f9300befa87dde09edb578555c99a82"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8b9c1c33e51d0959f2aec573dfbac0ffd3f5c0b7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/a7182993dd8e09f96839ddc3ac54f9b37370d282"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:26Z"
+  }
+}
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2qgr-37h8-x3w9",
+  "modified": "2024-05-21T15:31:41Z",
+  "published": "2024-05-21T15:31:41Z",
+  "aliases": [
+    "CVE-2021-47260"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a potential NULL dereference in nfs_get_client()\n\nNone of the callers are expecting NULL returns from nfs_get_client() so\nthis code will lead to an Oops.  It's better to return an error\npointer.  I expect that this is dead code so hopefully no one is\naffected.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47260"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/0057ecef9f324007c0ba5fcca4ddd131178ce78b"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/09226e8303beeec10f2ff844d2e46d1371dc58e0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/279ad78a00f8b9c5ff24171a59297187a3bd44b7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/4b380a7d84ef2ce3f4f5bec5d8706ed937ac6502"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/58ddf61f10b8f9b7b1341644bfee2f1c6508d4e1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/634f17ff1d59905eb3b4bbbc00805961d08beaee"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/a979e601000982a3ca693171a6d4dffc47f8ad00"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/fab8bfdfb4aac9e4e8363666333adfdf21e89106"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:14Z"
+  }
+}
@@ -0,0 +1,47 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2v26-28rg-whvc",
+  "modified": "2024-05-21T15:31:44Z",
+  "published": "2024-05-21T15:31:44Z",
+  "aliases": [
+    "CVE-2021-47385"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47385"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/0f36b88173f028e372668ae040ab1a496834d278"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/1499bb2c3a87a2efea0065adab2bd66badee61c3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/200ced5ba724d8bbf29dfac4ed1e17a39ccaccd1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/24af1fe376e22c42238a4a604d31e46c486876c3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:24Z"
+  }
+}
@@ -0,0 +1,51 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2v93-g9j3-9q9h",
+  "modified": "2024-05-21T15:31:41Z",
+  "published": "2024-05-21T15:31:41Z",
+  "aliases": [
+    "CVE-2021-47261"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix initializing CQ fragments buffer\n\nThe function init_cq_frag_buf() can be called to initialize the current CQ\nfragments buffer cq->buf, or the temporary cq->resize_buf that is filled\nduring CQ resize operation.\n\nHowever, the offending commit started to use function get_cqe() for\ngetting the CQEs, the issue with this change is that get_cqe() always\nreturns CQEs from cq->buf, which leads us to initialize the wrong buffer,\nand in case of enlarging the CQ we try to access elements beyond the size\nof the current cq->buf and eventually hit a kernel panic.\n\n [exception RIP: init_cq_frag_buf+103]\n  [ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib]\n  [ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core]\n  [ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt]\n  [ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt]\n  [ffff9f799ddcbe98] llt_rdma_client_conn_thread at ffffffffc0a6bb75 [llt]\n  [ffff9f799ddcbec8] kthread at ffffffffa66c5da1\n  [ffff9f799ddcbf50] ret_from_fork_nospec_begin at ffffffffa6d95ddd\n\nFix it by getting the needed CQE by calling mlx5_frag_buf_get_wqe() that\ntakes the correct source buffer as a parameter.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47261"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/1ec2dcd680c71d0d36fa25638b327a468babd5c9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/2ba0aa2feebda680ecfc3c552e867cf4d1b05a3a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/3e670c54eda238cb8a1ea93538a79ae89285c1c4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/91f7fdc4cc10542ca1045c06aad23365f0d067e0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/e3ecd9c09fcc10cf6b2bc67e2990c397c40a8c26"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:14Z"
+  }
+}
@@ -0,0 +1,47 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2wcp-6fq9-mcr6",
+  "modified": "2024-05-21T15:31:44Z",
+  "published": "2024-05-21T15:31:44Z",
+  "aliases": [
+    "CVE-2021-47386"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignment]",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47386"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/16887ae4e3defd2c4e7913b6c539f33eaf4eac5c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/44d3c480e4e2a75bf6296a18b4356157991ccd80"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/516d9055039017a20a698103be2b556b4c976bb8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/943c15ac1b84d378da26bba41c83c67e16499ac4"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:24Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-335x-9j96-mxcr",
+  "modified": "2024-05-21T15:31:44Z",
+  "published": "2024-05-21T15:31:44Z",
+  "aliases": [
+    "CVE-2021-47374"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: prevent an error message from causing runtime problems\n\nFor some drivers, that use the DMA API. This error message can be reached\nseveral millions of times per second, causing spam to the kernel's printk\nbuffer and bringing the CPU usage up to 100% (so, it should be rate\nlimited). However, since there is at least one driver that is in the\nmainline and suffers from the error condition, it is more useful to\nerr_printk() here instead of just rate limiting the error message (in hopes\nthat it will make it easier for other drivers that suffer from this issue\nto be spotted).",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47374"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/510e1a724ab1bf38150be2c1acabb303f98d0047"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/de4afec2d2946c92c62a15ab341c70b287289e6a"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-21T15:15:23Z"
+  }
+}
--- a/Show More
+++ b/Show More