From 8fd0de42c92264a5f4e07db344f8162ac5214dd5 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 21 May 2024 15:33:14 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-5gqj-6vcf-6f45.json | 7 +- .../GHSA-7q9j-c58f-8cw5.json | 3 +- .../GHSA-8vhv-h63p-g472.json | 2 +- .../GHSA-wr7p-7f4r-37fr.json | 10 ++- .../GHSA-2277-9x7j-58f3.json | 43 +++++++++++ .../GHSA-24r3-rx3r-wgvw.json | 35 +++++++++ .../GHSA-27rv-f8p8-59gg.json | 39 ++++++++++ .../GHSA-28c9-mq9x-7pcr.json | 51 +++++++++++++ .../GHSA-29rx-6chj-44xc.json | 47 ++++++++++++ .../GHSA-2cf6-4ffg-wwcf.json | 59 +++++++++++++++ .../GHSA-2hh5-254v-jpf4.json | 39 ++++++++++ .../GHSA-2hq2-46wf-3mhv.json | 59 +++++++++++++++ .../GHSA-2jpv-mgvf-9659.json | 51 +++++++++++++ .../GHSA-2p2c-qgqr-9ghc.json | 43 +++++++++++ .../GHSA-2pp7-rwqg-2gcx.json | 55 ++++++++++++++ .../GHSA-2qgr-37h8-x3w9.json | 63 ++++++++++++++++ .../GHSA-2v26-28rg-whvc.json | 47 ++++++++++++ .../GHSA-2v93-g9j3-9q9h.json | 51 +++++++++++++ .../GHSA-2wcp-6fq9-mcr6.json | 47 ++++++++++++ .../GHSA-335x-9j96-mxcr.json | 39 ++++++++++ .../GHSA-33w7-r9c3-9qwq.json | 59 +++++++++++++++ .../GHSA-39gw-mq6q-79fw.json | 39 ++++++++++ .../GHSA-3c4w-p6cr-wgq6.json | 43 +++++++++++ .../GHSA-3gcc-j58h-xmv8.json | 67 +++++++++++++++++ .../GHSA-3hw4-pvhh-9qcq.json | 55 ++++++++++++++ .../GHSA-3p2v-4qj8-6w5f.json | 43 +++++++++++ .../GHSA-3qvj-8qwq-5jxj.json | 67 +++++++++++++++++ .../GHSA-3vpw-pw66-4mjh.json | 43 +++++++++++ .../GHSA-3w59-vx6f-4274.json | 63 ++++++++++++++++ .../GHSA-3wh6-h4gj-wjr7.json | 47 ++++++++++++ .../GHSA-3whv-3wrh-jjqq.json | 55 ++++++++++++++ .../GHSA-47p2-vwpg-v462.json | 35 +++++++++ .../GHSA-482h-984g-m9qw.json | 43 +++++++++++ .../GHSA-4fxc-v2fq-wgmf.json | 39 ++++++++++ .../GHSA-4gxv-hggr-2473.json | 43 +++++++++++ .../GHSA-4h6j-2wpq-2xv2.json | 38 ++++++++++ .../GHSA-4jxh-jrgp-4422.json | 43 +++++++++++ .../GHSA-4mwj-7h55-4fvc.json | 43 +++++++++++ .../GHSA-4q4j-hm78-5vmp.json | 51 +++++++++++++ .../GHSA-4xq8-m4f5-h82h.json | 59 +++++++++++++++ .../GHSA-589w-2j5c-px7j.json | 63 ++++++++++++++++ .../GHSA-5cq3-7g4c-4j8m.json | 39 ++++++++++ .../GHSA-5g7f-2wxq-wj73.json | 35 +++++++++ .../GHSA-5hmx-w727-fqq7.json | 51 +++++++++++++ .../GHSA-5j57-53hq-vmc7.json | 39 ++++++++++ .../GHSA-5vvx-6299-h82w.json | 63 ++++++++++++++++ .../GHSA-5w2f-hr95-2h6j.json | 39 ++++++++++ .../GHSA-6239-6f98-f8vf.json | 63 ++++++++++++++++ .../GHSA-62x6-4gmp-fg78.json | 63 ++++++++++++++++ .../GHSA-688x-28gq-pm6f.json | 63 ++++++++++++++++ .../GHSA-6g88-wmq7-m8g5.json | 39 ++++++++++ .../GHSA-6h98-v544-xj7q.json | 51 +++++++++++++ .../GHSA-6hjh-qhhq-4q76.json | 35 +++++++++ .../GHSA-6hmf-7mx4-83j8.json | 55 ++++++++++++++ .../GHSA-6pvp-xcj5-pgh8.json | 51 +++++++++++++ .../GHSA-6qx7-m4qh-j7cp.json | 39 ++++++++++ .../GHSA-6xc5-7hvv-v7jc.json | 39 ++++++++++ .../GHSA-7457-jp56-wxrq.json | 43 +++++++++++ .../GHSA-747f-wh5x-mp2p.json | 63 ++++++++++++++++ .../GHSA-74hg-7r85-vvw3.json | 55 ++++++++++++++ .../GHSA-74qf-46c3-qxv8.json | 67 +++++++++++++++++ .../GHSA-76pr-h99m-q4fj.json | 47 ++++++++++++ .../GHSA-77hq-crr3-x6hc.json | 39 ++++++++++ .../GHSA-7f2x-rjqg-7667.json | 51 +++++++++++++ .../GHSA-7fq3-h5p4-7j98.json | 43 +++++++++++ .../GHSA-7hrf-mgqx-vhg4.json | 47 ++++++++++++ .../GHSA-7qhc-3php-2c6m.json | 39 ++++++++++ .../GHSA-7qvv-hm32-963p.json | 39 ++++++++++ .../GHSA-7r2w-9mrv-hfqg.json | 63 ++++++++++++++++ .../GHSA-7r7x-qw92-2ffh.json | 55 ++++++++++++++ .../GHSA-7rxq-5vw3-rhvg.json | 55 ++++++++++++++ .../GHSA-7wxc-v995-9mmf.json | 43 +++++++++++ .../GHSA-836m-cmjj-qv5g.json | 47 ++++++++++++ .../GHSA-84wp-3676-5rx2.json | 43 +++++++++++ .../GHSA-85h7-g6vm-p392.json | 47 ++++++++++++ .../GHSA-8cxw-6695-4jq3.json | 47 ++++++++++++ .../GHSA-8fm5-v3c4-vrmq.json | 43 +++++++++++ .../GHSA-8g98-8rxj-3j4q.json | 43 +++++++++++ .../GHSA-8p4f-x4p9-vv9j.json | 63 ++++++++++++++++ .../GHSA-8q2m-46mc-pjw4.json | 55 ++++++++++++++ .../GHSA-8v6f-ww2f-hcqw.json | 39 ++++++++++ .../GHSA-8w7w-2rv7-qqw7.json | 51 +++++++++++++ .../GHSA-8x7q-xp33-2vvh.json | 38 ++++++++++ .../GHSA-95jj-pjw6-q9fr.json | 43 +++++++++++ .../GHSA-95jq-x6q9-c9cq.json | 39 ++++++++++ .../GHSA-9fqj-w3wf-p8vf.json | 47 ++++++++++++ .../GHSA-9h2q-cwg7-7wx8.json | 55 ++++++++++++++ .../GHSA-9rr2-xw5v-w787.json | 39 ++++++++++ .../GHSA-c227-q7j7-xf88.json | 63 ++++++++++++++++ .../GHSA-c5qq-qcr6-82vp.json | 43 +++++++++++ .../GHSA-c655-qwvw-wfqm.json | 47 ++++++++++++ .../GHSA-c97j-6qv5-jqj7.json | 51 +++++++++++++ .../GHSA-c989-6j3h-w4c3.json | 35 +++++++++ .../GHSA-c9p5-rxmf-r4m6.json | 47 ++++++++++++ .../GHSA-cc2x-949j-9v5x.json | 43 +++++++++++ .../GHSA-cc8f-64j2-hxm7.json | 43 +++++++++++ .../GHSA-ch44-784c-7wgq.json | 63 ++++++++++++++++ .../GHSA-chv3-xxv6-8hvr.json | 67 +++++++++++++++++ .../GHSA-cjw7-m4qf-xc59.json | 43 +++++++++++ .../GHSA-cm35-f8g3-r786.json | 67 +++++++++++++++++ .../GHSA-cm8p-x6g5-jp9g.json | 59 +++++++++++++++ .../GHSA-cqgv-cq5q-68pf.json | 47 ++++++++++++ .../GHSA-cv8j-wfmq-4fjv.json | 47 ++++++++++++ .../GHSA-cwgg-8744-62hw.json | 63 ++++++++++++++++ .../GHSA-cwj6-5v55-7mj7.json | 63 ++++++++++++++++ .../GHSA-cwq4-fr9x-6844.json | 47 ++++++++++++ .../GHSA-f353-mfhf-jfh7.json | 51 +++++++++++++ .../GHSA-f7qf-xjhc-mhcj.json | 39 ++++++++++ .../GHSA-f8fr-xvcp-37m8.json | 39 ++++++++++ .../GHSA-fhjr-hghh-2jv9.json | 67 +++++++++++++++++ .../GHSA-fj34-p4r2-ghh5.json | 43 +++++++++++ .../GHSA-fmvf-fm6q-vpjg.json | 35 +++++++++ .../GHSA-fpq3-4hc6-6rvg.json | 67 +++++++++++++++++ .../GHSA-fw4j-88v3-6hfw.json | 55 ++++++++++++++ .../GHSA-g2fc-vv42-p4pc.json | 43 +++++++++++ .../GHSA-g3v4-6rhh-7539.json | 63 ++++++++++++++++ .../GHSA-g595-9cfg-4hxm.json | 47 ++++++++++++ .../GHSA-g7gx-qmj4-gxrc.json | 39 ++++++++++ .../GHSA-g8c8-mwvp-jcrr.json | 39 ++++++++++ .../GHSA-g97v-hf56-5335.json | 59 +++++++++++++++ .../GHSA-gc8r-vh42-27g4.json | 39 ++++++++++ .../GHSA-gg86-5h5f-jrwx.json | 43 +++++++++++ .../GHSA-gh9h-qjxh-2mh7.json | 47 ++++++++++++ .../GHSA-ghv4-3pw7-86rj.json | 67 +++++++++++++++++ .../GHSA-gr8g-fg7p-9238.json | 43 +++++++++++ .../GHSA-grfr-gx46-j682.json | 43 +++++++++++ .../GHSA-grwp-8243-xpjh.json | 43 +++++++++++ .../GHSA-gx2j-3fvm-rqj3.json | 39 ++++++++++ .../GHSA-h3hv-fpf3-c5jm.json | 63 ++++++++++++++++ .../GHSA-h423-6g7m-qpqq.json | 55 ++++++++++++++ .../GHSA-h6gr-4677-26p9.json | 47 ++++++++++++ .../GHSA-h7hm-j4cr-jwhq.json | 63 ++++++++++++++++ .../GHSA-h9p9-4f35-pxjm.json | 47 ++++++++++++ .../GHSA-hf7w-m8fc-q8fp.json | 51 +++++++++++++ .../GHSA-hh94-frj2-pf9r.json | 43 +++++++++++ .../GHSA-hjv5-8xv5-vmfp.json | 71 +++++++++++++++++++ .../GHSA-hm5p-668j-x4q6.json | 67 +++++++++++++++++ .../GHSA-hq29-fr4v-2847.json | 43 +++++++++++ .../GHSA-hw2j-3fc3-hf74.json | 43 +++++++++++ .../GHSA-hxcf-7gwm-65p8.json | 47 ++++++++++++ .../GHSA-hxrw-3c72-p9hc.json | 42 +++++++++++ .../GHSA-j2r5-7q65-9hjq.json | 35 +++++++++ .../GHSA-j469-qwv3-79fj.json | 67 +++++++++++++++++ .../GHSA-j8cp-h624-v86v.json | 63 ++++++++++++++++ .../GHSA-j8g9-5p8g-4f3x.json | 47 ++++++++++++ .../GHSA-j8hx-6rxw-p4r9.json | 47 ++++++++++++ .../GHSA-jhg5-q2mj-r9vh.json | 39 ++++++++++ .../GHSA-jmm7-6r74-7f4p.json | 63 ++++++++++++++++ .../GHSA-jpfh-4v99-5m27.json | 43 +++++++++++ .../GHSA-jq29-8xm6-ccxq.json | 47 ++++++++++++ .../GHSA-jq6v-72pf-8j24.json | 59 +++++++++++++++ .../GHSA-jqwg-pjjq-gqv5.json | 59 +++++++++++++++ .../GHSA-jv5x-8v9f-frx2.json | 59 +++++++++++++++ .../GHSA-jwv9-vf83-vjmw.json | 59 +++++++++++++++ .../GHSA-m2r9-3c4r-qv68.json | 51 +++++++++++++ .../GHSA-m2xg-x7vq-c628.json | 63 ++++++++++++++++ .../GHSA-m9r6-94f7-4j6m.json | 55 ++++++++++++++ .../GHSA-mgmg-f25r-3gfh.json | 47 ++++++++++++ .../GHSA-mjhg-c85c-62fv.json | 39 ++++++++++ .../GHSA-mpm3-wjp6-8g7x.json | 39 ++++++++++ .../GHSA-mrm7-vh23-g98v.json | 39 ++++++++++ .../GHSA-mv9f-845w-2cgm.json | 43 +++++++++++ .../GHSA-mxwx-46p7-hcm6.json | 43 +++++++++++ .../GHSA-p2qw-28x5-q4gw.json | 39 ++++++++++ .../GHSA-p47x-q59q-2mpw.json | 55 ++++++++++++++ .../GHSA-p52g-5qgx-4crw.json | 55 ++++++++++++++ .../GHSA-p793-3f2h-38xw.json | 47 ++++++++++++ .../GHSA-pcr5-v468-562j.json | 63 ++++++++++++++++ .../GHSA-pcwf-v3ph-3p9v.json | 63 ++++++++++++++++ .../GHSA-pmmh-7pm7-hc62.json | 43 +++++++++++ .../GHSA-pmrx-2gv3-hv52.json | 51 +++++++++++++ .../GHSA-ppm9-9qx2-3mjr.json | 51 +++++++++++++ .../GHSA-prq2-qj2r-jcgv.json | 63 ++++++++++++++++ .../GHSA-pv65-xqrg-hc85.json | 67 +++++++++++++++++ .../GHSA-pwqm-5jrg-2v3g.json | 67 +++++++++++++++++ .../GHSA-px85-vjfw-cm92.json | 59 +++++++++++++++ .../GHSA-pxqq-3ph7-mw6w.json | 39 ++++++++++ .../GHSA-q44p-8h6w-57m6.json | 63 ++++++++++++++++ .../GHSA-q77h-85v7-m3mw.json | 39 ++++++++++ .../GHSA-qh8g-p933-67r9.json | 39 ++++++++++ .../GHSA-qj4q-cgq8-w2m4.json | 43 +++++++++++ .../GHSA-qj68-9gpw-8pq2.json | 39 ++++++++++ .../GHSA-qp63-w47q-g9vj.json | 63 ++++++++++++++++ .../GHSA-qpf6-m6mq-hcmq.json | 39 ++++++++++ .../GHSA-qqw5-j897-27cf.json | 51 +++++++++++++ .../GHSA-qr6c-mgw3-xxq8.json | 67 +++++++++++++++++ .../GHSA-qvgm-cw57-rm8q.json | 67 +++++++++++++++++ .../GHSA-qxvg-qh99-hg66.json | 43 +++++++++++ .../GHSA-r2r3-fm28-9g3h.json | 43 +++++++++++ .../GHSA-rcjv-j3v6-r6cv.json | 55 ++++++++++++++ .../GHSA-rgj4-j68m-986v.json | 63 ++++++++++++++++ .../GHSA-rmqp-6x5x-g7fg.json | 47 ++++++++++++ .../GHSA-rr3f-v8j5-mmr6.json | 59 +++++++++++++++ .../GHSA-rxcf-2w24-j9pq.json | 39 ++++++++++ .../GHSA-v5r4-g8jp-rvxf.json | 67 +++++++++++++++++ .../GHSA-v8p3-mfrc-9v8j.json | 55 ++++++++++++++ .../GHSA-vp78-5x9p-m27h.json | 51 +++++++++++++ .../GHSA-vrx5-g53m-hhm7.json | 39 ++++++++++ .../GHSA-w2mr-3frj-pxv2.json | 35 +++++++++ .../GHSA-w5h4-c4xx-3r8p.json | 43 +++++++++++ .../GHSA-w5h9-gvgr-jhpg.json | 43 +++++++++++ .../GHSA-w7j7-m99g-gcgq.json | 55 ++++++++++++++ .../GHSA-w825-9xqr-f6q3.json | 43 +++++++++++ .../GHSA-w883-jj58-rv96.json | 63 ++++++++++++++++ .../GHSA-w9cr-rpv2-57qv.json | 47 ++++++++++++ .../GHSA-w9fp-75mc-76ff.json | 51 +++++++++++++ .../GHSA-wc9c-rv2v-442r.json | 63 ++++++++++++++++ .../GHSA-wf38-7v3f-5mjp.json | 59 +++++++++++++++ .../GHSA-wgwm-v825-xmjx.json | 47 ++++++++++++ .../GHSA-whrp-vxvh-9rj2.json | 43 +++++++++++ .../GHSA-wr5g-85mp-25c9.json | 63 ++++++++++++++++ .../GHSA-wr76-p7r7-8vjv.json | 47 ++++++++++++ .../GHSA-wvfx-f2w6-5jrg.json | 67 +++++++++++++++++ .../GHSA-wxhc-3989-9jq8.json | 63 ++++++++++++++++ .../GHSA-x52v-qr6m-xx85.json | 43 +++++++++++ .../GHSA-x56w-x8rv-273m.json | 47 ++++++++++++ .../GHSA-x5fc-mwch-j73r.json | 43 +++++++++++ .../GHSA-x6vg-gvf6-hmp9.json | 63 ++++++++++++++++ .../GHSA-x858-gx5h-mfp9.json | 55 ++++++++++++++ .../GHSA-x95x-w6hq-mwxc.json | 39 ++++++++++ .../GHSA-xchp-7x95-36g7.json | 43 +++++++++++ .../GHSA-xj33-wwm4-p8mw.json | 47 ++++++++++++ .../GHSA-xm9j-x4hp-v2x3.json | 43 +++++++++++ .../GHSA-xmfc-6x2r-fqv5.json | 67 +++++++++++++++++ .../GHSA-xp4x-rp64-962g.json | 59 +++++++++++++++ .../GHSA-xqq2-v4rf-49qr.json | 39 ++++++++++ .../GHSA-xwrf-hhx9-vmhv.json | 43 +++++++++++ .../GHSA-xwvh-fxhh-3qrr.json | 47 ++++++++++++ 228 files changed, 11192 insertions(+), 7 deletions(-) create mode 100644 advisories/unreviewed/2024/05/GHSA-2277-9x7j-58f3/GHSA-2277-9x7j-58f3.json create mode 100644 advisories/unreviewed/2024/05/GHSA-24r3-rx3r-wgvw/GHSA-24r3-rx3r-wgvw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-27rv-f8p8-59gg/GHSA-27rv-f8p8-59gg.json create mode 100644 advisories/unreviewed/2024/05/GHSA-28c9-mq9x-7pcr/GHSA-28c9-mq9x-7pcr.json create mode 100644 advisories/unreviewed/2024/05/GHSA-29rx-6chj-44xc/GHSA-29rx-6chj-44xc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2cf6-4ffg-wwcf/GHSA-2cf6-4ffg-wwcf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2hh5-254v-jpf4/GHSA-2hh5-254v-jpf4.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2hq2-46wf-3mhv/GHSA-2hq2-46wf-3mhv.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2jpv-mgvf-9659/GHSA-2jpv-mgvf-9659.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2p2c-qgqr-9ghc/GHSA-2p2c-qgqr-9ghc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2pp7-rwqg-2gcx/GHSA-2pp7-rwqg-2gcx.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2qgr-37h8-x3w9/GHSA-2qgr-37h8-x3w9.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2v26-28rg-whvc/GHSA-2v26-28rg-whvc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2v93-g9j3-9q9h/GHSA-2v93-g9j3-9q9h.json create mode 100644 advisories/unreviewed/2024/05/GHSA-2wcp-6fq9-mcr6/GHSA-2wcp-6fq9-mcr6.json create mode 100644 advisories/unreviewed/2024/05/GHSA-335x-9j96-mxcr/GHSA-335x-9j96-mxcr.json create mode 100644 advisories/unreviewed/2024/05/GHSA-33w7-r9c3-9qwq/GHSA-33w7-r9c3-9qwq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-39gw-mq6q-79fw/GHSA-39gw-mq6q-79fw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3c4w-p6cr-wgq6/GHSA-3c4w-p6cr-wgq6.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3gcc-j58h-xmv8/GHSA-3gcc-j58h-xmv8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3hw4-pvhh-9qcq/GHSA-3hw4-pvhh-9qcq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3p2v-4qj8-6w5f/GHSA-3p2v-4qj8-6w5f.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3qvj-8qwq-5jxj/GHSA-3qvj-8qwq-5jxj.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3vpw-pw66-4mjh/GHSA-3vpw-pw66-4mjh.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3w59-vx6f-4274/GHSA-3w59-vx6f-4274.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3wh6-h4gj-wjr7/GHSA-3wh6-h4gj-wjr7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-3whv-3wrh-jjqq/GHSA-3whv-3wrh-jjqq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-47p2-vwpg-v462/GHSA-47p2-vwpg-v462.json create mode 100644 advisories/unreviewed/2024/05/GHSA-482h-984g-m9qw/GHSA-482h-984g-m9qw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-4fxc-v2fq-wgmf/GHSA-4fxc-v2fq-wgmf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-4gxv-hggr-2473/GHSA-4gxv-hggr-2473.json create mode 100644 advisories/unreviewed/2024/05/GHSA-4h6j-2wpq-2xv2/GHSA-4h6j-2wpq-2xv2.json create mode 100644 advisories/unreviewed/2024/05/GHSA-4jxh-jrgp-4422/GHSA-4jxh-jrgp-4422.json create mode 100644 advisories/unreviewed/2024/05/GHSA-4mwj-7h55-4fvc/GHSA-4mwj-7h55-4fvc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-4q4j-hm78-5vmp/GHSA-4q4j-hm78-5vmp.json create mode 100644 advisories/unreviewed/2024/05/GHSA-4xq8-m4f5-h82h/GHSA-4xq8-m4f5-h82h.json create mode 100644 advisories/unreviewed/2024/05/GHSA-589w-2j5c-px7j/GHSA-589w-2j5c-px7j.json create mode 100644 advisories/unreviewed/2024/05/GHSA-5cq3-7g4c-4j8m/GHSA-5cq3-7g4c-4j8m.json create mode 100644 advisories/unreviewed/2024/05/GHSA-5g7f-2wxq-wj73/GHSA-5g7f-2wxq-wj73.json create mode 100644 advisories/unreviewed/2024/05/GHSA-5hmx-w727-fqq7/GHSA-5hmx-w727-fqq7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-5j57-53hq-vmc7/GHSA-5j57-53hq-vmc7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-5vvx-6299-h82w/GHSA-5vvx-6299-h82w.json create mode 100644 advisories/unreviewed/2024/05/GHSA-5w2f-hr95-2h6j/GHSA-5w2f-hr95-2h6j.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6239-6f98-f8vf/GHSA-6239-6f98-f8vf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-62x6-4gmp-fg78/GHSA-62x6-4gmp-fg78.json create mode 100644 advisories/unreviewed/2024/05/GHSA-688x-28gq-pm6f/GHSA-688x-28gq-pm6f.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6g88-wmq7-m8g5/GHSA-6g88-wmq7-m8g5.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6h98-v544-xj7q/GHSA-6h98-v544-xj7q.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6hjh-qhhq-4q76/GHSA-6hjh-qhhq-4q76.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6hmf-7mx4-83j8/GHSA-6hmf-7mx4-83j8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6pvp-xcj5-pgh8/GHSA-6pvp-xcj5-pgh8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6qx7-m4qh-j7cp/GHSA-6qx7-m4qh-j7cp.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6xc5-7hvv-v7jc/GHSA-6xc5-7hvv-v7jc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7457-jp56-wxrq/GHSA-7457-jp56-wxrq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-747f-wh5x-mp2p/GHSA-747f-wh5x-mp2p.json create mode 100644 advisories/unreviewed/2024/05/GHSA-74hg-7r85-vvw3/GHSA-74hg-7r85-vvw3.json create mode 100644 advisories/unreviewed/2024/05/GHSA-74qf-46c3-qxv8/GHSA-74qf-46c3-qxv8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-76pr-h99m-q4fj/GHSA-76pr-h99m-q4fj.json create mode 100644 advisories/unreviewed/2024/05/GHSA-77hq-crr3-x6hc/GHSA-77hq-crr3-x6hc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7f2x-rjqg-7667/GHSA-7f2x-rjqg-7667.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7fq3-h5p4-7j98/GHSA-7fq3-h5p4-7j98.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7hrf-mgqx-vhg4/GHSA-7hrf-mgqx-vhg4.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7qhc-3php-2c6m/GHSA-7qhc-3php-2c6m.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7qvv-hm32-963p/GHSA-7qvv-hm32-963p.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7r2w-9mrv-hfqg/GHSA-7r2w-9mrv-hfqg.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7r7x-qw92-2ffh/GHSA-7r7x-qw92-2ffh.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7rxq-5vw3-rhvg/GHSA-7rxq-5vw3-rhvg.json create mode 100644 advisories/unreviewed/2024/05/GHSA-7wxc-v995-9mmf/GHSA-7wxc-v995-9mmf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-836m-cmjj-qv5g/GHSA-836m-cmjj-qv5g.json create mode 100644 advisories/unreviewed/2024/05/GHSA-84wp-3676-5rx2/GHSA-84wp-3676-5rx2.json create mode 100644 advisories/unreviewed/2024/05/GHSA-85h7-g6vm-p392/GHSA-85h7-g6vm-p392.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8cxw-6695-4jq3/GHSA-8cxw-6695-4jq3.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8fm5-v3c4-vrmq/GHSA-8fm5-v3c4-vrmq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8g98-8rxj-3j4q/GHSA-8g98-8rxj-3j4q.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8p4f-x4p9-vv9j/GHSA-8p4f-x4p9-vv9j.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8q2m-46mc-pjw4/GHSA-8q2m-46mc-pjw4.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8v6f-ww2f-hcqw/GHSA-8v6f-ww2f-hcqw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8w7w-2rv7-qqw7/GHSA-8w7w-2rv7-qqw7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8x7q-xp33-2vvh/GHSA-8x7q-xp33-2vvh.json create mode 100644 advisories/unreviewed/2024/05/GHSA-95jj-pjw6-q9fr/GHSA-95jj-pjw6-q9fr.json create mode 100644 advisories/unreviewed/2024/05/GHSA-95jq-x6q9-c9cq/GHSA-95jq-x6q9-c9cq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-9fqj-w3wf-p8vf/GHSA-9fqj-w3wf-p8vf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-9h2q-cwg7-7wx8/GHSA-9h2q-cwg7-7wx8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-9rr2-xw5v-w787/GHSA-9rr2-xw5v-w787.json create mode 100644 advisories/unreviewed/2024/05/GHSA-c227-q7j7-xf88/GHSA-c227-q7j7-xf88.json create mode 100644 advisories/unreviewed/2024/05/GHSA-c5qq-qcr6-82vp/GHSA-c5qq-qcr6-82vp.json create mode 100644 advisories/unreviewed/2024/05/GHSA-c655-qwvw-wfqm/GHSA-c655-qwvw-wfqm.json create mode 100644 advisories/unreviewed/2024/05/GHSA-c97j-6qv5-jqj7/GHSA-c97j-6qv5-jqj7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-c989-6j3h-w4c3/GHSA-c989-6j3h-w4c3.json create mode 100644 advisories/unreviewed/2024/05/GHSA-c9p5-rxmf-r4m6/GHSA-c9p5-rxmf-r4m6.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cc2x-949j-9v5x/GHSA-cc2x-949j-9v5x.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cc8f-64j2-hxm7/GHSA-cc8f-64j2-hxm7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-ch44-784c-7wgq/GHSA-ch44-784c-7wgq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-chv3-xxv6-8hvr/GHSA-chv3-xxv6-8hvr.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cjw7-m4qf-xc59/GHSA-cjw7-m4qf-xc59.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cm35-f8g3-r786/GHSA-cm35-f8g3-r786.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cm8p-x6g5-jp9g/GHSA-cm8p-x6g5-jp9g.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cqgv-cq5q-68pf/GHSA-cqgv-cq5q-68pf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cv8j-wfmq-4fjv/GHSA-cv8j-wfmq-4fjv.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cwgg-8744-62hw/GHSA-cwgg-8744-62hw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cwj6-5v55-7mj7/GHSA-cwj6-5v55-7mj7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-cwq4-fr9x-6844/GHSA-cwq4-fr9x-6844.json create mode 100644 advisories/unreviewed/2024/05/GHSA-f353-mfhf-jfh7/GHSA-f353-mfhf-jfh7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-f7qf-xjhc-mhcj/GHSA-f7qf-xjhc-mhcj.json create mode 100644 advisories/unreviewed/2024/05/GHSA-f8fr-xvcp-37m8/GHSA-f8fr-xvcp-37m8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-fhjr-hghh-2jv9/GHSA-fhjr-hghh-2jv9.json create mode 100644 advisories/unreviewed/2024/05/GHSA-fj34-p4r2-ghh5/GHSA-fj34-p4r2-ghh5.json create mode 100644 advisories/unreviewed/2024/05/GHSA-fmvf-fm6q-vpjg/GHSA-fmvf-fm6q-vpjg.json create mode 100644 advisories/unreviewed/2024/05/GHSA-fpq3-4hc6-6rvg/GHSA-fpq3-4hc6-6rvg.json create mode 100644 advisories/unreviewed/2024/05/GHSA-fw4j-88v3-6hfw/GHSA-fw4j-88v3-6hfw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-g2fc-vv42-p4pc/GHSA-g2fc-vv42-p4pc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-g3v4-6rhh-7539/GHSA-g3v4-6rhh-7539.json create mode 100644 advisories/unreviewed/2024/05/GHSA-g595-9cfg-4hxm/GHSA-g595-9cfg-4hxm.json create mode 100644 advisories/unreviewed/2024/05/GHSA-g7gx-qmj4-gxrc/GHSA-g7gx-qmj4-gxrc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-g8c8-mwvp-jcrr/GHSA-g8c8-mwvp-jcrr.json create mode 100644 advisories/unreviewed/2024/05/GHSA-g97v-hf56-5335/GHSA-g97v-hf56-5335.json create mode 100644 advisories/unreviewed/2024/05/GHSA-gc8r-vh42-27g4/GHSA-gc8r-vh42-27g4.json create mode 100644 advisories/unreviewed/2024/05/GHSA-gg86-5h5f-jrwx/GHSA-gg86-5h5f-jrwx.json create mode 100644 advisories/unreviewed/2024/05/GHSA-gh9h-qjxh-2mh7/GHSA-gh9h-qjxh-2mh7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-ghv4-3pw7-86rj/GHSA-ghv4-3pw7-86rj.json create mode 100644 advisories/unreviewed/2024/05/GHSA-gr8g-fg7p-9238/GHSA-gr8g-fg7p-9238.json create mode 100644 advisories/unreviewed/2024/05/GHSA-grfr-gx46-j682/GHSA-grfr-gx46-j682.json create mode 100644 advisories/unreviewed/2024/05/GHSA-grwp-8243-xpjh/GHSA-grwp-8243-xpjh.json create mode 100644 advisories/unreviewed/2024/05/GHSA-gx2j-3fvm-rqj3/GHSA-gx2j-3fvm-rqj3.json create mode 100644 advisories/unreviewed/2024/05/GHSA-h3hv-fpf3-c5jm/GHSA-h3hv-fpf3-c5jm.json create mode 100644 advisories/unreviewed/2024/05/GHSA-h423-6g7m-qpqq/GHSA-h423-6g7m-qpqq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-h6gr-4677-26p9/GHSA-h6gr-4677-26p9.json create mode 100644 advisories/unreviewed/2024/05/GHSA-h7hm-j4cr-jwhq/GHSA-h7hm-j4cr-jwhq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-h9p9-4f35-pxjm/GHSA-h9p9-4f35-pxjm.json create mode 100644 advisories/unreviewed/2024/05/GHSA-hf7w-m8fc-q8fp/GHSA-hf7w-m8fc-q8fp.json create mode 100644 advisories/unreviewed/2024/05/GHSA-hh94-frj2-pf9r/GHSA-hh94-frj2-pf9r.json create mode 100644 advisories/unreviewed/2024/05/GHSA-hjv5-8xv5-vmfp/GHSA-hjv5-8xv5-vmfp.json create mode 100644 advisories/unreviewed/2024/05/GHSA-hm5p-668j-x4q6/GHSA-hm5p-668j-x4q6.json create mode 100644 advisories/unreviewed/2024/05/GHSA-hq29-fr4v-2847/GHSA-hq29-fr4v-2847.json create mode 100644 advisories/unreviewed/2024/05/GHSA-hw2j-3fc3-hf74/GHSA-hw2j-3fc3-hf74.json create mode 100644 advisories/unreviewed/2024/05/GHSA-hxcf-7gwm-65p8/GHSA-hxcf-7gwm-65p8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-hxrw-3c72-p9hc/GHSA-hxrw-3c72-p9hc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-j2r5-7q65-9hjq/GHSA-j2r5-7q65-9hjq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-j469-qwv3-79fj/GHSA-j469-qwv3-79fj.json create mode 100644 advisories/unreviewed/2024/05/GHSA-j8cp-h624-v86v/GHSA-j8cp-h624-v86v.json create mode 100644 advisories/unreviewed/2024/05/GHSA-j8g9-5p8g-4f3x/GHSA-j8g9-5p8g-4f3x.json create mode 100644 advisories/unreviewed/2024/05/GHSA-j8hx-6rxw-p4r9/GHSA-j8hx-6rxw-p4r9.json create mode 100644 advisories/unreviewed/2024/05/GHSA-jhg5-q2mj-r9vh/GHSA-jhg5-q2mj-r9vh.json create mode 100644 advisories/unreviewed/2024/05/GHSA-jmm7-6r74-7f4p/GHSA-jmm7-6r74-7f4p.json create mode 100644 advisories/unreviewed/2024/05/GHSA-jpfh-4v99-5m27/GHSA-jpfh-4v99-5m27.json create mode 100644 advisories/unreviewed/2024/05/GHSA-jq29-8xm6-ccxq/GHSA-jq29-8xm6-ccxq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-jq6v-72pf-8j24/GHSA-jq6v-72pf-8j24.json create mode 100644 advisories/unreviewed/2024/05/GHSA-jqwg-pjjq-gqv5/GHSA-jqwg-pjjq-gqv5.json create mode 100644 advisories/unreviewed/2024/05/GHSA-jv5x-8v9f-frx2/GHSA-jv5x-8v9f-frx2.json create mode 100644 advisories/unreviewed/2024/05/GHSA-jwv9-vf83-vjmw/GHSA-jwv9-vf83-vjmw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-m2r9-3c4r-qv68/GHSA-m2r9-3c4r-qv68.json create mode 100644 advisories/unreviewed/2024/05/GHSA-m2xg-x7vq-c628/GHSA-m2xg-x7vq-c628.json create mode 100644 advisories/unreviewed/2024/05/GHSA-m9r6-94f7-4j6m/GHSA-m9r6-94f7-4j6m.json create mode 100644 advisories/unreviewed/2024/05/GHSA-mgmg-f25r-3gfh/GHSA-mgmg-f25r-3gfh.json create mode 100644 advisories/unreviewed/2024/05/GHSA-mjhg-c85c-62fv/GHSA-mjhg-c85c-62fv.json create mode 100644 advisories/unreviewed/2024/05/GHSA-mpm3-wjp6-8g7x/GHSA-mpm3-wjp6-8g7x.json create mode 100644 advisories/unreviewed/2024/05/GHSA-mrm7-vh23-g98v/GHSA-mrm7-vh23-g98v.json create mode 100644 advisories/unreviewed/2024/05/GHSA-mv9f-845w-2cgm/GHSA-mv9f-845w-2cgm.json create mode 100644 advisories/unreviewed/2024/05/GHSA-mxwx-46p7-hcm6/GHSA-mxwx-46p7-hcm6.json create mode 100644 advisories/unreviewed/2024/05/GHSA-p2qw-28x5-q4gw/GHSA-p2qw-28x5-q4gw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-p47x-q59q-2mpw/GHSA-p47x-q59q-2mpw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-p52g-5qgx-4crw/GHSA-p52g-5qgx-4crw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-p793-3f2h-38xw/GHSA-p793-3f2h-38xw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-pcr5-v468-562j/GHSA-pcr5-v468-562j.json create mode 100644 advisories/unreviewed/2024/05/GHSA-pcwf-v3ph-3p9v/GHSA-pcwf-v3ph-3p9v.json create mode 100644 advisories/unreviewed/2024/05/GHSA-pmmh-7pm7-hc62/GHSA-pmmh-7pm7-hc62.json create mode 100644 advisories/unreviewed/2024/05/GHSA-pmrx-2gv3-hv52/GHSA-pmrx-2gv3-hv52.json create mode 100644 advisories/unreviewed/2024/05/GHSA-ppm9-9qx2-3mjr/GHSA-ppm9-9qx2-3mjr.json create mode 100644 advisories/unreviewed/2024/05/GHSA-prq2-qj2r-jcgv/GHSA-prq2-qj2r-jcgv.json create mode 100644 advisories/unreviewed/2024/05/GHSA-pv65-xqrg-hc85/GHSA-pv65-xqrg-hc85.json create mode 100644 advisories/unreviewed/2024/05/GHSA-pwqm-5jrg-2v3g/GHSA-pwqm-5jrg-2v3g.json create mode 100644 advisories/unreviewed/2024/05/GHSA-px85-vjfw-cm92/GHSA-px85-vjfw-cm92.json create mode 100644 advisories/unreviewed/2024/05/GHSA-pxqq-3ph7-mw6w/GHSA-pxqq-3ph7-mw6w.json create mode 100644 advisories/unreviewed/2024/05/GHSA-q44p-8h6w-57m6/GHSA-q44p-8h6w-57m6.json create mode 100644 advisories/unreviewed/2024/05/GHSA-q77h-85v7-m3mw/GHSA-q77h-85v7-m3mw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qh8g-p933-67r9/GHSA-qh8g-p933-67r9.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qj4q-cgq8-w2m4/GHSA-qj4q-cgq8-w2m4.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qj68-9gpw-8pq2/GHSA-qj68-9gpw-8pq2.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qp63-w47q-g9vj/GHSA-qp63-w47q-g9vj.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qpf6-m6mq-hcmq/GHSA-qpf6-m6mq-hcmq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qqw5-j897-27cf/GHSA-qqw5-j897-27cf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qr6c-mgw3-xxq8/GHSA-qr6c-mgw3-xxq8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qvgm-cw57-rm8q/GHSA-qvgm-cw57-rm8q.json create mode 100644 advisories/unreviewed/2024/05/GHSA-qxvg-qh99-hg66/GHSA-qxvg-qh99-hg66.json create mode 100644 advisories/unreviewed/2024/05/GHSA-r2r3-fm28-9g3h/GHSA-r2r3-fm28-9g3h.json create mode 100644 advisories/unreviewed/2024/05/GHSA-rcjv-j3v6-r6cv/GHSA-rcjv-j3v6-r6cv.json create mode 100644 advisories/unreviewed/2024/05/GHSA-rgj4-j68m-986v/GHSA-rgj4-j68m-986v.json create mode 100644 advisories/unreviewed/2024/05/GHSA-rmqp-6x5x-g7fg/GHSA-rmqp-6x5x-g7fg.json create mode 100644 advisories/unreviewed/2024/05/GHSA-rr3f-v8j5-mmr6/GHSA-rr3f-v8j5-mmr6.json create mode 100644 advisories/unreviewed/2024/05/GHSA-rxcf-2w24-j9pq/GHSA-rxcf-2w24-j9pq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-v5r4-g8jp-rvxf/GHSA-v5r4-g8jp-rvxf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-v8p3-mfrc-9v8j/GHSA-v8p3-mfrc-9v8j.json create mode 100644 advisories/unreviewed/2024/05/GHSA-vp78-5x9p-m27h/GHSA-vp78-5x9p-m27h.json create mode 100644 advisories/unreviewed/2024/05/GHSA-vrx5-g53m-hhm7/GHSA-vrx5-g53m-hhm7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-w2mr-3frj-pxv2/GHSA-w2mr-3frj-pxv2.json create mode 100644 advisories/unreviewed/2024/05/GHSA-w5h4-c4xx-3r8p/GHSA-w5h4-c4xx-3r8p.json create mode 100644 advisories/unreviewed/2024/05/GHSA-w5h9-gvgr-jhpg/GHSA-w5h9-gvgr-jhpg.json create mode 100644 advisories/unreviewed/2024/05/GHSA-w7j7-m99g-gcgq/GHSA-w7j7-m99g-gcgq.json create mode 100644 advisories/unreviewed/2024/05/GHSA-w825-9xqr-f6q3/GHSA-w825-9xqr-f6q3.json create mode 100644 advisories/unreviewed/2024/05/GHSA-w883-jj58-rv96/GHSA-w883-jj58-rv96.json create mode 100644 advisories/unreviewed/2024/05/GHSA-w9cr-rpv2-57qv/GHSA-w9cr-rpv2-57qv.json create mode 100644 advisories/unreviewed/2024/05/GHSA-w9fp-75mc-76ff/GHSA-w9fp-75mc-76ff.json create mode 100644 advisories/unreviewed/2024/05/GHSA-wc9c-rv2v-442r/GHSA-wc9c-rv2v-442r.json create mode 100644 advisories/unreviewed/2024/05/GHSA-wf38-7v3f-5mjp/GHSA-wf38-7v3f-5mjp.json create mode 100644 advisories/unreviewed/2024/05/GHSA-wgwm-v825-xmjx/GHSA-wgwm-v825-xmjx.json create mode 100644 advisories/unreviewed/2024/05/GHSA-whrp-vxvh-9rj2/GHSA-whrp-vxvh-9rj2.json create mode 100644 advisories/unreviewed/2024/05/GHSA-wr5g-85mp-25c9/GHSA-wr5g-85mp-25c9.json create mode 100644 advisories/unreviewed/2024/05/GHSA-wr76-p7r7-8vjv/GHSA-wr76-p7r7-8vjv.json create mode 100644 advisories/unreviewed/2024/05/GHSA-wvfx-f2w6-5jrg/GHSA-wvfx-f2w6-5jrg.json create mode 100644 advisories/unreviewed/2024/05/GHSA-wxhc-3989-9jq8/GHSA-wxhc-3989-9jq8.json create mode 100644 advisories/unreviewed/2024/05/GHSA-x52v-qr6m-xx85/GHSA-x52v-qr6m-xx85.json create mode 100644 advisories/unreviewed/2024/05/GHSA-x56w-x8rv-273m/GHSA-x56w-x8rv-273m.json create mode 100644 advisories/unreviewed/2024/05/GHSA-x5fc-mwch-j73r/GHSA-x5fc-mwch-j73r.json create mode 100644 advisories/unreviewed/2024/05/GHSA-x6vg-gvf6-hmp9/GHSA-x6vg-gvf6-hmp9.json create mode 100644 advisories/unreviewed/2024/05/GHSA-x858-gx5h-mfp9/GHSA-x858-gx5h-mfp9.json create mode 100644 advisories/unreviewed/2024/05/GHSA-x95x-w6hq-mwxc/GHSA-x95x-w6hq-mwxc.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xchp-7x95-36g7/GHSA-xchp-7x95-36g7.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xj33-wwm4-p8mw/GHSA-xj33-wwm4-p8mw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xm9j-x4hp-v2x3/GHSA-xm9j-x4hp-v2x3.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xmfc-6x2r-fqv5/GHSA-xmfc-6x2r-fqv5.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xp4x-rp64-962g/GHSA-xp4x-rp64-962g.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xqq2-v4rf-49qr/GHSA-xqq2-v4rf-49qr.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xwrf-hhx9-vmhv/GHSA-xwrf-hhx9-vmhv.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xwvh-fxhh-3qrr/GHSA-xwvh-fxhh-3qrr.json diff --git a/advisories/unreviewed/2022/05/GHSA-5gqj-6vcf-6f45/GHSA-5gqj-6vcf-6f45.json b/advisories/unreviewed/2022/05/GHSA-5gqj-6vcf-6f45/GHSA-5gqj-6vcf-6f45.json index c52638b6bd5..045f8c00a6c 100644 --- a/advisories/unreviewed/2022/05/GHSA-5gqj-6vcf-6f45/GHSA-5gqj-6vcf-6f45.json +++ b/advisories/unreviewed/2022/05/GHSA-5gqj-6vcf-6f45/GHSA-5gqj-6vcf-6f45.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5gqj-6vcf-6f45", - "modified": "2022-05-24T17:45:27Z", + "modified": "2024-05-21T15:31:37Z", "published": "2022-05-24T17:45:27Z", "aliases": [ "CVE-2021-29098" ], "details": "Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2022/05/GHSA-7q9j-c58f-8cw5/GHSA-7q9j-c58f-8cw5.json b/advisories/unreviewed/2022/05/GHSA-7q9j-c58f-8cw5/GHSA-7q9j-c58f-8cw5.json index f1c12da7562..e16fb7fa726 100644 --- a/advisories/unreviewed/2022/05/GHSA-7q9j-c58f-8cw5/GHSA-7q9j-c58f-8cw5.json +++ b/advisories/unreviewed/2022/05/GHSA-7q9j-c58f-8cw5/GHSA-7q9j-c58f-8cw5.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-22" + "CWE-22", + "CWE-23" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/05/GHSA-8vhv-h63p-g472/GHSA-8vhv-h63p-g472.json b/advisories/unreviewed/2022/05/GHSA-8vhv-h63p-g472/GHSA-8vhv-h63p-g472.json index ff10171caeb..b3ff0556797 100644 --- a/advisories/unreviewed/2022/05/GHSA-8vhv-h63p-g472/GHSA-8vhv-h63p-g472.json +++ b/advisories/unreviewed/2022/05/GHSA-8vhv-h63p-g472/GHSA-8vhv-h63p-g472.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8vhv-h63p-g472", - "modified": "2022-05-24T17:45:27Z", + "modified": "2024-05-21T15:31:37Z", "published": "2022-05-24T17:45:27Z", "aliases": [ "CVE-2021-29096" diff --git a/advisories/unreviewed/2022/05/GHSA-wr7p-7f4r-37fr/GHSA-wr7p-7f4r-37fr.json b/advisories/unreviewed/2022/05/GHSA-wr7p-7f4r-37fr/GHSA-wr7p-7f4r-37fr.json index 8885959d671..8fd61dd2959 100644 --- a/advisories/unreviewed/2022/05/GHSA-wr7p-7f4r-37fr/GHSA-wr7p-7f4r-37fr.json +++ b/advisories/unreviewed/2022/05/GHSA-wr7p-7f4r-37fr/GHSA-wr7p-7f4r-37fr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wr7p-7f4r-37fr", - "modified": "2022-05-24T17:45:27Z", + "modified": "2024-05-21T15:31:37Z", "published": "2022-05-24T17:45:27Z", "aliases": [ "CVE-2021-29097" ], "details": "Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -57,7 +60,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-119" + "CWE-119", + "CWE-121" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/05/GHSA-2277-9x7j-58f3/GHSA-2277-9x7j-58f3.json b/advisories/unreviewed/2024/05/GHSA-2277-9x7j-58f3/GHSA-2277-9x7j-58f3.json new file mode 100644 index 00000000000..3845465dd57 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2277-9x7j-58f3/GHSA-2277-9x7j-58f3.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2277-9x7j-58f3", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47283" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet:sfc: fix non-freed irq in legacy irq mode\n\nSFC driver can be configured via modparam to work using MSI-X, MSI or\nlegacy IRQ interrupts. In the last one, the interrupt was not properly\nreleased on module remove.\n\nIt was not freed because the flag irqs_hooked was not set during\ninitialization in the case of using legacy IRQ.\n\nExample of (trimmed) trace during module remove without this fix:\n\nremove_proc_entry: removing non-empty directory 'irq/125', leaking at least '0000:3b:00.1'\nWARNING: CPU: 39 PID: 3658 at fs/proc/generic.c:715 remove_proc_entry+0x15c/0x170\n...trimmed...\nCall Trace:\n unregister_irq_proc+0xe3/0x100\n free_desc+0x29/0x70\n irq_free_descs+0x47/0x70\n mp_unmap_irq+0x58/0x60\n acpi_unregister_gsi_ioapic+0x2a/0x40\n acpi_pci_irq_disable+0x78/0xb0\n pci_disable_device+0xd1/0x100\n efx_pci_remove+0xa1/0x1e0 [sfc]\n pci_device_remove+0x38/0xa0\n __device_release_driver+0x177/0x230\n driver_detach+0xcb/0x110\n bus_remove_driver+0x58/0xd0\n pci_unregister_driver+0x2a/0xb0\n efx_exit_module+0x24/0xf40 [sfc]\n __do_sys_delete_module.constprop.0+0x171/0x280\n ? exit_to_user_mode_prepare+0x83/0x1d0\n do_syscall_64+0x3d/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f9f9385800b\n...trimmed...", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47283" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/81c4d1d83f88e15b26f4522a35cba6ffd8c5dfdd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d717c9135a3340ae62d1699484850bfb4112b0c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8f03eeb6e0a0a0b8d617ee0a4bce729e47130036" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-24r3-rx3r-wgvw/GHSA-24r3-rx3r-wgvw.json b/advisories/unreviewed/2024/05/GHSA-24r3-rx3r-wgvw/GHSA-24r3-rx3r-wgvw.json new file mode 100644 index 00000000000..a6b6312c495 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-24r3-rx3r-wgvw/GHSA-24r3-rx3r-wgvw.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-24r3-rx3r-wgvw", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2024-33528" + ], + "details": "A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33528" + }, + { + "type": "WEB", + "url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-27rv-f8p8-59gg/GHSA-27rv-f8p8-59gg.json b/advisories/unreviewed/2024/05/GHSA-27rv-f8p8-59gg/GHSA-27rv-f8p8-59gg.json new file mode 100644 index 00000000000..7dc5b2f56c8 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-27rv-f8p8-59gg/GHSA-27rv-f8p8-59gg.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-27rv-f8p8-59gg", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47366" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server\n\nAFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and\nLinux's afs client switches between them when talking to a non-YFS server\nif the read size, the file position or the sum of the two have the upper 32\nbits set of the 64-bit value.\n\nThis is a problem, however, since the file position and length fields of\nFS.FetchData are *signed* 32-bit values.\n\nFix this by capturing the capability bits obtained from the fileserver when\nit's sent an FS.GetCapabilities RPC, rather than just discarding them, and\nthen picking out the VICED_CAPABILITY_64BITFILES flag. This can then be\nused to decide whether to use FS.FetchData or FS.FetchData64 - and also\nFS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to\nswitch on the parameter values.\n\nThis capabilities flag could also be used to limit the maximum size of the\nfile, but all servers must be checked for that.\n\nNote that the issue does not exist with FS.StoreData - that uses *unsigned*\n32-bit values. It's also not a problem with Auristor servers as its\nYFS.FetchData64 op uses unsigned 64-bit values.\n\nThis can be tested by cloning a git repo through an OpenAFS client to an\nOpenAFS server and then doing \"git status\" on it from a Linux afs\nclient[1]. Provided the clone has a pack file that's in the 2G-4G range,\nthe git status will show errors like:\n\n\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\n\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\n\nThis can be observed in the server's FileLog with something like the\nfollowing appearing:\n\nSun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001\nSun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866\n...\nSun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5\n\nNote the file position of 18446744071815340032. This is the requested file\nposition sign-extended.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47366" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b537a3c21775075395af475dcc6ef212fcf29db8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e66fc460d6dcf85cf12288e133a081205aebcd97" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-28c9-mq9x-7pcr/GHSA-28c9-mq9x-7pcr.json b/advisories/unreviewed/2024/05/GHSA-28c9-mq9x-7pcr/GHSA-28c9-mq9x-7pcr.json new file mode 100644 index 00000000000..ad85f2bef0b --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-28c9-mq9x-7pcr/GHSA-28c9-mq9x-7pcr.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-28c9-mq9x-7pcr", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47296" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n\nvcpu_put is not called if the user copy fails. This can result in preempt\nnotifier corruption and crashes, among other issues.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47296" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-29rx-6chj-44xc/GHSA-29rx-6chj-44xc.json b/advisories/unreviewed/2024/05/GHSA-29rx-6chj-44xc/GHSA-29rx-6chj-44xc.json new file mode 100644 index 00000000000..fce375aef9f --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-29rx-6chj-44xc/GHSA-29rx-6chj-44xc.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-29rx-6chj-44xc", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47291" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions\n\nWhile running the self-tests on a KASAN enabled kernel, I observed a\nslab-out-of-bounds splat very similar to the one reported in\ncommit 821bbf79fe46 (\"ipv6: Fix KASAN: slab-out-of-bounds Read in\n fib6_nh_flush_exceptions\").\n\nWe additionally need to take care of fib6_metrics initialization\nfailure when the caller provides an nh.\n\nThe fix is similar, explicitly free the route instead of calling\nfib6_info_release on a half-initialized object.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47291" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/115784bcccf135c3a3548098153413d76f16aae0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/830251361425c5be044db4d826aaf304ea3d14c6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8fb4792f091e608a0a1d353dfdf07ef55a719db5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ce8fafb68051fba52546f8bbe8621f7641683680" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2cf6-4ffg-wwcf/GHSA-2cf6-4ffg-wwcf.json b/advisories/unreviewed/2024/05/GHSA-2cf6-4ffg-wwcf/GHSA-2cf6-4ffg-wwcf.json new file mode 100644 index 00000000000..9587610bbf8 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2cf6-4ffg-wwcf/GHSA-2cf6-4ffg-wwcf.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2cf6-4ffg-wwcf", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47395" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap\n\nLimit max values for vht mcs and nss in ieee80211_parse_tx_radiotap\nroutine in order to fix the following warning reported by syzbot:\n\nWARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_rate_set_vht include/net/mac80211.h:989 [inline]\nWARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244\nModules linked in:\nCPU: 0 PID: 10717 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:ieee80211_rate_set_vht include/net/mac80211.h:989 [inline]\nRIP: 0010:ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244\nRSP: 0018:ffffc9000186f3e8 EFLAGS: 00010216\nRAX: 0000000000000618 RBX: ffff88804ef76500 RCX: ffffc900143a5000\nRDX: 0000000000040000 RSI: ffffffff888f478e RDI: 0000000000000003\nRBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100\nR10: ffffffff888f46f9 R11: 0000000000000000 R12: 00000000fffffff8\nR13: ffff88804ef7653c R14: 0000000000000001 R15: 0000000000000004\nFS: 00007fbf5718f700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b2de23000 CR3: 000000006a671000 CR4: 00000000001506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600\nCall Trace:\n ieee80211_monitor_select_queue+0xa6/0x250 net/mac80211/iface.c:740\n netdev_core_pick_tx+0x169/0x2e0 net/core/dev.c:4089\n __dev_queue_xmit+0x6f9/0x3710 net/core/dev.c:4165\n __bpf_tx_skb net/core/filter.c:2114 [inline]\n __bpf_redirect_no_mac net/core/filter.c:2139 [inline]\n __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162\n ____bpf_clone_redirect net/core/filter.c:2429 [inline]\n bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401\n bpf_prog_eeb6f53a69e5c6a2+0x59/0x234\n bpf_dispatcher_nop_func include/linux/bpf.h:717 [inline]\n __bpf_prog_run include/linux/filter.h:624 [inline]\n bpf_prog_run include/linux/filter.h:631 [inline]\n bpf_test_run+0x381/0xa30 net/bpf/test_run.c:119\n bpf_prog_test_run_skb+0xb84/0x1ee0 net/bpf/test_run.c:663\n bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline]\n __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605\n __do_sys_bpf kernel/bpf/syscall.c:4691 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:4689 [inline]\n __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x4665f9", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47395" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1282bb00835ff79d2d9c023055d514df5b4de260" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/13cb6d826e0ac0d144b0d48191ff1a111d32f0c6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/76538c7b4df314bb937e44c5cb1782f37d47443c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/997ee230e4f5285cd98445c102d9033c7ec4814b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ab85997465b972d39d9747fc16311fa5773374b2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ce5f372f5f084ff51c285fc27b232f15a3d00f0b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e5bb852aa2ad963074f0ad73030dbc20a30853e3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2hh5-254v-jpf4/GHSA-2hh5-254v-jpf4.json b/advisories/unreviewed/2024/05/GHSA-2hh5-254v-jpf4/GHSA-2hh5-254v-jpf4.json new file mode 100644 index 00000000000..39733c70400 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2hh5-254v-jpf4/GHSA-2hh5-254v-jpf4.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2hh5-254v-jpf4", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47247" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free of encap entry in neigh update handler\n\nFunction mlx5e_rep_neigh_update() wasn't updated to accommodate rtnl lock\nremoval from TC filter update path and properly handle concurrent encap\nentry insertion/deletion which can lead to following use-after-free:\n\n [23827.464923] ==================================================================\n [23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635\n [23827.472251]\n [23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5\n [23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n [23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]\n [23827.476731] Call Trace:\n [23827.477260] dump_stack+0xbb/0x107\n [23827.477906] print_address_description.constprop.0+0x18/0x140\n [23827.478896] ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.479879] ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.480905] kasan_report.cold+0x7c/0xd8\n [23827.481701] ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.482744] kasan_check_range+0x145/0x1a0\n [23827.493112] mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.494054] ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core]\n [23827.495296] mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core]\n [23827.496338] ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core]\n [23827.497486] ? read_word_at_a_time+0xe/0x20\n [23827.498250] ? strscpy+0xa0/0x2a0\n [23827.498889] process_one_work+0x8ac/0x14e0\n [23827.499638] ? lockdep_hardirqs_on_prepare+0x400/0x400\n [23827.500537] ? pwq_dec_nr_in_flight+0x2c0/0x2c0\n [23827.501359] ? rwlock_bug.part.0+0x90/0x90\n [23827.502116] worker_thread+0x53b/0x1220\n [23827.502831] ? process_one_work+0x14e0/0x14e0\n [23827.503627] kthread+0x328/0x3f0\n [23827.504254] ? _raw_spin_unlock_irq+0x24/0x40\n [23827.505065] ? __kthread_bind_mask+0x90/0x90\n [23827.505912] ret_from_fork+0x1f/0x30\n [23827.506621]\n [23827.506987] Allocated by task 28248:\n [23827.507694] kasan_save_stack+0x1b/0x40\n [23827.508476] __kasan_kmalloc+0x7c/0x90\n [23827.509197] mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core]\n [23827.510194] mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core]\n [23827.511218] __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core]\n [23827.512234] mlx5e_configure_flower+0x191c/0x4870 [mlx5_core]\n [23827.513298] tc_setup_cb_add+0x1d5/0x420\n [23827.514023] fl_hw_replace_filter+0x382/0x6a0 [cls_flower]\n [23827.514975] fl_change+0x2ceb/0x4a51 [cls_flower]\n [23827.515821] tc_new_tfilter+0x89a/0x2070\n [23827.516548] rtnetlink_rcv_msg+0x644/0x8c0\n [23827.517300] netlink_rcv_skb+0x11d/0x340\n [23827.518021] netlink_unicast+0x42b/0x700\n [23827.518742] netlink_sendmsg+0x743/0xc20\n [23827.519467] sock_sendmsg+0xb2/0xe0\n [23827.520131] ____sys_sendmsg+0x590/0x770\n [23827.520851] ___sys_sendmsg+0xd8/0x160\n [23827.521552] __sys_sendmsg+0xb7/0x140\n [23827.522238] do_syscall_64+0x3a/0x70\n [23827.522907] entry_SYSCALL_64_after_hwframe+0x44/0xae\n [23827.523797]\n [23827.524163] Freed by task 25948:\n [23827.524780] kasan_save_stack+0x1b/0x40\n [23827.525488] kasan_set_track+0x1c/0x30\n [23827.526187] kasan_set_free_info+0x20/0x30\n [23827.526968] __kasan_slab_free+0xed/0x130\n [23827.527709] slab_free_freelist_hook+0xcf/0x1d0\n [23827.528528] kmem_cache_free_bulk+0x33a/0x6e0\n [23827.529317] kfree_rcu_work+0x55f/0xb70\n [23827.530024] process_one_work+0x8ac/0x14e0\n [23827.530770] worker_thread+0x53b/0x1220\n [23827.531480] kthread+0x328/0x3f0\n [23827.532114] ret_from_fork+0x1f/0x30\n [23827.532785]\n [23827.533147] Last potentially related work creation:\n [23827.534007] kasan_save_stack+0x1b/0x40\n [23827.534710] kasan_record_aux_stack+0xab/0xc0\n [23827.535492] kvfree_call_rcu+0x31/0x7b0\n [23827.536206] mlx5e_tc_del\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47247" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b6447b72aca571632e71bb73a797118d5ce46a93" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fb1a3132ee1ac968316e45d21a48703a6db0b6c3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2hq2-46wf-3mhv/GHSA-2hq2-46wf-3mhv.json b/advisories/unreviewed/2024/05/GHSA-2hq2-46wf-3mhv/GHSA-2hq2-46wf-3mhv.json new file mode 100644 index 00000000000..cf6e6ec54c4 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2hq2-46wf-3mhv/GHSA-2hq2-46wf-3mhv.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2hq2-46wf-3mhv", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47311" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qcom/emac: fix UAF in emac_remove\n\nadpt is netdev private data and it cannot be\nused after free_netdev() call. Using adpt after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47311" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/11e9d163d631198bb3eb41a677a61b499516c0f7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2b70ca92847c619d6264c7372ef74fcbfd1e048c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4d04a42b926e682140776e54188f4a44f1f01a81" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8a225a6e07a57a1538d53637cb3d82bd3e477839" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ad297cd2db8953e2202970e9504cab247b6c7cb4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b1e091331920f8fbfc747dcbd16263fcd71abb2d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b560521eca03d0a2db6093a5a632cbdd0a0cf833" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2jpv-mgvf-9659/GHSA-2jpv-mgvf-9659.json b/advisories/unreviewed/2024/05/GHSA-2jpv-mgvf-9659/GHSA-2jpv-mgvf-9659.json new file mode 100644 index 00000000000..695784b33fd --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2jpv-mgvf-9659/GHSA-2jpv-mgvf-9659.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2jpv-mgvf-9659", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47351" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix races between xattr_{set|get} and listxattr operations\n\nUBIFS may occur some problems with concurrent xattr_{set|get} and\nlistxattr operations, such as assertion failure, memory corruption,\nstale xattr value[1].\n\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\noperations on xattr, concurrent read operations are still effective,\njust like ext4.\n\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47351" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/38dde03eb239605f428f3f1e4baa73d4933a4cc6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7adc05b73d91a5e3d4ca7714fa53ad9b70c53d08" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9558612cb829f2c022b788f55d6b8437d5234a82" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c0756f75c22149d20fcb7d8409827cee905eb386" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f4e3634a3b642225a530c292fdb1e8a4007507f5" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2p2c-qgqr-9ghc/GHSA-2p2c-qgqr-9ghc.json b/advisories/unreviewed/2024/05/GHSA-2p2c-qgqr-9ghc/GHSA-2p2c-qgqr-9ghc.json new file mode 100644 index 00000000000..c7703981f62 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2p2c-qgqr-9ghc/GHSA-2p2c-qgqr-9ghc.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2p2c-qgqr-9ghc", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47317" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/bpf: Fix detecting BPF atomic instructions\n\nCommit 91c960b0056672 (\"bpf: Rename BPF_XADD and prepare to encode other\natomics in .imm\") converted BPF_XADD to BPF_ATOMIC and added a way to\ndistinguish instructions based on the immediate field. Existing JIT\nimplementations were updated to check for the immediate field and to\nreject programs utilizing anything more than BPF_ADD (such as BPF_FETCH)\nin the immediate field.\n\nHowever, the check added to powerpc64 JIT did not look at the correct\nBPF instruction. Due to this, such programs would be accepted and\nincorrectly JIT'ed resulting in soft lockups, as seen with the atomic\nbounds test. Fix this by looking at the correct immediate value.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47317" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0d435b6d94b05dcfd836d758a63145aa566618e2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/419ac821766cbdb9fd85872bb3f1a589df05c94c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7284dab07e4d51d453cc42851fae9ec4fac6ef2f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2pp7-rwqg-2gcx/GHSA-2pp7-rwqg-2gcx.json b/advisories/unreviewed/2024/05/GHSA-2pp7-rwqg-2gcx/GHSA-2pp7-rwqg-2gcx.json new file mode 100644 index 00000000000..b2e1636cd22 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2pp7-rwqg-2gcx/GHSA-2pp7-rwqg-2gcx.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2pp7-rwqg-2gcx", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47409" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47409" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2754fa3b73df7d0ae042f3ed6cfd9df9042f6262" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/337f00a0bc62d7cb7d10ec0b872c79009a1641df" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4b7f4a0eb92bf37bea4cd838c7f83ea42823ca8b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/856e6e8e0f9300befa87dde09edb578555c99a82" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8b9c1c33e51d0959f2aec573dfbac0ffd3f5c0b7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a7182993dd8e09f96839ddc3ac54f9b37370d282" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2qgr-37h8-x3w9/GHSA-2qgr-37h8-x3w9.json b/advisories/unreviewed/2024/05/GHSA-2qgr-37h8-x3w9/GHSA-2qgr-37h8-x3w9.json new file mode 100644 index 00000000000..0ad547be1f1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2qgr-37h8-x3w9/GHSA-2qgr-37h8-x3w9.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2qgr-37h8-x3w9", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47260" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a potential NULL dereference in nfs_get_client()\n\nNone of the callers are expecting NULL returns from nfs_get_client() so\nthis code will lead to an Oops. It's better to return an error\npointer. I expect that this is dead code so hopefully no one is\naffected.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47260" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0057ecef9f324007c0ba5fcca4ddd131178ce78b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/09226e8303beeec10f2ff844d2e46d1371dc58e0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/279ad78a00f8b9c5ff24171a59297187a3bd44b7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4b380a7d84ef2ce3f4f5bec5d8706ed937ac6502" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/58ddf61f10b8f9b7b1341644bfee2f1c6508d4e1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/634f17ff1d59905eb3b4bbbc00805961d08beaee" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a979e601000982a3ca693171a6d4dffc47f8ad00" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fab8bfdfb4aac9e4e8363666333adfdf21e89106" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2v26-28rg-whvc/GHSA-2v26-28rg-whvc.json b/advisories/unreviewed/2024/05/GHSA-2v26-28rg-whvc/GHSA-2v26-28rg-whvc.json new file mode 100644 index 00000000000..d299f4d8418 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2v26-28rg-whvc/GHSA-2v26-28rg-whvc.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2v26-28rg-whvc", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47385" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47385" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0f36b88173f028e372668ae040ab1a496834d278" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1499bb2c3a87a2efea0065adab2bd66badee61c3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/200ced5ba724d8bbf29dfac4ed1e17a39ccaccd1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/24af1fe376e22c42238a4a604d31e46c486876c3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2v93-g9j3-9q9h/GHSA-2v93-g9j3-9q9h.json b/advisories/unreviewed/2024/05/GHSA-2v93-g9j3-9q9h/GHSA-2v93-g9j3-9q9h.json new file mode 100644 index 00000000000..b834904cbc1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2v93-g9j3-9q9h/GHSA-2v93-g9j3-9q9h.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2v93-g9j3-9q9h", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47261" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix initializing CQ fragments buffer\n\nThe function init_cq_frag_buf() can be called to initialize the current CQ\nfragments buffer cq->buf, or the temporary cq->resize_buf that is filled\nduring CQ resize operation.\n\nHowever, the offending commit started to use function get_cqe() for\ngetting the CQEs, the issue with this change is that get_cqe() always\nreturns CQEs from cq->buf, which leads us to initialize the wrong buffer,\nand in case of enlarging the CQ we try to access elements beyond the size\nof the current cq->buf and eventually hit a kernel panic.\n\n [exception RIP: init_cq_frag_buf+103]\n [ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib]\n [ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core]\n [ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt]\n [ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt]\n [ffff9f799ddcbe98] llt_rdma_client_conn_thread at ffffffffc0a6bb75 [llt]\n [ffff9f799ddcbec8] kthread at ffffffffa66c5da1\n [ffff9f799ddcbf50] ret_from_fork_nospec_begin at ffffffffa6d95ddd\n\nFix it by getting the needed CQE by calling mlx5_frag_buf_get_wqe() that\ntakes the correct source buffer as a parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47261" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1ec2dcd680c71d0d36fa25638b327a468babd5c9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2ba0aa2feebda680ecfc3c552e867cf4d1b05a3a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3e670c54eda238cb8a1ea93538a79ae89285c1c4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/91f7fdc4cc10542ca1045c06aad23365f0d067e0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e3ecd9c09fcc10cf6b2bc67e2990c397c40a8c26" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2wcp-6fq9-mcr6/GHSA-2wcp-6fq9-mcr6.json b/advisories/unreviewed/2024/05/GHSA-2wcp-6fq9-mcr6/GHSA-2wcp-6fq9-mcr6.json new file mode 100644 index 00000000000..18d9d4d3407 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-2wcp-6fq9-mcr6/GHSA-2wcp-6fq9-mcr6.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2wcp-6fq9-mcr6", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47386" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignment]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47386" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/16887ae4e3defd2c4e7913b6c539f33eaf4eac5c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/44d3c480e4e2a75bf6296a18b4356157991ccd80" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/516d9055039017a20a698103be2b556b4c976bb8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/943c15ac1b84d378da26bba41c83c67e16499ac4" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-335x-9j96-mxcr/GHSA-335x-9j96-mxcr.json b/advisories/unreviewed/2024/05/GHSA-335x-9j96-mxcr/GHSA-335x-9j96-mxcr.json new file mode 100644 index 00000000000..4f97bbc75c4 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-335x-9j96-mxcr/GHSA-335x-9j96-mxcr.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-335x-9j96-mxcr", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47374" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: prevent an error message from causing runtime problems\n\nFor some drivers, that use the DMA API. This error message can be reached\nseveral millions of times per second, causing spam to the kernel's printk\nbuffer and bringing the CPU usage up to 100% (so, it should be rate\nlimited). However, since there is at least one driver that is in the\nmainline and suffers from the error condition, it is more useful to\nerr_printk() here instead of just rate limiting the error message (in hopes\nthat it will make it easier for other drivers that suffer from this issue\nto be spotted).", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47374" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/510e1a724ab1bf38150be2c1acabb303f98d0047" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/de4afec2d2946c92c62a15ab341c70b287289e6a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-33w7-r9c3-9qwq/GHSA-33w7-r9c3-9qwq.json b/advisories/unreviewed/2024/05/GHSA-33w7-r9c3-9qwq/GHSA-33w7-r9c3-9qwq.json new file mode 100644 index 00000000000..3b44b4dcddc --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-33w7-r9c3-9qwq/GHSA-33w7-r9c3-9qwq.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-33w7-r9c3-9qwq", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47257" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: fix null deref in parse dev addr\n\nFix a logic error that could result in a null deref if the user sets\nthe mode incorrectly for the given addr type.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47257" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1f95741981c899c4724647291fec5faa3c777185" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5f728ec65485625e30f46e5b4917ff023ad29ea0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9fdd04918a452980631ecc499317881c1d120b70" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c6998ccfefa652bac3f9b236821e392af43efa1e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c7836de2cadd88bc2f20f2c5a3d4ef4c73aef627" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d0f47648b87b6d5f204cb7f3cbce6d36dab85a67" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fdd51e34f45311ab6e48d2147cbc2904731b9993" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-39gw-mq6q-79fw/GHSA-39gw-mq6q-79fw.json b/advisories/unreviewed/2024/05/GHSA-39gw-mq6q-79fw/GHSA-39gw-mq6q-79fw.json new file mode 100644 index 00000000000..0104cac4e1f --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-39gw-mq6q-79fw/GHSA-39gw-mq6q-79fw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-39gw-mq6q-79fw", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47279" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: brcmstb-usb-pinmap: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47279" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2147684be1ebdaf845783139b9bc4eba3fecd9e4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fbf649cd6d64d40c03c5397ecd6b1ae922ba7afc" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3c4w-p6cr-wgq6/GHSA-3c4w-p6cr-wgq6.json b/advisories/unreviewed/2024/05/GHSA-3c4w-p6cr-wgq6/GHSA-3c4w-p6cr-wgq6.json new file mode 100644 index 00000000000..b75b3469885 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3c4w-p6cr-wgq6/GHSA-3c4w-p6cr-wgq6.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3c4w-p6cr-wgq6", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47221" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: actually fix freelist pointer vs redzoning\n\nIt turns out that SLUB redzoning (\"slub_debug=Z\") checks from\ns->object_size rather than from s->inuse (which is normally bumped to\nmake room for the freelist pointer), so a cache created with an object\nsize less than 24 would have the freelist pointer written beyond\ns->object_size, causing the redzone to be corrupted by the freelist\npointer. This was very visible with \"slub_debug=ZF\":\n\n BUG test (Tainted: G B ): Right Redzone overwritten\n -----------------------------------------------------------------------------\n\n INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb\n INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200\n INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620\n\n Redzone (____ptrval____): bb bb bb bb bb bb bb bb ........\n Object (____ptrval____): 00 00 00 00 00 f6 f4 a5 ........\n Redzone (____ptrval____): 40 1d e8 1a aa @....\n Padding (____ptrval____): 00 00 00 00 00 00 00 00 ........\n\nAdjust the offset to stay within s->object_size.\n\n(Note that no caches of in this size range are known to exist in the\nkernel currently.)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47221" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ce6e8bee7a3883e8008b30f5887dbb426aac6a35" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e41a49fadbc80b60b48d3c095d9e2ee7ef7c9a8e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f6ed2357541612a13a5841b3af4dc32ed984a25f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3gcc-j58h-xmv8/GHSA-3gcc-j58h-xmv8.json b/advisories/unreviewed/2024/05/GHSA-3gcc-j58h-xmv8/GHSA-3gcc-j58h-xmv8.json new file mode 100644 index 00000000000..8911dc025bd --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3gcc-j58h-xmv8/GHSA-3gcc-j58h-xmv8.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3gcc-j58h-xmv8", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47347" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwl1251: Fix possible buffer overflow in wl1251_cmd_scan\n\nFunction wl1251_cmd_scan calls memcpy without checking the length.\nHarden by checking the length is within the maximum allowed size.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47347" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0f6c0488368c9ac1aa685821916fadba32f5d1ef" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/115103f6e3f1c26c473766c16439c7c8b235529a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/302e2ee34c5f7c5d805b7f835d9a6f2b43474e2a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/40af3960a15339e8bbd3be50c3bc7b35e1a0b6ea" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/57ad99ae3c6738ba87bad259bb57c641ca68ebf6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c5e4a10d7bd5d4f419d8b9705dff60cf69b302a1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d10a87a3535cce2b890897914f5d0d83df669c63" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d3d8b9c9c7843dce31e284927d4c9904fd5a510a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d71dddeb5380613f9ef199f3e7368fd78fb1a46e" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3hw4-pvhh-9qcq/GHSA-3hw4-pvhh-9qcq.json b/advisories/unreviewed/2024/05/GHSA-3hw4-pvhh-9qcq/GHSA-3hw4-pvhh-9qcq.json new file mode 100644 index 00000000000..c2b2246f377 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3hw4-pvhh-9qcq/GHSA-3hw4-pvhh-9qcq.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3hw4-pvhh-9qcq", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47346" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()\n\ncommit 6f755e85c332 (\"coresight: Add helper for inserting synchronization\npackets\") removed trailing '\\0' from barrier_pkt array and updated the\ncall sites like etb_update_buffer() to have proper checks for barrier_pkt\nsize before read but missed updating tmc_update_etf_buffer() which still\nreads barrier_pkt past the array size resulting in KASAN out-of-bounds\nbug. Fix this by adding a check for barrier_pkt size before accessing\nlike it is done in etb_update_buffer().\n\n BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698\n Read of size 4 at addr ffffffd05b7d1030 by task perf/2629\n\n Call trace:\n dump_backtrace+0x0/0x27c\n show_stack+0x20/0x2c\n dump_stack+0x11c/0x188\n print_address_description+0x3c/0x4a4\n __kasan_report+0x140/0x164\n kasan_report+0x10/0x18\n __asan_report_load4_noabort+0x1c/0x24\n tmc_update_etf_buffer+0x4b8/0x698\n etm_event_stop+0x248/0x2d8\n etm_event_del+0x20/0x2c\n event_sched_out+0x214/0x6f0\n group_sched_out+0xd0/0x270\n ctx_sched_out+0x2ec/0x518\n __perf_event_task_sched_out+0x4fc/0xe6c\n __schedule+0x1094/0x16a0\n preempt_schedule_irq+0x88/0x170\n arm64_preempt_schedule_irq+0xf0/0x18c\n el1_irq+0xe8/0x180\n perf_event_exec+0x4d8/0x56c\n setup_new_exec+0x204/0x400\n load_elf_binary+0x72c/0x18c0\n search_binary_handler+0x13c/0x420\n load_script+0x500/0x6c4\n search_binary_handler+0x13c/0x420\n exec_binprm+0x118/0x654\n __do_execve_file+0x77c/0xba4\n __arm64_compat_sys_execve+0x98/0xac\n el0_svc_common+0x1f8/0x5e0\n el0_svc_compat_handler+0x84/0xb0\n el0_svc_compat+0x10/0x50\n\n The buggy address belongs to the variable:\n barrier_pkt+0x10/0x40\n\n Memory state around the buggy address:\n ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00\n ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03\n ^\n ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa\n ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa\n ==================================================================", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47346" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0115687be7b13993066aef602253a53d55f5b11f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/04bd77ef4f4d9fc6102023b85f4590fc2130aac5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/35c1c4bd2d59ad734129d4e232af9d1098023918" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5fae8a946ac2df879caf3f79a193d4766d00239b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/733d4d95c0101d5f277b8e4910411d016e49a9dc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ef0a06acc6b16388640ad367eedfa2a17f1945db" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3p2v-4qj8-6w5f/GHSA-3p2v-4qj8-6w5f.json b/advisories/unreviewed/2024/05/GHSA-3p2v-4qj8-6w5f/GHSA-3p2v-4qj8-6w5f.json new file mode 100644 index 00000000000..aaa109ac5d4 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3p2v-4qj8-6w5f/GHSA-3p2v-4qj8-6w5f.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3p2v-4qj8-6w5f", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47339" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-core: explicitly clear ioctl input data\n\nAs seen from a recent syzbot bug report, mistakes in the compat ioctl\nimplementation can lead to uninitialized kernel stack data getting used\nas input for driver ioctl handlers.\n\nThe reported bug is now fixed, but it's possible that other related\nbugs are still present or get added in the future. As the drivers need\nto check user input already, the possible impact is fairly low, but it\nmight still cause an information leak.\n\nTo be on the safe side, always clear the entire ioctl buffer before\ncalling the conversion handler functions that are meant to initialize\nthem.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47339" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7b53cca764f9b291b7907fcd39d9e66ad728ee0b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bfb48b54db25c3b4ef4bef5e0691464ebc4aa335" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dc02c0b2bd6096f2f3ce63e1fc317aeda05f74d8" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3qvj-8qwq-5jxj/GHSA-3qvj-8qwq-5jxj.json b/advisories/unreviewed/2024/05/GHSA-3qvj-8qwq-5jxj/GHSA-3qvj-8qwq-5jxj.json new file mode 100644 index 00000000000..fefd38aaafb --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3qvj-8qwq-5jxj/GHSA-3qvj-8qwq-5jxj.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3qvj-8qwq-5jxj", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47330" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: 8250: serial_cs: Fix a memory leak in error handling path\n\nIn the probe function, if the final 'serial_config()' fails, 'info' is\nleaking.\n\nAdd a resource handling path to free this memory.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47330" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/331f5923fce4f45b8170ccf06c529e8eb28f37bc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/34f4590f5ec9859ea9136249f528173d150bd584" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7a80f71601af015856a0aeb1e3c294037ac3dd32" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b2ef1f5de40342de44fc5355321595f91774dab5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b5a2799cd62ed30c81b22c23028d9ee374e2138c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c39cf4df19acf0133fa284a8cd83fad42cd13cc2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cddee5c287e26f6b2ba5c0ffdfc3a846f2f10461" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ee16bed959862a6de2913f71a04cb563d7237b67" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fad92b11047a748c996ebd6cfb164a63814eeb2e" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3vpw-pw66-4mjh/GHSA-3vpw-pw66-4mjh.json b/advisories/unreviewed/2024/05/GHSA-3vpw-pw66-4mjh/GHSA-3vpw-pw66-4mjh.json new file mode 100644 index 00000000000..9794a9b8626 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3vpw-pw66-4mjh/GHSA-3vpw-pw66-4mjh.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3vpw-pw66-4mjh", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47392" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure\n\nIf cma_listen_on_all() fails it leaves the per-device ID still on the\nlisten_list but the state is not set to RDMA_CM_ADDR_BOUND.\n\nWhen the cmid is eventually destroyed cma_cancel_listens() is not called\ndue to the wrong state, however the per-device IDs are still holding the\nrefcount preventing the ID from being destroyed, thus deadlocking:\n\n task:rping state:D stack: 0 pid:19605 ppid: 47036 flags:0x00000084\n Call Trace:\n __schedule+0x29a/0x780\n ? free_unref_page_commit+0x9b/0x110\n schedule+0x3c/0xa0\n schedule_timeout+0x215/0x2b0\n ? __flush_work+0x19e/0x1e0\n wait_for_completion+0x8d/0xf0\n _destroy_id+0x144/0x210 [rdma_cm]\n ucma_close_id+0x2b/0x40 [rdma_ucm]\n __destroy_id+0x93/0x2c0 [rdma_ucm]\n ? __xa_erase+0x4a/0xa0\n ucma_destroy_id+0x9a/0x120 [rdma_ucm]\n ucma_write+0xb8/0x130 [rdma_ucm]\n vfs_write+0xb4/0x250\n ksys_write+0xb5/0xd0\n ? syscall_trace_enter.isra.19+0x123/0x190\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nEnsure that cma_listen_on_all() atomically unwinds its action under the\nlock during error.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47392" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3f4e68902d2e545033c80d7ad62fd9a439e573f4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ca465e1f1f9b38fe916a36f7d80c5d25f2337c81" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e56a5146ef8cb51cd7c9e748267dce7564448a35" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3w59-vx6f-4274/GHSA-3w59-vx6f-4274.json b/advisories/unreviewed/2024/05/GHSA-3w59-vx6f-4274/GHSA-3w59-vx6f-4274.json new file mode 100644 index 00000000000..0ad7f3ea455 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3w59-vx6f-4274/GHSA-3w59-vx6f-4274.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3w59-vx6f-4274", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47236" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cdc_eem: fix tx fixup skb leak\n\nwhen usbnet transmit a skb, eem fixup it in eem_tx_fixup(),\nif skb_copy_expand() failed, it return NULL,\nusbnet_start_xmit() will have no chance to free original skb.\n\nfix it by free orginal skb in eem_tx_fixup() first,\nthen check skb clone status, if failed, return NULL to usbnet.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47236" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/05b2b9f7d24b5663d9b47427fe1555bdafd3ea02" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/14184ec5c958b589ba934da7363a2877879204df" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1bcacd6088d61c0ac6a990d87975600a81f3247e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/81de2ed06df8b5451e050fe6a318af3263dbff3f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b4f7a9fc9d094c0c4a66f2ad7c37b1dbe9e78f88" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f12554b0ff639e74612cc01b3b4a049e098d2d65" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f4e6a7f19c82f39b1803e91c54718f0d7143767d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3wh6-h4gj-wjr7/GHSA-3wh6-h4gj-wjr7.json b/advisories/unreviewed/2024/05/GHSA-3wh6-h4gj-wjr7/GHSA-3wh6-h4gj-wjr7.json new file mode 100644 index 00000000000..995aeef4b98 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3wh6-h4gj-wjr7/GHSA-3wh6-h4gj-wjr7.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wh6-h4gj-wjr7", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47282" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: bcm2835: Fix out-of-bounds access with more than 4 slaves\n\nCommit 571e31fa60b3 (\"spi: bcm2835: Cache CS register value for\n->prepare_message()\") limited the number of slaves to 3 at compile-time.\nThe limitation was necessitated by a statically-sized array prepare_cs[]\nin the driver private data which contains a per-slave register value.\n\nThe commit sought to enforce the limitation at run-time by setting the\ncontroller's num_chipselect to 3: Slaves with a higher chipselect are\nrejected by spi_add_device().\n\nHowever the commit neglected that num_chipselect only limits the number\nof *native* chipselects. If GPIO chipselects are specified in the\ndevice tree for more than 3 slaves, num_chipselect is silently raised by\nof_spi_get_gpio_numbers() and the result are out-of-bounds accesses to\nthe statically-sized array prepare_cs[].\n\nAs a bandaid fix which is backportable to stable, raise the number of\nallowed slaves to 24 (which \"ought to be enough for anybody\"), enforce\nthe limitation on slave ->setup and revert num_chipselect to 3 (which is\nthe number of native chipselects supported by the controller).\nAn upcoming for-next commit will allow an arbitrary number of slaves.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47282" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/01415ff85a24308059e06ca3e97fd7bf75648690" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/13817d466eb8713a1ffd254f537402f091d48444" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/82a8ffba54d31e97582051cb56ba1f988018681e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b5502580cf958b094f3b69dfe4eece90eae01fbc" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-3whv-3wrh-jjqq/GHSA-3whv-3wrh-jjqq.json b/advisories/unreviewed/2024/05/GHSA-3whv-3wrh-jjqq/GHSA-3whv-3wrh-jjqq.json new file mode 100644 index 00000000000..c0048ee8132 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3whv-3wrh-jjqq/GHSA-3whv-3wrh-jjqq.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3whv-3wrh-jjqq", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47328" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi: Fix conn use after free during resets\n\nIf we haven't done a unbind target call we can race where\niscsi_conn_teardown wakes up the EH thread and then frees the conn while\nthose threads are still accessing the conn ehwait.\n\nWe can only do one TMF per session so this just moves the TMF fields from\nthe conn to the session. We can then rely on the\niscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call\nto remove the target and it's devices, and know after that point there is\nno device or scsi-ml callout trying to access the session.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47328" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/89812e7957ab0746eab66ed6fc49d52bb4dca250" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bf20d85a88384574fabb3d53ad62a8af57e7ab11" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d04958a348e560938410e04a12fb99da9c7e6a00" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ec29d0ac29be366450a7faffbcf8cba3a6a3b506" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f0a031f7c55ffd944fead1ddaf2aa94df9a158c1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fa9542b35ceb4202e8f8d65f440529a63524dca9" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-47p2-vwpg-v462/GHSA-47p2-vwpg-v462.json b/advisories/unreviewed/2024/05/GHSA-47p2-vwpg-v462/GHSA-47p2-vwpg-v462.json new file mode 100644 index 00000000000..5741d7fa4fa --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-47p2-vwpg-v462/GHSA-47p2-vwpg-v462.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-47p2-vwpg-v462", + "modified": "2024-05-21T15:31:38Z", + "published": "2024-05-21T15:31:38Z", + "aliases": [ + "CVE-2024-35385" + ], + "details": "An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35385" + }, + { + "type": "WEB", + "url": "https://github.com/cesanta/mjs/issues/288" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T14:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-482h-984g-m9qw/GHSA-482h-984g-m9qw.json b/advisories/unreviewed/2024/05/GHSA-482h-984g-m9qw/GHSA-482h-984g-m9qw.json new file mode 100644 index 00000000000..627b524f563 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-482h-984g-m9qw/GHSA-482h-984g-m9qw.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-482h-984g-m9qw", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47298" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix potential memory leak on unlikely error case\n\nIf skb_linearize is needed and fails we could leak a msg on the error\nhandling. To fix ensure we kfree the msg block before returning error.\nFound during code review.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47298" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6c508a1c6c62793dc6e6872cad4b200097bab7c9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/715f378f42909c401ec043f5150c4fdf57fb8889" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7e6b27a69167f97c56b5437871d29e9722c3e470" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-4fxc-v2fq-wgmf/GHSA-4fxc-v2fq-wgmf.json b/advisories/unreviewed/2024/05/GHSA-4fxc-v2fq-wgmf/GHSA-4fxc-v2fq-wgmf.json new file mode 100644 index 00000000000..cac70990b2f --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-4fxc-v2fq-wgmf/GHSA-4fxc-v2fq-wgmf.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4fxc-v2fq-wgmf", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47417" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Fix memory leak in strset\n\nFree struct strset itself, not just its internal parts.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47417" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9e8e7504e09831c469b67d6dc11d9a72654bdb8c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b0e875bac0fab3e7a7431c2eee36a8ccc0c712ac" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-4gxv-hggr-2473/GHSA-4gxv-hggr-2473.json b/advisories/unreviewed/2024/05/GHSA-4gxv-hggr-2473/GHSA-4gxv-hggr-2473.json new file mode 100644 index 00000000000..93cdc4740be --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-4gxv-hggr-2473/GHSA-4gxv-hggr-2473.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4gxv-hggr-2473", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47408" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: serialize hash resizes and cleanups\n\nSyzbot was able to trigger the following warning [1]\n\nNo repro found by syzbot yet but I was able to trigger similar issue\nby having 2 scripts running in parallel, changing conntrack hash sizes,\nand:\n\nfor j in `seq 1 1000` ; do unshare -n /bin/true >/dev/null ; done\n\nIt would take more than 5 minutes for net_namespace structures\nto be cleaned up.\n\nThis is because nf_ct_iterate_cleanup() has to restart everytime\na resize happened.\n\nBy adding a mutex, we can serialize hash resizes and cleanups\nand also make get_next_corpse() faster by skipping over empty\nbuckets.\n\nEven without resizes in the picture, this patch considerably\nspeeds up network namespace dismantles.\n\n[1]\nINFO: task syz-executor.0:8312 can't die for more than 144 seconds.\ntask:syz-executor.0 state:R running task stack:25672 pid: 8312 ppid: 6573 flags:0x00004006\nCall Trace:\n context_switch kernel/sched/core.c:4955 [inline]\n __schedule+0x940/0x26f0 kernel/sched/core.c:6236\n preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6408\n preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35\n __local_bh_enable_ip+0x109/0x120 kernel/softirq.c:390\n local_bh_enable include/linux/bottom_half.h:32 [inline]\n get_next_corpse net/netfilter/nf_conntrack_core.c:2252 [inline]\n nf_ct_iterate_cleanup+0x15a/0x450 net/netfilter/nf_conntrack_core.c:2275\n nf_conntrack_cleanup_net_list+0x14c/0x4f0 net/netfilter/nf_conntrack_core.c:2469\n ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171\n setup_net+0x639/0xa30 net/core/net_namespace.c:349\n copy_net_ns+0x319/0x760 net/core/net_namespace.c:470\n create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110\n unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226\n ksys_unshare+0x445/0x920 kernel/fork.c:3128\n __do_sys_unshare kernel/fork.c:3202 [inline]\n __se_sys_unshare kernel/fork.c:3200 [inline]\n __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3200\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f63da68e739\nRSP: 002b:00007f63d7c05188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110\nRAX: ffffffffffffffda RBX: 00007f63da792f80 RCX: 00007f63da68e739\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000\nRBP: 00007f63da6e8cc4 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007f63da792f80\nR13: 00007fff50b75d3f R14: 00007f63d7c05300 R15: 0000000000022000\n\nShowing all locks held in the system:\n1 lock held by khungtaskd/27:\n #0: ffffffff8b980020 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446\n2 locks held by kworker/u4:2/153:\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268\n #1: ffffc9000140fdb0 ((kfence_timer).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272\n1 lock held by systemd-udevd/2970:\n1 lock held by in:imklog/6258:\n #0: ffff88807f970ff0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990\n3 locks held by kworker/1:6/8158:\n1 lock held by syz-executor.0/8312:\n2 locks held by kworker/u4:13/9320:\n1 lock held by\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47408" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7ea6f5848281182ce0cff6cafdcf3fbdeb8ca7e1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e2d192301a0df8160d1555b66ae8611e8050e424" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e9edc188fc76499b0b9bd60364084037f6d03773" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-4h6j-2wpq-2xv2/GHSA-4h6j-2wpq-2xv2.json b/advisories/unreviewed/2024/05/GHSA-4h6j-2wpq-2xv2/GHSA-4h6j-2wpq-2xv2.json new file mode 100644 index 00000000000..4f588722069 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-4h6j-2wpq-2xv2/GHSA-4h6j-2wpq-2xv2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4h6j-2wpq-2xv2", + "modified": "2024-05-21T15:31:38Z", + "published": "2024-05-21T15:31:38Z", + "aliases": [ + "CVE-2023-3943" + ], + "details": "Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions.\n\nThis issue affects \nZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others)\n\n with firmware \nZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3943" + }, + { + "type": "WEB", + "url": "https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-006.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T14:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-4jxh-jrgp-4422/GHSA-4jxh-jrgp-4422.json b/advisories/unreviewed/2024/05/GHSA-4jxh-jrgp-4422/GHSA-4jxh-jrgp-4422.json new file mode 100644 index 00000000000..bf57607b9ae --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-4jxh-jrgp-4422/GHSA-4jxh-jrgp-4422.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4jxh-jrgp-4422", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47226" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer\n\nBoth Intel and AMD consider it to be architecturally valid for XRSTOR to\nfail with #PF but nonetheless change the register state. The actual\nconditions under which this might occur are unclear [1], but it seems\nplausible that this might be triggered if one sibling thread unmaps a page\nand invalidates the shared TLB while another sibling thread is executing\nXRSTOR on the page in question.\n\n__fpu__restore_sig() can execute XRSTOR while the hardware registers\nare preserved on behalf of a different victim task (using the\nfpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but\nmodify the registers.\n\nIf this happens, then there is a window in which __fpu__restore_sig()\ncould schedule out and the victim task could schedule back in without\nreloading its own FPU registers. This would result in part of the FPU\nstate that __fpu__restore_sig() was attempting to load leaking into the\nvictim task's user-visible state.\n\nInvalidate preserved FPU registers on XRSTOR failure to prevent this\nsituation from corrupting any state.\n\n[1] Frequent readers of the errata lists might imagine \"complex\n microarchitectural conditions\".", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47226" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-4mwj-7h55-4fvc/GHSA-4mwj-7h55-4fvc.json b/advisories/unreviewed/2024/05/GHSA-4mwj-7h55-4fvc/GHSA-4mwj-7h55-4fvc.json new file mode 100644 index 00000000000..647f44aaf0b --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-4mwj-7h55-4fvc/GHSA-4mwj-7h55-4fvc.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4mwj-7h55-4fvc", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47263" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: wcd934x: Fix shift-out-of-bounds error\n\nbit-mask for pins 0 to 4 is BIT(0) to BIT(4) however we ended up with BIT(n - 1)\nwhich is not right, and this was caught by below usban check\n\nUBSAN: shift-out-of-bounds in drivers/gpio/gpio-wcd934x.c:34:14", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47263" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dbec64b11c65d74f31427e2b9d5746fbf17bf840" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dd55331d493b7ea75c5db1f24d6822946fde2862" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e0b518a2eb44d8a74c19e50f79a8ed393e96d634" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-4q4j-hm78-5vmp/GHSA-4q4j-hm78-5vmp.json b/advisories/unreviewed/2024/05/GHSA-4q4j-hm78-5vmp/GHSA-4q4j-hm78-5vmp.json new file mode 100644 index 00000000000..aaca76de3ca --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-4q4j-hm78-5vmp/GHSA-4q4j-hm78-5vmp.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4q4j-hm78-5vmp", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47325" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation\n\nThe reference counting issue happens in several exception handling paths\nof arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the\nfunction forgets to decrease the refcount of \"smmu\" increased by\narm_smmu_rpm_get(), causing a refcount leak.\n\nFix this issue by jumping to \"out\" label when those error scenarios\noccur.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47325" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0f0c5ea09139777d90729d408b807021f2ea6492" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/43d1aaa1965f9b58035196dac49b1e1e6c9c25eb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5f9741a9a91f25c89e04b408cd61e3ab050ce24b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7c8f176d6a3fa18aa0f8875da6f7c672ed2a8554" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b11220803ad14a2a880cc06d8e01fe2548cc85b0" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-4xq8-m4f5-h82h/GHSA-4xq8-m4f5-h82h.json b/advisories/unreviewed/2024/05/GHSA-4xq8-m4f5-h82h/GHSA-4xq8-m4f5-h82h.json new file mode 100644 index 00000000000..37e08f4be3e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-4xq8-m4f5-h82h/GHSA-4xq8-m4f5-h82h.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xq8-m4f5-h82h", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47270" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: fix various gadgets null ptr deref on 10gbps cabling.\n\nThis avoids a null pointer dereference in\nf_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm}\nby simply reusing the 5gbps config for 10gbps.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47270" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/10770d2ac0094b053c8897d96d7b2737cd72f7c5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4b289a0f3033f465b4fd51ba995251a7867a2aa2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8cd5f45c1b769e3e9e0f4325dd08b6c3749dc7ee" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/90c4d05780d47e14a50e11a7f17373104cd47d25" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b4903f7fdc484628d0b8022daf86e2439d3ab4db" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/beb1e67a5ca8d69703c776db9000527f44c0c93c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f17aae7c4009160f0630a91842a281773976a5bc" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-589w-2j5c-px7j/GHSA-589w-2j5c-px7j.json b/advisories/unreviewed/2024/05/GHSA-589w-2j5c-px7j/GHSA-589w-2j5c-px7j.json new file mode 100644 index 00000000000..0020820040c --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-589w-2j5c-px7j/GHSA-589w-2j5c-px7j.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-589w-2j5c-px7j", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47310" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: fix UAF in tlan_remove_one\n\npriv is netdev private data and it cannot be\nused after free_netdev() call. Using priv after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47310" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0336f8ffece62f882ab3012820965a786a983f70" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0538b0ab7d2c396e385694228c7cdcd2d2c514e9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/93efab0ef2a607fff9166d447c4035f98b5db342" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a0a817b2d308fac090a05cbbe80988e073ac5193" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a18a8d9cfbb112ad72e625372849adc3986fd6bf" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b7e5563f2a7862a9e4796abb9908b092f677e3c1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c263ae8c7e4c482387de5e6c89e213f8173fe8b6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f2a062fcfe1d6f1b0a86fa76ae21c277d65f4405" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-5cq3-7g4c-4j8m/GHSA-5cq3-7g4c-4j8m.json b/advisories/unreviewed/2024/05/GHSA-5cq3-7g4c-4j8m/GHSA-5cq3-7g4c-4j8m.json new file mode 100644 index 00000000000..966ab7c008e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-5cq3-7g4c-4j8m/GHSA-5cq3-7g4c-4j8m.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5cq3-7g4c-4j8m", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47411" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: allow conditional reschedule for intensive iterators\n\nIf we have a lot of threads and rings, the tctx list can get quite big.\nThis is especially true if we keep creating new threads and rings.\nLikewise for the provided buffers list. Be nice and insert a conditional\nreschedule point while iterating the nodes for deletion.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47411" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/648f59a06b0e1fec7a4158cdee9acd362e493ce1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8bab4c09f24ec8d4a7a78ab343620f89d3a24804" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-5g7f-2wxq-wj73/GHSA-5g7f-2wxq-wj73.json b/advisories/unreviewed/2024/05/GHSA-5g7f-2wxq-wj73/GHSA-5g7f-2wxq-wj73.json new file mode 100644 index 00000000000..696329bff4f --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-5g7f-2wxq-wj73/GHSA-5g7f-2wxq-wj73.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5g7f-2wxq-wj73", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2024-33527" + ], + "details": "A Stored Cross-site Scripting (XSS) vulnerability in the \"Import of Users and login name of user\" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33527" + }, + { + "type": "WEB", + "url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-5hmx-w727-fqq7/GHSA-5hmx-w727-fqq7.json b/advisories/unreviewed/2024/05/GHSA-5hmx-w727-fqq7/GHSA-5hmx-w727-fqq7.json new file mode 100644 index 00000000000..97b8d36e487 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-5hmx-w727-fqq7/GHSA-5hmx-w727-fqq7.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5hmx-w727-fqq7", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47350" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/mm: Fix lockup on kernel exec fault\n\nThe powerpc kernel is not prepared to handle exec faults from kernel.\nEspecially, the function is_exec_fault() will return 'false' when an\nexec fault is taken by kernel, because the check is based on reading\ncurrent->thread.regs->trap which contains the trap from user.\n\nFor instance, when provoking a LKDTM EXEC_USERSPACE test,\ncurrent->thread.regs->trap is set to SYSCALL trap (0xc00), and\nthe fault taken by the kernel is not seen as an exec fault by\nset_access_flags_filter().\n\nCommit d7df2443cd5f (\"powerpc/mm: Fix spurious segfaults on radix\nwith autonuma\") made it clear and handled it properly. But later on\ncommit d3ca587404b3 (\"powerpc/mm: Fix reporting of kernel execute\nfaults\") removed that handling, introducing test based on error_code.\nAnd here is the problem, because on the 603 all upper bits of SRR1\nget cleared when the TLB instruction miss handler bails out to ISI.\n\nUntil commit cbd7e6ca0210 (\"powerpc/fault: Avoid heavy\nsearch_exception_tables() verification\"), an exec fault from kernel\nat a userspace address was indirectly caught by the lack of entry for\nthat address in the exception tables. But after that commit the\nkernel mainly relies on KUAP or on core mm handling to catch wrong\nuser accesses. Here the access is not wrong, so mm handles it.\nIt is a minor fault because PAGE_EXEC is not set,\nset_access_flags_filter() should set PAGE_EXEC and voila.\nBut as is_exec_fault() returns false as explained in the beginning,\nset_access_flags_filter() bails out without setting PAGE_EXEC flag,\nwhich leads to a forever minor exec fault.\n\nAs the kernel is not prepared to handle such exec faults, the thing to\ndo is to fire in bad_kernel_fault() for any exec fault taken by the\nkernel, as it was prior to commit d3ca587404b3.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47350" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/500f81cec9f1bfa5210aa9dd5ba9a06e22f62a35" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8a96ec5ebf96ad8e2ba7b1b34103a0be5140fc70" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a82471a14aad90f79d1608d2bcbb019f0ffb53f0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cd5d5e602f502895e47e18cd46804d6d7014e65c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d2e52d4664097a6c1f591d869ec594bd7a0d4925" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-5j57-53hq-vmc7/GHSA-5j57-53hq-vmc7.json b/advisories/unreviewed/2024/05/GHSA-5j57-53hq-vmc7/GHSA-5j57-53hq-vmc7.json new file mode 100644 index 00000000000..f1feb415242 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-5j57-53hq-vmc7/GHSA-5j57-53hq-vmc7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j57-53hq-vmc7", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47278" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: pci_generic: Fix possible use-after-free in mhi_pci_remove()\n\nThis driver's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47278" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0b67808ade8893a1b3608ddd74fac7854786c919" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c597d5c59c7a6417dba06590f59b922e01188e8d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-5vvx-6299-h82w/GHSA-5vvx-6299-h82w.json b/advisories/unreviewed/2024/05/GHSA-5vvx-6299-h82w/GHSA-5vvx-6299-h82w.json new file mode 100644 index 00000000000..bc4dc9fcf44 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-5vvx-6299-h82w/GHSA-5vvx-6299-h82w.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5vvx-6299-h82w", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47337" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix bad pointer dereference when ehandler kthread is invalid\n\nCommit 66a834d09293 (\"scsi: core: Fix error handling of scsi_host_alloc()\")\nchanged the allocation logic to call put_device() to perform host cleanup\nwith the assumption that IDA removal and stopping the kthread would\nproperly be performed in scsi_host_dev_release(). However, in the unlikely\ncase that the error handler thread fails to spawn, shost->ehandler is set\nto ERR_PTR(-ENOMEM).\n\nThe error handler cleanup code in scsi_host_dev_release() will call\nkthread_stop() if shost->ehandler != NULL which will always be the case\nwhether the kthread was successfully spawned or not. In the case that it\nfailed to spawn this has the nasty side effect of trying to dereference an\ninvalid pointer when kthread_stop() is called. The following splat provides\nan example of this behavior in the wild:\n\nscsi host11: error handler thread failed to spawn, error = -4\nKernel attempted to read user page (10c) - exploit attempt? (uid: 0)\nBUG: Kernel NULL pointer dereference on read at 0x0000010c\nFaulting instruction address: 0xc00000000818e9a8\nOops: Kernel access of bad area, sig: 11 [#1]\nLE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries\nModules linked in: ibmvscsi(+) scsi_transport_srp dm_multipath dm_mirror dm_region\n hash dm_log dm_mod fuse overlay squashfs loop\nCPU: 12 PID: 274 Comm: systemd-udevd Not tainted 5.13.0-rc7 #1\nNIP: c00000000818e9a8 LR: c0000000089846e8 CTR: 0000000000007ee8\nREGS: c000000037d12ea0 TRAP: 0300 Not tainted (5.13.0-rc7)\nMSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28228228\nXER: 20040001\nCFAR: c0000000089846e4 DAR: 000000000000010c DSISR: 40000000 IRQMASK: 0\nGPR00: c0000000089846e8 c000000037d13140 c000000009cc1100 fffffffffffffffc\nGPR04: 0000000000000001 0000000000000000 0000000000000000 c000000037dc0000\nGPR08: 0000000000000000 c000000037dc0000 0000000000000001 00000000fffff7ff\nGPR12: 0000000000008000 c00000000a049000 c000000037d13d00 000000011134d5a0\nGPR16: 0000000000001740 c0080000190d0000 c0080000190d1740 c000000009129288\nGPR20: c000000037d13bc0 0000000000000001 c000000037d13bc0 c0080000190b7898\nGPR24: c0080000190b7708 0000000000000000 c000000033bb2c48 0000000000000000\nGPR28: c000000046b28280 0000000000000000 000000000000010c fffffffffffffffc\nNIP [c00000000818e9a8] kthread_stop+0x38/0x230\nLR [c0000000089846e8] scsi_host_dev_release+0x98/0x160\nCall Trace:\n[c000000033bb2c48] 0xc000000033bb2c48 (unreliable)\n[c0000000089846e8] scsi_host_dev_release+0x98/0x160\n[c00000000891e960] device_release+0x60/0x100\n[c0000000087e55c4] kobject_release+0x84/0x210\n[c00000000891ec78] put_device+0x28/0x40\n[c000000008984ea4] scsi_host_alloc+0x314/0x430\n[c0080000190b38bc] ibmvscsi_probe+0x54/0xad0 [ibmvscsi]\n[c000000008110104] vio_bus_probe+0xa4/0x4b0\n[c00000000892a860] really_probe+0x140/0x680\n[c00000000892aefc] driver_probe_device+0x15c/0x200\n[c00000000892b63c] device_driver_attach+0xcc/0xe0\n[c00000000892b740] __driver_attach+0xf0/0x200\n[c000000008926f28] bus_for_each_dev+0xa8/0x130\n[c000000008929ce4] driver_attach+0x34/0x50\n[c000000008928fc0] bus_add_driver+0x1b0/0x300\n[c00000000892c798] driver_register+0x98/0x1a0\n[c00000000810eb60] __vio_register_driver+0x80/0xe0\n[c0080000190b4a30] ibmvscsi_module_init+0x9c/0xdc [ibmvscsi]\n[c0000000080121d0] do_one_initcall+0x60/0x2d0\n[c000000008261abc] do_init_module+0x7c/0x320\n[c000000008265700] load_module+0x2350/0x25b0\n[c000000008265cb4] __do_sys_finit_module+0xd4/0x160\n[c000000008031110] system_call_exception+0x150/0x2d0\n[c00000000800d35c] system_call_common+0xec/0x278\n\nFix this be nulling shost->ehandler when the kthread fails to spawn.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47337" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/887bfae2732b5b02a86a859fd239d34f7ff93c05" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8e4212ecf0713dd57d0e3209a66201da582149b1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/93aa71ad7379900e61c8adff6a710a4c18c7c99b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c1671d2d2ef8a84837eea1b4d99ca0c6a66fb691" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d2f0b960d07e52bb664471b4de0ed8b08c636b3a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e1bd3fac2baa3d5c04375980c1d5263a3335af92" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ea518b70ed5e4598c8d706f37fc16f7b06e440bd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f3d0a109240c9bed5c60d819014786be3a2fe515" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-5w2f-hr95-2h6j/GHSA-5w2f-hr95-2h6j.json b/advisories/unreviewed/2024/05/GHSA-5w2f-hr95-2h6j/GHSA-5w2f-hr95-2h6j.json new file mode 100644 index 00000000000..fe07e012568 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-5w2f-hr95-2h6j/GHSA-5w2f-hr95-2h6j.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5w2f-hr95-2h6j", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47363" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Fix division by zero while replacing a resilient group\n\nThe resilient nexthop group torture tests in fib_nexthop.sh exposed a\npossible division by zero while replacing a resilient group [1]. The\ndivision by zero occurs when the data path sees a resilient nexthop\ngroup with zero buckets.\n\nThe tests replace a resilient nexthop group in a loop while traffic is\nforwarded through it. The tests do not specify the number of buckets\nwhile performing the replacement, resulting in the kernel allocating a\nstub resilient table (i.e, 'struct nh_res_table') with zero buckets.\n\nThis table should never be visible to the data path, but the old nexthop\ngroup (i.e., 'oldg') might still be used by the data path when the stub\ntable is assigned to it.\n\nFix this by only assigning the stub table to the old nexthop group after\nmaking sure the group is no longer used by the data path.\n\nTested with fib_nexthops.sh:\n\nTests passed: 222\nTests failed: 0\n\n[1]\n divide error: 0000 [#1] PREEMPT SMP KASAN\n CPU: 0 PID: 1850 Comm: ping Not tainted 5.14.0-custom-10271-ga86eb53057fe #1107\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014\n RIP: 0010:nexthop_select_path+0x2d2/0x1a80\n[...]\n Call Trace:\n fib_select_multipath+0x79b/0x1530\n fib_select_path+0x8fb/0x1c10\n ip_route_output_key_hash_rcu+0x1198/0x2da0\n ip_route_output_key_hash+0x190/0x340\n ip_route_output_flow+0x21/0x120\n raw_sendmsg+0x91d/0x2e10\n inet_sendmsg+0x9e/0xe0\n __sys_sendto+0x23d/0x360\n __x64_sys_sendto+0xe1/0x1b0\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47363" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/563f23b002534176f49524b5ca0e1d94d8906c40" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e9d32ec26e7f01d1af13bdc687f586362546aa25" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6239-6f98-f8vf/GHSA-6239-6f98-f8vf.json b/advisories/unreviewed/2024/05/GHSA-6239-6f98-f8vf/GHSA-6239-6f98-f8vf.json new file mode 100644 index 00000000000..8e0e1ac95e9 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6239-6f98-f8vf/GHSA-6239-6f98-f8vf.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6239-6f98-f8vf", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47277" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkvm: avoid speculation-based attacks from out-of-range memslot accesses\n\nKVM's mechanism for accessing guest memory translates a guest physical\naddress (gpa) to a host virtual address using the right-shifted gpa\n(also known as gfn) and a struct kvm_memory_slot. The translation is\nperformed in __gfn_to_hva_memslot using the following formula:\n\n hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE\n\nIt is expected that gfn falls within the boundaries of the guest's\nphysical memory. However, a guest can access invalid physical addresses\nin such a way that the gfn is invalid.\n\n__gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first\nretrieves a memslot through __gfn_to_memslot. While __gfn_to_memslot\ndoes check that the gfn falls within the boundaries of the guest's\nphysical memory or not, a CPU can speculate the result of the check and\ncontinue execution speculatively using an illegal gfn. The speculation\ncan result in calculating an out-of-bounds hva. If the resulting host\nvirtual address is used to load another guest physical address, this\nis effectively a Spectre gadget consisting of two consecutive reads,\nthe second of which is data dependent on the first.\n\nRight now it's not clear if there are any cases in which this is\nexploitable. One interesting case was reported by the original author\nof this patch, and involves visiting guest page tables on x86. Right\nnow these are not vulnerable because the hva read goes through get_user(),\nwhich contains an LFENCE speculation barrier. However, there are\npatches in progress for x86 uaccess.h to mask kernel addresses instead of\nusing LFENCE; once these land, a guest could use speculation to read\nfrom the VMM's ring 3 address space. Other architectures such as ARM\nalready use the address masking method, and would be susceptible to\nthis same kind of data-dependent access gadgets. Therefore, this patch\nproactively protects from these attacks by masking out-of-bounds gfns\nin __gfn_to_hva_memslot, which blocks speculation of invalid hvas.\n\nSean Christopherson noted that this patch does not cover\nkvm_read_guest_offset_cached. This however is limited to a few bytes\npast the end of the cache, and therefore it is unlikely to be useful in\nthe context of building a chain of data dependent accesses.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47277" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/22b87fb17a28d37331bb9c1110737627b17f6781" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3098b86390a6b9ea52657689f08410baf130ceff" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/361ce3b917aff93123e9e966d8608655c967f438" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/740621309b25bbf619b8a0ba5fd50a8e58989441" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7af299b97734c7e7f465b42a2139ce4d77246975" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bff1fbf0cf0712686f1df59a83fba6e31d2746a0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/da27a83fd6cc7780fea190e1f5c19e87019da65c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ed0e2a893092c7fcb4ff7ba74e5efce53a6f5940" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-62x6-4gmp-fg78/GHSA-62x6-4gmp-fg78.json b/advisories/unreviewed/2024/05/GHSA-62x6-4gmp-fg78/GHSA-62x6-4gmp-fg78.json new file mode 100644 index 00000000000..4f160133f70 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-62x6-4gmp-fg78/GHSA-62x6-4gmp-fg78.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-62x6-4gmp-fg78", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47297" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix uninit-value in caif_seqpkt_sendmsg\n\nWhen nr_segs equal to zero in iovec_from_user, the object\nmsg->msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg\nwhich is defined in ___sys_sendmsg. So we cann't just judge\nmsg->msg_iter.iov->base directlly. We can use nr_segs to judge\nmsg in caif_seqpkt_sendmsg whether has data buffers.\n\n=====================================================\nBUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1c9/0x220 lib/dump_stack.c:118\n kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118\n __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215\n caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542\n sock_sendmsg_nosec net/socket.c:652 [inline]\n sock_sendmsg net/socket.c:672 [inline]\n ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343\n ___sys_sendmsg net/socket.c:2397 [inline]\n __sys_sendmmsg+0x808/0xc90 net/socket.c:2480\n __compat_sys_sendmmsg net/compat.c:656 [inline]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47297" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1582a02fecffcee306663035a295e28e1c4aaaff" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/452c3ed7bf63721b07bc2238ed1261bb26027e85" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5c6d8e2f7187b8e45a18c27acb7a3885f03ee3db" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9413c0abb57f70a953b1116318d6aa478013c35d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/991e634360f2622a683b48dfe44fe6d9cb765a09" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d4c7797ab1517515f0d08b3bc1c6b48883889c54" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d9d646acad2c3590e189bb5d5c86ab8bd8a2dfc3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ffe31dd70b70a40cd6b21b78c1713a23e021843a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-688x-28gq-pm6f/GHSA-688x-28gq-pm6f.json b/advisories/unreviewed/2024/05/GHSA-688x-28gq-pm6f/GHSA-688x-28gq-pm6f.json new file mode 100644 index 00000000000..25cf1839e32 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-688x-28gq-pm6f/GHSA-688x-28gq-pm6f.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-688x-28gq-pm6f", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47285" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/nfc/rawsock.c: fix a permission check bug\n\nThe function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable().", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47285" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1e5cab50208c8fb7351b798cb1d569debfeb994a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/38cb2e23188af29c43966acee9dbb18b62e26cfe" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8ab78863e9eff11910e1ac8bcf478060c29b379e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/90d0a3c76965d7a10fc87c07be3e9714e2130d5c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c08e0be44759d0b5affc5888be4aa5e536873335" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d6a21a3fb03300fbaa9fc3ed99f8b0962ce28362" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ec72482564ff99c6832d33610d9f8ab7ecc81b6d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f3ed12af6bbbaf79eddb0ae14656b8ecacea74f0" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6g88-wmq7-m8g5/GHSA-6g88-wmq7-m8g5.json b/advisories/unreviewed/2024/05/GHSA-6g88-wmq7-m8g5/GHSA-6g88-wmq7-m8g5.json new file mode 100644 index 00000000000..f9c4ee9cf6b --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6g88-wmq7-m8g5/GHSA-6g88-wmq7-m8g5.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6g88-wmq7-m8g5", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47412" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't call rq_qos_ops->done_bio if the bio isn't tracked\n\nrq_qos framework is only applied on request based driver, so:\n\n1) rq_qos_done_bio() needn't to be called for bio based driver\n\n2) rq_qos_done_bio() needn't to be called for bio which isn't tracked,\nsuch as bios ended from error handling code.\n\nEspecially in bio_endio():\n\n1) request queue is referred via bio->bi_bdev->bd_disk->queue, which\nmay be gone since request queue refcount may not be held in above two\ncases\n\n2) q->rq_qos may be freed in blk_cleanup_queue() when calling into\n__rq_qos_done_bio()\n\nFix the potential kernel panic by not calling rq_qos_ops->done_bio if\nthe bio isn't tracked. This way is safe because both ioc_rqos_done_bio()\nand blkcg_iolatency_done_bio() are nop if the bio isn't tracked.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47412" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/004b8f8a691205a93d9e80d98b786b2b97424d6e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a647a524a46736786c95cdb553a070322ca096e3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6h98-v544-xj7q/GHSA-6h98-v544-xj7q.json b/advisories/unreviewed/2024/05/GHSA-6h98-v544-xj7q/GHSA-6h98-v544-xj7q.json new file mode 100644 index 00000000000..c6786268eb7 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6h98-v544-xj7q/GHSA-6h98-v544-xj7q.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6h98-v544-xj7q", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47240" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\n\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\n\n\tif (len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won't fail and\n\n\tskb_put_data(skb, data + hdrlen, size);\n\nwill read out of bound from data, which is hdrlen allocated block.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47240" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ad9d24c9429e2159d1e279dc3a83191ccb4daf1d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f8111c0d7ed42ede41a3d0d393b104de0730a8a6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6hjh-qhhq-4q76/GHSA-6hjh-qhhq-4q76.json b/advisories/unreviewed/2024/05/GHSA-6hjh-qhhq-4q76/GHSA-6hjh-qhhq-4q76.json new file mode 100644 index 00000000000..77912c44e91 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6hjh-qhhq-4q76/GHSA-6hjh-qhhq-4q76.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hjh-qhhq-4q76", + "modified": "2024-05-21T15:31:38Z", + "published": "2024-05-21T15:31:38Z", + "aliases": [ + "CVE-2024-35384" + ], + "details": "An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35384" + }, + { + "type": "WEB", + "url": "https://github.com/cesanta/mjs/issues/287" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T14:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6hmf-7mx4-83j8/GHSA-6hmf-7mx4-83j8.json b/advisories/unreviewed/2024/05/GHSA-6hmf-7mx4-83j8/GHSA-6hmf-7mx4-83j8.json new file mode 100644 index 00000000000..d953941b680 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6hmf-7mx4-83j8/GHSA-6hmf-7mx4-83j8.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hmf-7mx4-83j8", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47372" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix use after free on rmmod\n\nplat_dev->dev->platform_data is released by platform_device_unregister(),\nuse of pclk and hclk is a use-after-free. Since device unregister won't\nneed a clk device we adjust the function call sequence to fix this issue.\n\n[ 31.261225] BUG: KASAN: use-after-free in macb_remove+0x77/0xc6 [macb_pci]\n[ 31.275563] Freed by task 306:\n[ 30.276782] platform_device_release+0x25/0x80", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47372" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1da750d1e2140ef43d64d17f301ff6f41b45541e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/46670fb832ee80943715df618632ca13c2e96f2b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4ad6f2d23b0f6ac0d3e5f3102a4256d1c86c90f5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7721221e87d25c9840d9ca6b986dbdc410d5ce2b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a7d521cc726f30b8e679a6f36d04b18a8ab3c536" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d82d5303c4c539db86588ffb5dc5b26c3f1513e8" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6pvp-xcj5-pgh8/GHSA-6pvp-xcj5-pgh8.json b/advisories/unreviewed/2024/05/GHSA-6pvp-xcj5-pgh8/GHSA-6pvp-xcj5-pgh8.json new file mode 100644 index 00000000000..83bd9e27dac --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6pvp-xcj5-pgh8/GHSA-6pvp-xcj5-pgh8.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6pvp-xcj5-pgh8", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47243" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_cake: Fix out of bounds when parsing TCP options and header\n\nThe TCP option parser in cake qdisc (cake_get_tcpopt and\ncake_tcph_may_drop) could read one byte out of bounds. When the length\nis 1, the execution flow gets into the loop, reads one byte of the\nopcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads\none more byte, which exceeds the length of 1.\n\nThis fix is inspired by commit 9609dad263f8 (\"ipv4: tcp_input: fix stack\nout of bounds when parsing TCP options.\").\n\nv2 changes:\n\nAdded doff validation in cake_get_tcphdr to avoid parsing garbage as TCP\nheader. Although it wasn't strictly an out-of-bounds access (memory was\nallocated), garbage values could be read where CAKE expected the TCP\nheader if doff was smaller than 5.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47243" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/595897ef118d6fe66690c4fc5b572028c9da95b7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ba91c49dedbde758ba0b72f57ac90b06ddf8e548" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6qx7-m4qh-j7cp/GHSA-6qx7-m4qh-j7cp.json b/advisories/unreviewed/2024/05/GHSA-6qx7-m4qh-j7cp/GHSA-6qx7-m4qh-j7cp.json new file mode 100644 index 00000000000..f3a78fa95da --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6qx7-m4qh-j7cp/GHSA-6qx7-m4qh-j7cp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6qx7-m4qh-j7cp", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47367" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix pages leaking when building skb in big mode\n\nWe try to use build_skb() if we had sufficient tailroom. But we forget\nto release the unused pages chained via private in big mode which will\nleak pages. Fixing this by release the pages after building the skb in\nbig mode.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47367" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/afd92d82c9d715fb97565408755acad81573591a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f020bb63b5d2e5576acadd10e158fe3b04af67ba" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6xc5-7hvv-v7jc/GHSA-6xc5-7hvv-v7jc.json b/advisories/unreviewed/2024/05/GHSA-6xc5-7hvv-v7jc/GHSA-6xc5-7hvv-v7jc.json new file mode 100644 index 00000000000..cbd09174983 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6xc5-7hvv-v7jc/GHSA-6xc5-7hvv-v7jc.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6xc5-7hvv-v7jc", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47370" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: ensure tx skbs always have the MPTCP ext\n\nDue to signed/unsigned comparison, the expression:\n\n\tinfo->size_goal - skb->len > 0\n\nevaluates to true when the size goal is smaller than the\nskb size. That results in lack of tx cache refill, so that\nthe skb allocated by the core TCP code lacks the required\nMPTCP skb extensions.\n\nDue to the above, syzbot is able to trigger the following WARN_ON():\n\nWARNING: CPU: 1 PID: 810 at net/mptcp/protocol.c:1366 mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366\nModules linked in:\nCPU: 1 PID: 810 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366\nCode: ff 4c 8b 74 24 50 48 8b 5c 24 58 e9 0f fb ff ff e8 13 44 8b f8 4c 89 e7 45 31 ed e8 98 57 2e fe e9 81 f4 ff ff e8 fe 43 8b f8 <0f> 0b 41 bd ea ff ff ff e9 6f f4 ff ff 4c 89 e7 e8 b9 8e d2 f8 e9\nRSP: 0018:ffffc9000531f6a0 EFLAGS: 00010216\nRAX: 000000000000697f RBX: 0000000000000000 RCX: ffffc90012107000\nRDX: 0000000000040000 RSI: ffffffff88eac9e2 RDI: 0000000000000003\nRBP: ffff888078b15780 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff88eac017 R11: 0000000000000000 R12: ffff88801de0a280\nR13: 0000000000006b58 R14: ffff888066278280 R15: ffff88803c2fe9c0\nFS: 00007fd9f866e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007faebcb2f718 CR3: 00000000267cb000 CR4: 00000000001506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n __mptcp_push_pending+0x1fb/0x6b0 net/mptcp/protocol.c:1547\n mptcp_release_cb+0xfe/0x210 net/mptcp/protocol.c:3003\n release_sock+0xb4/0x1b0 net/core/sock.c:3206\n sk_stream_wait_memory+0x604/0xed0 net/core/stream.c:145\n mptcp_sendmsg+0xc39/0x1bc0 net/mptcp/protocol.c:1749\n inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:724\n sock_write_iter+0x2a0/0x3e0 net/socket.c:1057\n call_write_iter include/linux/fs.h:2163 [inline]\n new_sync_write+0x40b/0x640 fs/read_write.c:507\n vfs_write+0x7cf/0xae0 fs/read_write.c:594\n ksys_write+0x1ee/0x250 fs/read_write.c:647\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x4665f9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fd9f866e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665f9\nRDX: 00000000000e7b78 RSI: 0000000020000000 RDI: 0000000000000003\nRBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c038\nR13: 0000000000a9fb1f R14: 00007fd9f866e300 R15: 0000000000022000\n\nFix the issue rewriting the relevant expression to avoid\nsign-related problems - note: size_goal is always >= 0.\n\nAdditionally, ensure that the skb in the tx cache always carries\nthe relevant extension.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47370" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/977d293e23b48a1129830d7968605f61c4af71a0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f8ff625a8082db8c2b58dcb5229b27928943b94b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7457-jp56-wxrq/GHSA-7457-jp56-wxrq.json b/advisories/unreviewed/2024/05/GHSA-7457-jp56-wxrq/GHSA-7457-jp56-wxrq.json new file mode 100644 index 00000000000..68e8dd3f307 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7457-jp56-wxrq/GHSA-7457-jp56-wxrq.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7457-jp56-wxrq", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47428" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s: fix program check interrupt emergency stack path\n\nEmergency stack path was jumping into a 3: label inside the\n__GEN_COMMON_BODY macro for the normal path after it had finished,\nrather than jumping over it. By a small miracle this is the correct\nplace to build up a new interrupt frame with the existing stack\npointer, so things basically worked okay with an added weird looking\n700 trap frame on top (which had the wrong ->nip so it didn't decode\nbug messages either).\n\nFix this by avoiding using numeric labels when jumping over non-trivial\nmacros.\n\nBefore:\n\n LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV\n Modules linked in:\n CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637\n NIP: 7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0\n REGS: c0000000fffb3a50 TRAP: 0700 Not tainted\n MSR: 9000000000021031 CR: 00000700 XER: 20040000\n CFAR: c0000000000098b0 IRQMASK: 0\n GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000\n GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299\n GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8\n GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001\n GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8\n GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158\n GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300\n GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80\n NIP [7265677368657265] 0x7265677368657265\n LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10\n Call Trace:\n [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable)\n --- interrupt: 700 at decrementer_common_virt+0xb8/0x230\n NIP: c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0\n REGS: c0000000fffb3d60 TRAP: 0700 Not tainted\n MSR: 9000000000021031 CR: 22424282 XER: 20040000\n CFAR: c0000000000098b0 IRQMASK: 0\n GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000\n GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299\n GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8\n GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001\n GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8\n GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158\n GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300\n GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80\n NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230\n LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10\n --- interrupt: 700\n Instruction dump:\n XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n ---[ end trace 6d28218e0cc3c949 ]---\n\nAfter:\n\n ------------[ cut here ]------------\n kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491!\n Oops: Exception in kernel mode, sig: 5 [#1]\n LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV\n Modules linked in:\n CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638\n NIP: c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0\n REGS: c0000000fffb3d60 TRAP: 0700 Not tainted\n MSR: 9000000000021031 CR: 24482227 XER: 00040000\n CFAR: c0000000000098b0 IRQMASK: 0\n GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868\n GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009\n GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c\n GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00\n GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90\n GPR20: 00000000100eed90 00000\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47428" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3e607dc4df180b72a38e75030cb0f94d12808712" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/411b38fe68ba20a8bbe724b0939762c3f16e16ca" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c835b3d1d6362b4a4ebb192da7e7fd27a0a45d01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-747f-wh5x-mp2p/GHSA-747f-wh5x-mp2p.json b/advisories/unreviewed/2024/05/GHSA-747f-wh5x-mp2p/GHSA-747f-wh5x-mp2p.json new file mode 100644 index 00000000000..cfa93497aaa --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-747f-wh5x-mp2p/GHSA-747f-wh5x-mp2p.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-747f-wh5x-mp2p", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47239" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: fix possible use-after-free in smsc75xx_bind\n\nThe commit 46a8b29c6306 (\"net: usb: fix memory leak in smsc75xx_bind\")\nfails to clean up the work scheduled in smsc75xx_reset->\nsmsc75xx_set_multicast, which leads to use-after-free if the work is\nscheduled to start after the deallocation. In addition, this patch\nalso removes a dangling pointer - dev->data[0].\n\nThis patch calls cancel_work_sync to cancel the scheduled work and set\nthe dangling pointer to NULL.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47239" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/14616c372a7be01a2fb8c56c9d8debd232b9e43d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2fc8300c9cfa5167fcb5b1a2a07db6f53e82f59b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4252bf6c2b245f47011098113d405ffad6ad5d5b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/56b786d86694e079d8aad9b314e015cd4ac02a3d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/570a52cf3e01d19f7fd1a251dfc52b0cd86c13cb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/64160d1741a3de5204d1a822e058e0b4cc526504" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7cc8b2e05fcea6edd022d26e82091d781af8fd9b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c4e3be2e7742863e454ce31faf8fd0109c00050b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-74hg-7r85-vvw3/GHSA-74hg-7r85-vvw3.json b/advisories/unreviewed/2024/05/GHSA-74hg-7r85-vvw3/GHSA-74hg-7r85-vvw3.json new file mode 100644 index 00000000000..7de5653c847 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-74hg-7r85-vvw3/GHSA-74hg-7r85-vvw3.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-74hg-7r85-vvw3", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47229" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: aardvark: Fix kernel panic during PIO transfer\n\nTrying to start a new PIO transfer by writing value 0 in PIO_START register\nwhen previous transfer has not yet completed (which is indicated by value 1\nin PIO_START) causes an External Abort on CPU, which results in kernel\npanic:\n\n SError Interrupt on CPU0, code 0xbf000002 -- SError\n Kernel panic - not syncing: Asynchronous SError Interrupt\n\nTo prevent kernel panic, it is required to reject a new PIO transfer when\nprevious one has not finished yet.\n\nIf previous PIO transfer is not finished yet, the kernel may issue a new\nPIO request only if the previous PIO transfer timed out.\n\nIn the past the root cause of this issue was incorrectly identified (as it\noften happens during link retraining or after link down event) and special\nhack was implemented in Trusted Firmware to catch all SError events in EL3,\nto ignore errors with code 0xbf000002 and not forwarding any other errors\nto kernel and instead throw panic from EL3 Trusted Firmware handler.\n\nLinks to discussion and patches about this issue:\nhttps://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50\nhttps://lore.kernel.org/linux-pci/20190316161243.29517-1-repk@triplefau.lt/\nhttps://lore.kernel.org/linux-pci/971be151d24312cc533989a64bd454b4@www.loen.fr/\nhttps://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/1541\n\nBut the real cause was the fact that during link retraining or after link\ndown event the PIO transfer may take longer time, up to the 1.44s until it\ntimes out. This increased probability that a new PIO transfer would be\nissued by kernel while previous one has not finished yet.\n\nAfter applying this change into the kernel, it is possible to revert the\nmentioned TF-A hack and SError events do not have to be caught in TF-A EL3.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47229" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1a1dbc4473974867fe8c5f195c17b341c8e82867" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3d213a4ddf49a860be6e795482c17f87e0c82b2a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/400e6b1860c8be61388d0b77814c53260f96e17a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4c90f90a91d75c3c73dd633827c90e8746d9f54d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b00a9aaa4be20ad6e3311fb78a485eae0899e89a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f18139966d072dab8e4398c95ce955a9742e04f7" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-74qf-46c3-qxv8/GHSA-74qf-46c3-qxv8.json b/advisories/unreviewed/2024/05/GHSA-74qf-46c3-qxv8/GHSA-74qf-46c3-qxv8.json new file mode 100644 index 00000000000..6ea3d05ac98 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-74qf-46c3-qxv8/GHSA-74qf-46c3-qxv8.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-74qf-46c3-qxv8", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47356" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible use-after-free in HFC_cleanup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47356" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/009fc857c5f6fda81f2f7dd851b2d54193a8e733" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3ecd228c636ee17c14662729737fa07242a93cb0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/49331c07ef0f8fdfa42b30ba6a83a657b29d7fbe" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/54ff3202928952a100c477248e65ac6db01258a7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5f2818185da0fe82a932f0856633038b66faf124" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/61370ff07e0acc657559a8fac02551dfeb9d3020" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7867ddc5f3de7f289aee63233afc0df4b62834c5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ed7c3739d0a07e2ec3ccbffe7e93cea01c438cda" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-76pr-h99m-q4fj/GHSA-76pr-h99m-q4fj.json b/advisories/unreviewed/2024/05/GHSA-76pr-h99m-q4fj/GHSA-76pr-h99m-q4fj.json new file mode 100644 index 00000000000..5884442c328 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-76pr-h99m-q4fj/GHSA-76pr-h99m-q4fj.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-76pr-h99m-q4fj", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47360" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: make sure fd closes complete\n\nDuring BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object\ncleanup may close 1 or more fds. The close operations are\ncompleted using the task work mechanism -- which means the thread\nneeds to return to userspace or the file object may never be\ndereferenced -- which can lead to hung processes.\n\nForce the binder thread back to userspace if an fd is closed during\nBC_FREE_BUFFER handling.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47360" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5fdb55c1ac9585eb23bb2541d5819224429e103d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/aa2c274c279ff365a06a4cba263f04965895166e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b95483d8d94b41fa31a84c1d86710b7907a37621" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d5b0473707fa53b03a5db0256ce62b2874bddbc7" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-77hq-crr3-x6hc/GHSA-77hq-crr3-x6hc.json b/advisories/unreviewed/2024/05/GHSA-77hq-crr3-x6hc/GHSA-77hq-crr3-x6hc.json new file mode 100644 index 00000000000..128d69fe7ee --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-77hq-crr3-x6hc/GHSA-77hq-crr3-x6hc.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-77hq-crr3-x6hc", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47381" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Fix DSP oops stack dump output contents\n\nFix @buf arg given to hex_dump_to_buffer() and stack address used\nin dump error output.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47381" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a6bb576ead074ca6fa3b53cb1c5d4037a23de81b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ac4dfccb96571ca03af7cac64b7a0b2952c97f3a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7f2x-rjqg-7667/GHSA-7f2x-rjqg-7667.json b/advisories/unreviewed/2024/05/GHSA-7f2x-rjqg-7667/GHSA-7f2x-rjqg-7667.json new file mode 100644 index 00000000000..65e81958422 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7f2x-rjqg-7667/GHSA-7f2x-rjqg-7667.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7f2x-rjqg-7667", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47393" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs\n\nFan speed minimum can be enforced from sysfs. For example, setting\ncurrent fan speed to 20 is used to enforce fan speed to be at 100%\nspeed, 19 - to be not below 90% speed, etcetera. This feature provides\nability to limit fan speed according to some system wise\nconsiderations, like absence of some replaceable units or high system\nambient temperature.\n\nRequest for changing fan minimum speed is configuration request and can\nbe set only through 'sysfs' write procedure. In this situation value of\nargument 'state' is above nominal fan speed maximum.\n\nReturn non-zero code in this case to avoid\nthermal_cooling_device_stats_update() call, because in this case\nstatistics update violates thermal statistics table range.\nThe issues is observed in case kernel is configured with option\nCONFIG_THERMAL_STATISTICS.\n\nHere is the trace from KASAN:\n[ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0\n[ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444\n[ 159.545625] Call Trace:\n[ 159.548366] dump_stack+0x92/0xc1\n[ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0\n[ 159.635869] thermal_zone_device_update+0x345/0x780\n[ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0\n[ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core]\n[ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core]\n[ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core]\n[ 160.070233] RIP: 0033:0x7fd995909970\n[ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ..\n[ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970\n[ 160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001\n[ 160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700\n[ 160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013\n[ 160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013\n[ 160.143671]\n[ 160.145338] Allocated by task 2924:\n[ 160.149242] kasan_save_stack+0x19/0x40\n[ 160.153541] __kasan_kmalloc+0x7f/0xa0\n[ 160.157743] __kmalloc+0x1a2/0x2b0\n[ 160.161552] thermal_cooling_device_setup_sysfs+0xf9/0x1a0\n[ 160.167687] __thermal_cooling_device_register+0x1b5/0x500\n[ 160.173833] devm_thermal_of_cooling_device_register+0x60/0xa0\n[ 160.180356] mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan]\n[ 160.248140]\n[ 160.249807] The buggy address belongs to the object at ffff888116163400\n[ 160.249807] which belongs to the cache kmalloc-1k of size 1024\n[ 160.263814] The buggy address is located 64 bytes to the right of\n[ 160.263814] 1024-byte region [ffff888116163400, ffff888116163800)\n[ 160.277536] The buggy address belongs to the page:\n[ 160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160\n[ 160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0\n[ 160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2)\n[ 160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0\n[ 160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000\n[ 160.327033] page dumped because: kasan: bad access detected\n[ 160.333270]\n[ 160.334937] Memory state around the buggy address:\n[ 160.356469] >ffff888116163800: fc ..", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47393" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7fq3-h5p4-7j98/GHSA-7fq3-h5p4-7j98.json b/advisories/unreviewed/2024/05/GHSA-7fq3-h5p4-7j98/GHSA-7fq3-h5p4-7j98.json new file mode 100644 index 00000000000..eda6e08500c --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7fq3-h5p4-7j98/GHSA-7fq3-h5p4-7j98.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7fq3-h5p4-7j98", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47378" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: destroy cm id before destroy qp to avoid use after free\n\nWe should always destroy cm_id before destroy qp to avoid to get cma\nevent after qp was destroyed, which may lead to use after free.\nIn RDMA connection establishment error flow, don't destroy qp in cm\nevent handler.Just report cm_error to upper level, qp will be destroy\nin nvme_rdma_alloc_queue() after destroy cm id.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47378" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7hrf-mgqx-vhg4/GHSA-7hrf-mgqx-vhg4.json b/advisories/unreviewed/2024/05/GHSA-7hrf-mgqx-vhg4/GHSA-7hrf-mgqx-vhg4.json new file mode 100644 index 00000000000..d3b07fe4ec4 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7hrf-mgqx-vhg4/GHSA-7hrf-mgqx-vhg4.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7hrf-mgqx-vhg4", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47368" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nenetc: Fix illegal access when reading affinity_hint\n\nirq_set_affinity_hit() stores a reference to the cpumask_t\nparameter in the irq descriptor, and that reference can be\naccessed later from irq_affinity_hint_proc_show(). Since\nthe cpu_mask parameter passed to irq_set_affinity_hit() has\nonly temporary storage (it's on the stack memory), later\naccesses to it are illegal. Thus reads from the corresponding\nprocfs affinity_hint file can result in paging request oops.\n\nThe issue is fixed by the get_cpu_mask() helper, which provides\na permanent storage for the cpumask_t parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47368" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4c4c3052911b577920353a7646e4883d5da40c28" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6c3f1b741c6c2914ea120e3a5790d3e900152f7b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6f329d9da2a5ae032fcde800a99b118124ed5270" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7237a494decfa17d0b9d0076e6cee3235719de90" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7qhc-3php-2c6m/GHSA-7qhc-3php-2c6m.json b/advisories/unreviewed/2024/05/GHSA-7qhc-3php-2c6m/GHSA-7qhc-3php-2c6m.json new file mode 100644 index 00000000000..a6ecdfc1d94 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7qhc-3php-2c6m/GHSA-7qhc-3php-2c6m.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7qhc-3php-2c6m", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47415" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niwlwifi: mvm: Fix possible NULL dereference\n\nIn __iwl_mvm_remove_time_event() check that 'te_data->vif' is NULL\nbefore dereferencing it.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47415" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/24d5f16e407b75bc59d5419b957a9cab423b2681" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/432d8185e9ffce97e3866ca71c39b0807a456920" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7qvv-hm32-963p/GHSA-7qvv-hm32-963p.json b/advisories/unreviewed/2024/05/GHSA-7qvv-hm32-963p/GHSA-7qvv-hm32-963p.json new file mode 100644 index 00000000000..9a97a51d5eb --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7qvv-hm32-963p/GHSA-7qvv-hm32-963p.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7qvv-hm32-963p", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47271" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdnsp: Fix deadlock issue in cdnsp_thread_irq_handler\n\nPatch fixes the following critical issue caused by deadlock which has been\ndetected during testing NCM class:\n\nsmp: csd: Detected non-responsive CSD lock (#1) on CPU#0\nsmp: csd: CSD lock (#1) unresponsive.\n....\nRIP: 0010:native_queued_spin_lock_slowpath+0x61/0x1d0\nRSP: 0018:ffffbc494011cde0 EFLAGS: 00000002\nRAX: 0000000000000101 RBX: ffff9ee8116b4a68 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ee8116b4658\nRBP: ffffbc494011cde0 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658\nR13: ffff9ee8116b4670 R14: 0000000000000246 R15: ffff9ee8116b4658\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7bcc41a830 CR3: 000000007a612003 CR4: 00000000001706e0\nCall Trace:\n \n do_raw_spin_lock+0xc0/0xd0\n _raw_spin_lock_irqsave+0x95/0xa0\n cdnsp_gadget_ep_queue.cold+0x88/0x107 [cdnsp_udc_pci]\n usb_ep_queue+0x35/0x110\n eth_start_xmit+0x220/0x3d0 [u_ether]\n ncm_tx_timeout+0x34/0x40 [usb_f_ncm]\n ? ncm_free_inst+0x50/0x50 [usb_f_ncm]\n __hrtimer_run_queues+0xac/0x440\n hrtimer_run_softirq+0x8c/0xb0\n __do_softirq+0xcf/0x428\n asm_call_irq_on_stack+0x12/0x20\n \n do_softirq_own_stack+0x61/0x70\n irq_exit_rcu+0xc1/0xd0\n sysvec_apic_timer_interrupt+0x52/0xb0\n asm_sysvec_apic_timer_interrupt+0x12/0x20\nRIP: 0010:do_raw_spin_trylock+0x18/0x40\nRSP: 0018:ffffbc494138bda8 EFLAGS: 00000246\nRAX: 0000000000000000 RBX: ffff9ee8116b4658 RCX: 0000000000000000\nRDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9ee8116b4658\nRBP: ffffbc494138bda8 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658\nR13: ffff9ee8116b4670 R14: ffff9ee7b5c73d80 R15: ffff9ee8116b4000\n _raw_spin_lock+0x3d/0x70\n ? cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci]\n cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci]\n ? cdnsp_remove_request+0x1f0/0x1f0 [cdnsp_udc_pci]\n ? cdnsp_thread_irq_handler+0x5/0xa0 [cdnsp_udc_pci]\n ? irq_thread+0xa0/0x1c0\n irq_thread_fn+0x28/0x60\n irq_thread+0x105/0x1c0\n ? __kthread_parkme+0x42/0x90\n ? irq_forced_thread_fn+0x90/0x90\n ? wake_threads_waitq+0x30/0x30\n ? irq_thread_check_affinity+0xe0/0xe0\n kthread+0x12a/0x160\n ? kthread_park+0x90/0x90\n ret_from_fork+0x22/0x30\n\nThe root cause of issue is spin_lock/spin_unlock instruction instead\nspin_lock_irqsave/spin_lock_irqrestore in cdnsp_thread_irq_handler\nfunction.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47271" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a9aecef198faae3240921b707bc09b602e966fce" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ae746b6f4ce619cf4032fd798a232b010907a397" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7r2w-9mrv-hfqg/GHSA-7r2w-9mrv-hfqg.json b/advisories/unreviewed/2024/05/GHSA-7r2w-9mrv-hfqg/GHSA-7r2w-9mrv-hfqg.json new file mode 100644 index 00000000000..f5e9b09a707 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7r2w-9mrv-hfqg/GHSA-7r2w-9mrv-hfqg.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7r2w-9mrv-hfqg", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47237" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hamradio: fix memory leak in mkiss_close\n\nMy local syzbot instance hit memory leak in\nmkiss_open()[1]. The problem was in missing\nfree_netdev() in mkiss_close().\n\nIn mkiss_open() netdevice is allocated and then\nregistered, but in mkiss_close() netdevice was\nonly unregistered, but not freed.\n\nFail log:\n\nBUG: memory leak\nunreferenced object 0xffff8880281ba000 (size 4096):\n comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n hex dump (first 32 bytes):\n 61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 ax0.............\n 00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00 .'.*............\n backtrace:\n [] kvmalloc_node+0x61/0xf0\n [] alloc_netdev_mqs+0x98/0xe80\n [] mkiss_open+0xb2/0x6f0 [1]\n [] tty_ldisc_open+0x9b/0x110\n [] tty_set_ldisc+0x2e8/0x670\n [] tty_ioctl+0xda3/0x1440\n [] __x64_sys_ioctl+0x193/0x200\n [] do_syscall_64+0x3a/0xb0\n [] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff8880141a9a00 (size 96):\n comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n hex dump (first 32 bytes):\n e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff ...(.......(....\n 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@..........\n backtrace:\n [] __hw_addr_create_ex+0x5b/0x310\n [] __hw_addr_add_ex+0x1f8/0x2b0\n [] dev_addr_init+0x10b/0x1f0\n [] alloc_netdev_mqs+0x13b/0xe80\n [] mkiss_open+0xb2/0x6f0 [1]\n [] tty_ldisc_open+0x9b/0x110\n [] tty_set_ldisc+0x2e8/0x670\n [] tty_ioctl+0xda3/0x1440\n [] __x64_sys_ioctl+0x193/0x200\n [] do_syscall_64+0x3a/0xb0\n [] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff8880219bfc00 (size 512):\n comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n hex dump (first 32 bytes):\n 00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff ...(............\n 80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00 ................\n backtrace:\n [] kvmalloc_node+0x61/0xf0\n [] alloc_netdev_mqs+0x777/0xe80\n [] mkiss_open+0xb2/0x6f0 [1]\n [] tty_ldisc_open+0x9b/0x110\n [] tty_set_ldisc+0x2e8/0x670\n [] tty_ioctl+0xda3/0x1440\n [] __x64_sys_ioctl+0x193/0x200\n [] do_syscall_64+0x3a/0xb0\n [] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff888029b2b200 (size 256):\n comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [] kvmalloc_node+0x61/0xf0\n [] alloc_netdev_mqs+0x912/0xe80\n [] mkiss_open+0xb2/0x6f0 [1]\n [] tty_ldisc_open+0x9b/0x110\n [] tty_set_ldisc+0x2e8/0x670\n [] tty_ioctl+0xda3/0x1440\n [] __x64_sys_ioctl+0x193/0x200\n [] do_syscall_64+0x3a/0xb0\n [] entry_SYSCALL_64_after_hwframe+0x44/0xae", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47237" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/290b0b6432e2599021db0b8d6046f756d931c29f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3942d0f9ace1a95a74930b5b4fc0e5005c62b37b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/765a8a04f828db7222b36a42b1031f576bfe95c3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7edcc682301492380fbdd604b4516af5ae667a13" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a49cbb762ef20655f5c91abdc13658b0af5e159d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c16c4716a1b5ba4f83c7e00da457cba06761f119" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c634ba0b4159838ff45a60d3a0ace3b4118077a5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f4de2b43d13b7cf3ced9310e371b90c836dbd7cd" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7r7x-qw92-2ffh/GHSA-7r7x-qw92-2ffh.json b/advisories/unreviewed/2024/05/GHSA-7r7x-qw92-2ffh/GHSA-7r7x-qw92-2ffh.json new file mode 100644 index 00000000000..f18ce741a52 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7r7x-qw92-2ffh/GHSA-7r7x-qw92-2ffh.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7r7x-qw92-2ffh", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47308" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libfc: Fix array index out of bound exception\n\nFix array index out of bound exception in fc_rport_prli_resp().", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47308" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0fe70c15f9435bb3c50954778245d62ee38b0e03" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/44651522941c623e20882b3b443f23f77de1ea8b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4921b1618045ffab71b1050bf0014df3313a2289" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8511293e643a18b248510ae5734e4f360754348c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a4a54c54af2516caa9c145015844543cfc84316a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b27c4577557045f1ab3cdfeabfc7f3cd24aca1fe" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7rxq-5vw3-rhvg/GHSA-7rxq-5vw3-rhvg.json b/advisories/unreviewed/2024/05/GHSA-7rxq-5vw3-rhvg/GHSA-7rxq-5vw3-rhvg.json new file mode 100644 index 00000000000..ac863a181e0 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7rxq-5vw3-rhvg/GHSA-7rxq-5vw3-rhvg.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7rxq-5vw3-rhvg", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47377" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/balloon: use a kernel thread instead a workqueue\n\nToday the Xen ballooning is done via delayed work in a workqueue. This\nmight result in workqueue hangups being reported in case of large\namounts of memory are being ballooned in one go (here 16GB):\n\nBUG: workqueue lockup - pool cpus=6 node=0 flags=0x0 nice=0 stuck for 64s!\nShowing busy workqueues and worker pools:\nworkqueue events: flags=0x0\n pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=2/256 refcnt=3\n in-flight: 229:balloon_process\n pending: cache_reap\nworkqueue events_freezable_power_: flags=0x84\n pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=1/256 refcnt=2\n pending: disk_events_workfn\nworkqueue mm_percpu_wq: flags=0x8\n pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=1/256 refcnt=2\n pending: vmstat_update\npool 12: cpus=6 node=0 flags=0x0 nice=0 hung=64s workers=3 idle: 2222 43\n\nThis can easily be avoided by using a dedicated kernel thread for doing\nthe ballooning work.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47377" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/29917bbb07c30be295dece245c7c21872e1a6fbb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/372d3e6ea1e115942fdfb4b25f7003d822d071be" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6bba79c6a073741b672b0bf86a1f03c0fe47f973" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8480ed9c2bbd56fc86524998e5f2e3e22f5038f6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/922fd5b6bb13ad31ff36e86e2eba2f26d8135272" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c5d5a43dd2b649a0a290bfed00fb76d1aff89be6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7wxc-v995-9mmf/GHSA-7wxc-v995-9mmf.json b/advisories/unreviewed/2024/05/GHSA-7wxc-v995-9mmf/GHSA-7wxc-v995-9mmf.json new file mode 100644 index 00000000000..2b3999d392b --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7wxc-v995-9mmf/GHSA-7wxc-v995-9mmf.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7wxc-v995-9mmf", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47430" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n\n\nCommit\n\n 3c73b81a9164 (\"x86/entry, selftests: Further improve user entry sanity checks\")\n\nadded a warning if AC is set when in the kernel.\n\nCommit\n\n 662a0221893a3d (\"x86/entry: Fix AC assertion\")\n\nchanged the warning to only fire if the CPU supports SMAP.\n\nHowever, the warning can still trigger on a machine that supports SMAP\nbut where it's disabled in the kernel config and when running the\nsyscall_nt selftest, for example:\n\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 49 at irqentry_enter_from_user_mode\n CPU: 0 PID: 49 Comm: init Tainted: G T 5.15.0-rc4+ #98 e6202628ee053b4f310759978284bd8bb0ce6905\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\n RIP: 0010:irqentry_enter_from_user_mode\n ...\n Call Trace:\n ? irqentry_enter\n ? exc_general_protection\n ? asm_exc_general_protection\n ? asm_exc_general_protectio\n\nIS_ENABLED(CONFIG_X86_SMAP) could be added to the warning condition, but\neven this would not be enough in case SMAP is disabled at boot time with\nthe \"nosmap\" parameter.\n\nTo be consistent with \"nosmap\" behaviour, clear X86_FEATURE_SMAP when\n!CONFIG_X86_SMAP.\n\nFound using entry-fuzz + satrandconfig.\n\n [ bp: Massage commit message. ]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47430" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3958b9c34c2729597e182cc606cc43942fd19f7c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4e9ec1c65da98c293f75d83755dfa5e03075a6d0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f2447f6587b8ffe42ba04d14ce67d429a1163e5e" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-836m-cmjj-qv5g/GHSA-836m-cmjj-qv5g.json b/advisories/unreviewed/2024/05/GHSA-836m-cmjj-qv5g/GHSA-836m-cmjj-qv5g.json new file mode 100644 index 00000000000..eb745a2e7b9 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-836m-cmjj-qv5g/GHSA-836m-cmjj-qv5g.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-836m-cmjj-qv5g", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47331" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: common: usb-conn-gpio: fix NULL pointer dereference of charger\n\nWhen power on system with OTG cable, IDDIG's interrupt arises before\nthe charger registration, it will cause a NULL pointer dereference,\nfix the issue by registering the power supply before requesting\nIDDIG/VBUS irq.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47331" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1a133a0996d6b4c83509d570ed4edcba34c44f25" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/436906fd248e018403bcda61a9311d9af02912f1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/880287910b1892ed2cb38977893b947382a09d21" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8e8d910e9a3a7fba86140aff4924c30955ab228b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-84wp-3676-5rx2/GHSA-84wp-3676-5rx2.json b/advisories/unreviewed/2024/05/GHSA-84wp-3676-5rx2/GHSA-84wp-3676-5rx2.json new file mode 100644 index 00000000000..10a18559bc8 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-84wp-3676-5rx2/GHSA-84wp-3676-5rx2.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-84wp-3676-5rx2", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47273" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is disabled\n\nWhen only PHY1 is used (for example on Odroid-HC4), the regmap init code\nuses the usb2 ports when doesn't initialize the PHY1 regmap entry.\n\nThis fixes:\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000020\n...\npc : regmap_update_bits_base+0x40/0xa0\nlr : dwc3_meson_g12a_usb2_init_phy+0x4c/0xf8\n...\nCall trace:\nregmap_update_bits_base+0x40/0xa0\ndwc3_meson_g12a_usb2_init_phy+0x4c/0xf8\ndwc3_meson_g12a_usb2_init+0x7c/0xc8\ndwc3_meson_g12a_usb_init+0x28/0x48\ndwc3_meson_g12a_probe+0x298/0x540\nplatform_probe+0x70/0xe0\nreally_probe+0xf0/0x4d8\ndriver_probe_device+0xfc/0x168\n...", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47273" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4d2aa178d2ad2fb156711113790dde13e9aa2376" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/750a0d75564293be3ed50f13ef7f38ab75106421" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d8dd3754e707104a34f8ec595034d503ea8871a2" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-85h7-g6vm-p392/GHSA-85h7-g6vm-p392.json b/advisories/unreviewed/2024/05/GHSA-85h7-g6vm-p392/GHSA-85h7-g6vm-p392.json new file mode 100644 index 00000000000..7f888925e1a --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-85h7-g6vm-p392/GHSA-85h7-g6vm-p392.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-85h7-g6vm-p392", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47289" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: fix NULL pointer dereference\n\nCommit 71f642833284 (\"ACPI: utils: Fix reference counting in\nfor_each_acpi_dev_match()\") started doing \"acpi_dev_put()\" on a pointer\nthat was possibly NULL. That fails miserably, because that helper\ninline function is not set up to handle that case.\n\nJust make acpi_dev_put() silently accept a NULL pointer, rather than\ncalling down to put_device() with an invalid offset off that NULL\npointer.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47289" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/38f54217b423c0101d03a00feec6fb8ec608b12e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cae3fa3d8165761f3000f523b11cfa1cd35206bc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ccf23a0888077a25a0793a746c3941db2a7562e4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fc68f42aa737dc15e7665a4101d4168aadb8e4c4" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8cxw-6695-4jq3/GHSA-8cxw-6695-4jq3.json b/advisories/unreviewed/2024/05/GHSA-8cxw-6695-4jq3/GHSA-8cxw-6695-4jq3.json new file mode 100644 index 00000000000..3855bec5e73 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8cxw-6695-4jq3/GHSA-8cxw-6695-4jq3.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8cxw-6695-4jq3", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47266" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ipoib: Fix warning caused by destroying non-initial netns\n\nAfter the commit 5ce2dced8e95 (\"RDMA/ipoib: Set rtnl_link_ops for ipoib\ninterfaces\"), if the IPoIB device is moved to non-initial netns,\ndestroying that netns lets the device vanish instead of moving it back to\nthe initial netns, This is happening because default_device_exit() skips\nthe interfaces due to having rtnl_link_ops set.\n\nSteps to reporoduce:\n ip netns add foo\n ip link set mlx5_ib0 netns foo\n ip netns delete foo\n\nWARNING: CPU: 1 PID: 704 at net/core/dev.c:11435 netdev_exit+0x3f/0x50\nModules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT\nnf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack\nnf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun d\n fuse\nCPU: 1 PID: 704 Comm: kworker/u64:3 Tainted: G S W 5.13.0-rc1+ #1\nHardware name: Dell Inc. PowerEdge R630/02C2CP, BIOS 2.1.5 04/11/2016\nWorkqueue: netns cleanup_net\nRIP: 0010:netdev_exit+0x3f/0x50\nCode: 48 8b bb 30 01 00 00 e8 ef 81 b1 ff 48 81 fb c0 3a 54 a1 74 13 48\n8b 83 90 00 00 00 48 81 c3 90 00 00 00 48 39 d8 75 02 5b c3 <0f> 0b 5b\nc3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00\nRSP: 0018:ffffb297079d7e08 EFLAGS: 00010206\nRAX: ffff8eb542c00040 RBX: ffff8eb541333150 RCX: 000000008010000d\nRDX: 000000008010000e RSI: 000000008010000d RDI: ffff8eb440042c00\nRBP: ffffb297079d7e48 R08: 0000000000000001 R09: ffffffff9fdeac00\nR10: ffff8eb5003be000 R11: 0000000000000001 R12: ffffffffa1545620\nR13: ffffffffa1545628 R14: 0000000000000000 R15: ffffffffa1543b20\nFS: 0000000000000000(0000) GS:ffff8ed37fa00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005601b5f4c2e8 CR3: 0000001fc8c10002 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ops_exit_list.isra.9+0x36/0x70\n cleanup_net+0x234/0x390\n process_one_work+0x1cb/0x360\n ? process_one_work+0x360/0x360\n worker_thread+0x30/0x370\n ? process_one_work+0x360/0x360\n kthread+0x116/0x130\n ? kthread_park+0x80/0x80\n ret_from_fork+0x22/0x30\n\nTo avoid the above warning and later on the kernel panic that could happen\non shutdown due to a NULL pointer dereference, make sure to set the\nnetns_refund flag that was introduced by commit 3a5ca857079e (\"can: dev:\nMove device back to init netns on owning netns delete\") to properly\nrestore the IPoIB interfaces to the initial netns.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47266" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0a672f7d89db2da17ae02733ccc08458be72a6f8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/64f1fb6acc2ab95982fc4334f351d7576c26f313" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/67cf4e447b5e5e9e94996cb6812ae2828e0e0e27" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a3e74fb9247cd530dca246699d5eb5a691884d32" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8fm5-v3c4-vrmq/GHSA-8fm5-v3c4-vrmq.json b/advisories/unreviewed/2024/05/GHSA-8fm5-v3c4-vrmq/GHSA-8fm5-v3c4-vrmq.json new file mode 100644 index 00000000000..3b137de060e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8fm5-v3c4-vrmq/GHSA-8fm5-v3c4-vrmq.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8fm5-v3c4-vrmq", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47299" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp, net: Fix use-after-free in bpf_xdp_link_release\n\nThe problem occurs between dev_get_by_index() and dev_xdp_attach_link().\nAt this point, dev_xdp_uninstall() is called. Then xdp link will not be\ndetached automatically when dev is released. But link->dev already\npoints to dev, when xdp link is released, dev will still be accessed,\nbut dev has been released.\n\ndev_get_by_index() |\nlink->dev = dev |\n | rtnl_lock()\n | unregister_netdevice_many()\n | dev_xdp_uninstall()\n | rtnl_unlock()\nrtnl_lock(); |\ndev_xdp_attach_link() |\nrtnl_unlock(); |\n | netdev_run_todo() // dev released\nbpf_xdp_link_release() |\n /* access dev. |\n use-after-free */ |\n\n[ 45.966867] BUG: KASAN: use-after-free in bpf_xdp_link_release+0x3b8/0x3d0\n[ 45.967619] Read of size 8 at addr ffff00000f9980c8 by task a.out/732\n[ 45.968297]\n[ 45.968502] CPU: 1 PID: 732 Comm: a.out Not tainted 5.13.0+ #22\n[ 45.969222] Hardware name: linux,dummy-virt (DT)\n[ 45.969795] Call trace:\n[ 45.970106] dump_backtrace+0x0/0x4c8\n[ 45.970564] show_stack+0x30/0x40\n[ 45.970981] dump_stack_lvl+0x120/0x18c\n[ 45.971470] print_address_description.constprop.0+0x74/0x30c\n[ 45.972182] kasan_report+0x1e8/0x200\n[ 45.972659] __asan_report_load8_noabort+0x2c/0x50\n[ 45.973273] bpf_xdp_link_release+0x3b8/0x3d0\n[ 45.973834] bpf_link_free+0xd0/0x188\n[ 45.974315] bpf_link_put+0x1d0/0x218\n[ 45.974790] bpf_link_release+0x3c/0x58\n[ 45.975291] __fput+0x20c/0x7e8\n[ 45.975706] ____fput+0x24/0x30\n[ 45.976117] task_work_run+0x104/0x258\n[ 45.976609] do_notify_resume+0x894/0xaf8\n[ 45.977121] work_pending+0xc/0x328\n[ 45.977575]\n[ 45.977775] The buggy address belongs to the page:\n[ 45.978369] page:fffffc00003e6600 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f998\n[ 45.979522] flags: 0x7fffe0000000000(node=0|zone=0|lastcpupid=0x3ffff)\n[ 45.980349] raw: 07fffe0000000000 fffffc00003e6708 ffff0000dac3c010 0000000000000000\n[ 45.981309] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n[ 45.982259] page dumped because: kasan: bad access detected\n[ 45.982948]\n[ 45.983153] Memory state around the buggy address:\n[ 45.983753] ffff00000f997f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 45.984645] ffff00000f998000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[ 45.985533] >ffff00000f998080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[ 45.986419] ^\n[ 45.987112] ffff00000f998100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[ 45.988006] ffff00000f998180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[ 45.988895] ==================================================================\n[ 45.989773] Disabling lock debugging due to kernel taint\n[ 45.990552] Kernel panic - not syncing: panic_on_warn set ...\n[ 45.991166] CPU: 1 PID: 732 Comm: a.out Tainted: G B 5.13.0+ #22\n[ 45.991929] Hardware name: linux,dummy-virt (DT)\n[ 45.992448] Call trace:\n[ 45.992753] dump_backtrace+0x0/0x4c8\n[ 45.993208] show_stack+0x30/0x40\n[ 45.993627] dump_stack_lvl+0x120/0x18c\n[ 45.994113] dump_stack+0x1c/0x34\n[ 45.994530] panic+0x3a4/0x7d8\n[ 45.994930] end_report+0x194/0x198\n[ 45.995380] kasan_report+0x134/0x200\n[ 45.995850] __asan_report_load8_noabort+0x2c/0x50\n[ 45.996453] bpf_xdp_link_release+0x3b8/0x3d0\n[ 45.997007] bpf_link_free+0xd0/0x188\n[ 45.997474] bpf_link_put+0x1d0/0x218\n[ 45.997942] bpf_link_release+0x3c/0x58\n[ 45.998429] __fput+0x20c/0x7e8\n[ 45.998833] ____fput+0x24/0x30\n[ 45.999247] task_work_run+0x104/0x258\n[ 45.999731] do_notify_resume+0x894/0xaf8\n[ 46.000236] work_pending\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47299" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5acc7d3e8d342858405fbbc671221f676b547ce7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a7537dc73e69ad9c0b67ad24ad3ebee954ed0af6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ca9ba1de8f09976b45ccc8e655c51c6201992139" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8g98-8rxj-3j4q/GHSA-8g98-8rxj-3j4q.json b/advisories/unreviewed/2024/05/GHSA-8g98-8rxj-3j4q/GHSA-8g98-8rxj-3j4q.json new file mode 100644 index 00000000000..e4181ebf227 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8g98-8rxj-3j4q/GHSA-8g98-8rxj-3j4q.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8g98-8rxj-3j4q", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47268" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port\n\nA pending hrtimer may expire after the kthread_worker of tcpm port\nis destroyed, see below kernel dump when do module unload, fix it\nby cancel the 2 hrtimers.\n\n[ 111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880\n[ 111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0\n[ 111.526594] Mem abort info:\n[ 111.526597] ESR = 0x96000047\n[ 111.526600] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 111.526604] SET = 0, FnV = 0\n[ 111.526607] EA = 0, S1PTW = 0\n[ 111.526610] Data abort info:\n[ 111.526612] ISV = 0, ISS = 0x00000047\n[ 111.526615] CM = 0, WnR = 1\n[ 111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000\n[ 111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000\n[ 111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP\n[ 111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci]\n[ 111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36\n[ 111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT)\n[ 111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--)\n[ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390\n[ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4\n[ 111.526703] sp : ffff800010003e20\n[ 111.526706] x29: ffff800010003e20 x28: ffff00017f380180\n[ 111.537156] buffer_io_error: 6 callbacks suppressed\n[ 111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read\n[ 111.539932] x27: ffff00017f3801c0\n[ 111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001\n[ 111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0\n[ 111.548304]\n[ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180\n[ 111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read\n[ 111.554499]\n[ 111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000\n[ 111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read\n[ 111.561218]\n[ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[ 111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read\n[ 111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040\n[ 111.570902] x11: ffff0000c05ac6d8\n[ 111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read\n[ 111.588978] x10: 0000000000000000 x9 : 0000000000040000\n[ 111.588988] x8 : 0000000000000000\n[ 111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read\n[ 111.605766] x7 : ffff00017f384880 x6 : ffff8000118cb880\n[ 111.605777] x5 : ffff00017f384880\n[ 111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read\n[ 111.617086] x4 : 0000000000000000 x3 : ffff0000c2a9f184\n[ 111.617096] x2 : ffff8000118cb880\n[ 111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read\n[ 111.626927] x1 : ffff8000118cb880 x0 : ffff00017f384888\n[ 111.626938] Call trace:\n[ 111.626942] queued_spin_lock_slowpath+0x1a0/0x390\n[ 111.795809] kthread_queue_work+0x30/0xc0\n[ 111.799828] state_machine_timer_handler+0x20/0x30\n[ 111.804624] __hrtimer_run_queues+0x140/0x1e0\n[ 111.808990] hrtimer_interrupt+0xec/0x2c0\n[ 111.813004] arch_timer_handler_phys+0x38/0x50\n[ 111.817456] handle_percpu_devid_irq+0x88/0x150\n[ 111.821991] __handle_domain_irq+0x80/0xe0\n[ 111.826093] gic_handle_irq+0xc0/0x140\n[ 111.829848] el1_irq+0xbc/0x154\n[ 111.832991] arch_cpu_idle+0x1c/0x2c\n[ 111.836572] default_idle_call+0x24/0x6c\n[ 111.840497] do_idle+0x238/0x2ac\n[ 1\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47268" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8p4f-x4p9-vv9j/GHSA-8p4f-x4p9-vv9j.json b/advisories/unreviewed/2024/05/GHSA-8p4f-x4p9-vv9j/GHSA-8p4f-x4p9-vv9j.json new file mode 100644 index 00000000000..89cc70e0b3d --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8p4f-x4p9-vv9j/GHSA-8p4f-x4p9-vv9j.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8p4f-x4p9-vv9j", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47418" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: fix NULL deref in fifo_set_limit()\n\nsyzbot reported another NULL deref in fifo_set_limit() [1]\n\nI could repro the issue with :\n\nunshare -n\ntc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit\ntc qd replace dev lo parent 1:0 pfifo_fast\ntc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit\n\npfifo_fast does not have a change() operation.\nMake fifo_set_limit() more robust about this.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0\nOops: 0010 [#1] PREEMPT SMP KASAN\nCPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at RIP 0xffffffffffffffd6.\nRSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000\nRBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910\nR13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800\nFS: 00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n fifo_set_limit net/sched/sch_fifo.c:242 [inline]\n fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227\n tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418\n qdisc_change net/sched/sch_api.c:1332 [inline]\n tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634\n rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504\n netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340\n netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:724\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2463\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47418" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/08d7056e8e250fd2e67dbea5be5fdecdd75bf6b4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0dd7ddc462b9c2d31eb5a9926a2cc63eaa3e9f52" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/26af64d71b6277841285fa40e3f7164a378dfda9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/560ee196fe9e5037e5015e2cdb14b3aecb1cd7dc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/acff2d182c0768a713cee77442caeb07668bd68f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c951a3be5e8803e93bb49a0aca0d30457d3c1b67" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d07098f45be868a9cdce6c616563c36c64dbbd87" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fb58cd7991747b5e0b110c98c922d7b0e47a1f14" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8q2m-46mc-pjw4/GHSA-8q2m-46mc-pjw4.json b/advisories/unreviewed/2024/05/GHSA-8q2m-46mc-pjw4/GHSA-8q2m-46mc-pjw4.json new file mode 100644 index 00000000000..4f644755cf8 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8q2m-46mc-pjw4/GHSA-8q2m-46mc-pjw4.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8q2m-46mc-pjw4", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47223" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst null pointer dereference\n\nThis patch fixes a tunnel_dst null pointer dereference due to lockless\naccess in the tunnel egress path. When deleting a vlan tunnel the\ntunnel_dst pointer is set to NULL without waiting a grace period (i.e.\nwhile it's still usable) and packets egressing are dereferencing it\nwithout checking. Use READ/WRITE_ONCE to annotate the lockless use of\ntunnel_id, use RCU for accessing tunnel_dst and make sure it is read\nonly once and checked in the egress path. The dst is already properly RCU\nprotected so we don't need to do anything fancy than to make sure\ntunnel_id and tunnel_dst are read only once and checked in the egress path.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47223" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/24a6e55f17aa123bc1fc54b7d3c410b41bc16530" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/58e2071742e38f29f051b709a5cca014ba51166f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a2241e62f6b4a774d8a92048fdf59c45f6c2fe5c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/abb02e05cb1c0a30dd873a29f33bc092067dc35d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ad7feefe7164892db424c45687472db803d87f79" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fe0448a3fad365a747283a00a1d1ad5e8d6675b7" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8v6f-ww2f-hcqw/GHSA-8v6f-ww2f-hcqw.json b/advisories/unreviewed/2024/05/GHSA-8v6f-ww2f-hcqw/GHSA-8v6f-ww2f-hcqw.json new file mode 100644 index 00000000000..112867bff98 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8v6f-ww2f-hcqw/GHSA-8v6f-ww2f-hcqw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8v6f-ww2f-hcqw", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47371" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Fix memory leaks in nexthop notification chain listeners\n\nsyzkaller discovered memory leaks [1] that can be reduced to the\nfollowing commands:\n\n # ip nexthop add id 1 blackhole\n # devlink dev reload pci/0000:06:00.0\n\nAs part of the reload flow, mlxsw will unregister its netdevs and then\nunregister from the nexthop notification chain. Before unregistering\nfrom the notification chain, mlxsw will receive delete notifications for\nnexthop objects using netdevs registered by mlxsw or their uppers. mlxsw\nwill not receive notifications for nexthops using netdevs that are not\ndismantled as part of the reload flow. For example, the blackhole\nnexthop above that internally uses the loopback netdev as its nexthop\ndevice.\n\nOne way to fix this problem is to have listeners flush their nexthop\ntables after unregistering from the notification chain. This is\nerror-prone as evident by this patch and also not symmetric with the\nregistration path where a listener receives a dump of all the existing\nnexthops.\n\nTherefore, fix this problem by replaying delete notifications for the\nlistener being unregistered. This is symmetric to the registration path\nand also consistent with the netdev notification chain.\n\nThe above means that unregister_nexthop_notifier(), like\nregister_nexthop_notifier(), will have to take RTNL in order to iterate\nover the existing nexthops and that any callers of the function cannot\nhold RTNL. This is true for mlxsw and netdevsim, but not for the VXLAN\ndriver. To avoid a deadlock, change the latter to unregister its nexthop\nlistener without holding RTNL, making it symmetric to the registration\npath.\n\n[1]\nunreferenced object 0xffff88806173d600 (size 512):\n comm \"syz-executor.0\", pid 1290, jiffies 4295583142 (age 143.507s)\n hex dump (first 32 bytes):\n 41 9d 1e 60 80 88 ff ff 08 d6 73 61 80 88 ff ff A..`......sa....\n 08 d6 73 61 80 88 ff ff 01 00 00 00 00 00 00 00 ..sa............\n backtrace:\n [] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]\n [] slab_post_alloc_hook+0x96/0x490 mm/slab.h:522\n [] slab_alloc_node mm/slub.c:3206 [inline]\n [] slab_alloc mm/slub.c:3214 [inline]\n [] kmem_cache_alloc_trace+0x163/0x370 mm/slub.c:3231\n [] kmalloc include/linux/slab.h:591 [inline]\n [] kzalloc include/linux/slab.h:721 [inline]\n [] mlxsw_sp_nexthop_obj_group_create drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:4918 [inline]\n [] mlxsw_sp_nexthop_obj_new drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5054 [inline]\n [] mlxsw_sp_nexthop_obj_event+0x59a/0x2910 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5239\n [] notifier_call_chain+0xbd/0x210 kernel/notifier.c:83\n [] blocking_notifier_call_chain kernel/notifier.c:318 [inline]\n [] blocking_notifier_call_chain+0x72/0xa0 kernel/notifier.c:306\n [] call_nexthop_notifiers+0x156/0x310 net/ipv4/nexthop.c:244\n [] insert_nexthop net/ipv4/nexthop.c:2336 [inline]\n [] nexthop_add net/ipv4/nexthop.c:2644 [inline]\n [] rtm_new_nexthop+0x14e8/0x4d10 net/ipv4/nexthop.c:2913\n [] rtnetlink_rcv_msg+0x448/0xbf0 net/core/rtnetlink.c:5572\n [] netlink_rcv_skb+0x173/0x480 net/netlink/af_netlink.c:2504\n [] rtnetlink_rcv+0x22/0x30 net/core/rtnetlink.c:5590\n [] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n [] netlink_unicast+0x5ae/0x7f0 net/netlink/af_netlink.c:1340\n [] netlink_sendmsg+0x8e1/0xe30 net/netlink/af_netlink.c:1929\n [] sock_sendmsg_nosec net/socket.c:704 [inline\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47371" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3106a0847525befe3e22fc723909d1b21eb0d520" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/741760fa6252628a3d3afad439b72437d4b123d9" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8w7w-2rv7-qqw7/GHSA-8w7w-2rv7-qqw7.json b/advisories/unreviewed/2024/05/GHSA-8w7w-2rv7-qqw7/GHSA-8w7w-2rv7-qqw7.json new file mode 100644 index 00000000000..1b1fd2df8ef --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8w7w-2rv7-qqw7/GHSA-8w7w-2rv7-qqw7.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8w7w-2rv7-qqw7", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47327" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails\n\narm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the\nrefcount of the \"smmu\" even though the return value is less than 0.\n\nThe reference counting issue happens in some error handling paths of\narm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get()\nfails, the caller functions forget to decrease the refcount of \"smmu\"\nincreased by arm_smmu_rpm_get(), causing a refcount leak.\n\nFix this issue by calling pm_runtime_resume_and_get() instead of\npm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount\nbalanced in case of failure.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47327" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1adf30f198c26539a62d761e45af72cde570413d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3761ae0d0e549f2acdaf11f49df4ed06d256b20f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c4007596fbdabc29f858dc2e1990858a146b60b2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fbf4daa6f4105e01fbd3868006f65c163365c1e3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fe92c058199067ae90cf2a901ddf3c271893557a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8x7q-xp33-2vvh/GHSA-8x7q-xp33-2vvh.json b/advisories/unreviewed/2024/05/GHSA-8x7q-xp33-2vvh/GHSA-8x7q-xp33-2vvh.json new file mode 100644 index 00000000000..bf74467f07d --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8x7q-xp33-2vvh/GHSA-8x7q-xp33-2vvh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8x7q-xp33-2vvh", + "modified": "2024-05-21T15:31:37Z", + "published": "2024-05-21T15:31:37Z", + "aliases": [ + "CVE-2023-3942" + ], + "details": "An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the attacker to access user data and system parameters from the database.\nThis issue affects \nZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others)\n\n with firmware \nZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other, Standalone service v. 2.1.6-20200907 and possibly others.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3942" + }, + { + "type": "WEB", + "url": "https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-005.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T13:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-95jj-pjw6-q9fr/GHSA-95jj-pjw6-q9fr.json b/advisories/unreviewed/2024/05/GHSA-95jj-pjw6-q9fr/GHSA-95jj-pjw6-q9fr.json new file mode 100644 index 00000000000..3d31835ba56 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-95jj-pjw6-q9fr/GHSA-95jj-pjw6-q9fr.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-95jj-pjw6-q9fr", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47406" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: add error checking to ext4_ext_replay_set_iblocks()\n\nIf the call to ext4_map_blocks() fails due to an corrupted file\nsystem, ext4_ext_replay_set_iblocks() can get stuck in an infinite\nloop. This could be reproduced by running generic/526 with a file\nsystem that has inline_data and fast_commit enabled. The system will\nrepeatedly log to the console:\n\nEXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076\n\nand the stack that it gets stuck in is:\n\n ext4_block_to_path+0xe3/0x130\n ext4_ind_map_blocks+0x93/0x690\n ext4_map_blocks+0x100/0x660\n skip_hole+0x47/0x70\n ext4_ext_replay_set_iblocks+0x223/0x440\n ext4_fc_replay_inode+0x29e/0x3b0\n ext4_fc_replay+0x278/0x550\n do_one_pass+0x646/0xc10\n jbd2_journal_recover+0x14a/0x270\n jbd2_journal_load+0xc4/0x150\n ext4_load_journal+0x1f3/0x490\n ext4_fill_super+0x22d4/0x2c00\n\nWith this patch, generic/526 still fails, but system is no longer\nlocking up in a tight loop. It's likely the root casue is that\nfast_commit replay is corrupting file systems with inline_data, and we\nprobably need to add better error handling in the fast commit replay\ncode path beyond what is done here, which essentially just breaks the\ninfinite loop without reporting the to the higher levels of the code.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47406" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1fd95c05d8f742abfe906620780aee4dbe1a2db0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/27e10c5d31ff1d222c7f797f1ee96d422859ba67" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a63474dbf692dd09b50fed592bc41f6de5f102fc" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-95jq-x6q9-c9cq/GHSA-95jq-x6q9-c9cq.json b/advisories/unreviewed/2024/05/GHSA-95jq-x6q9-c9cq/GHSA-95jq-x6q9-c9cq.json new file mode 100644 index 00000000000..c7ea1659f30 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-95jq-x6q9-c9cq/GHSA-95jq-x6q9-c9cq.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-95jq-x6q9-c9cq", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47365" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix page leak\n\nThere's a loop in afs_extend_writeback() that adds extra pages to a write\nwe want to make to improve the efficiency of the writeback by making it\nlarger. This loop stops, however, if we hit a page we can't write back\nfrom immediately, but it doesn't get rid of the page ref we speculatively\nacquired.\n\nThis was caused by the removal of the cleanup loop when the code switched\nfrom using find_get_pages_contig() to xarray scanning as the latter only\ngets a single page at a time, not a batch.\n\nFix this by putting the page on a ref on an early break from the loop.\nUnfortunately, we can't just add that page to the pagevec we're employing\nas we'll go through that and add those pages to the RPC call.\n\nThis was found by the generic/074 test. It leaks ~4GiB of RAM each time it\nis run - which can be observed with \"top\".", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47365" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/581b2027af0018944ba301d68e7af45c6d1128b5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d130b5fdd42254d92948d06347940276140c927e" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-9fqj-w3wf-p8vf/GHSA-9fqj-w3wf-p8vf.json b/advisories/unreviewed/2024/05/GHSA-9fqj-w3wf-p8vf/GHSA-9fqj-w3wf-p8vf.json new file mode 100644 index 00000000000..f7db2ceef04 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-9fqj-w3wf-p8vf/GHSA-9fqj-w3wf-p8vf.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9fqj-w3wf-p8vf", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47262" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message\n\nUse the __string() machinery provided by the tracing subystem to make a\ncopy of the string literals consumed by the \"nested VM-Enter failed\"\ntracepoint. A complete copy is necessary to ensure that the tracepoint\ncan't outlive the data/memory it consumes and deference stale memory.\n\nBecause the tracepoint itself is defined by kvm, if kvm-intel and/or\nkvm-amd are built as modules, the memory holding the string literals\ndefined by the vendor modules will be freed when the module is unloaded,\nwhereas the tracepoint and its data in the ring buffer will live until\nkvm is unloaded (or \"indefinitely\" if kvm is built-in).\n\nThis bug has existed since the tracepoint was added, but was recently\nexposed by a new check in tracing to detect exactly this type of bug.\n\n fmt: '%s%s\n ' current_buffer: ' vmx_dirty_log_t-140127 [003] .... kvm_nested_vmenter_failed: '\n WARNING: CPU: 3 PID: 140134 at kernel/trace/trace.c:3759 trace_check_vprintf+0x3be/0x3e0\n CPU: 3 PID: 140134 Comm: less Not tainted 5.13.0-rc1-ce2e73ce600a-req #184\n Hardware name: ASUS Q87M-E/Q87M-E, BIOS 1102 03/03/2014\n RIP: 0010:trace_check_vprintf+0x3be/0x3e0\n Code: <0f> 0b 44 8b 4c 24 1c e9 a9 fe ff ff c6 44 02 ff 00 49 8b 97 b0 20\n RSP: 0018:ffffa895cc37bcb0 EFLAGS: 00010282\n RAX: 0000000000000000 RBX: ffffa895cc37bd08 RCX: 0000000000000027\n RDX: 0000000000000027 RSI: 00000000ffffdfff RDI: ffff9766cfad74f8\n RBP: ffffffffc0a041d4 R08: ffff9766cfad74f0 R09: ffffa895cc37bad8\n R10: 0000000000000001 R11: 0000000000000001 R12: ffffffffc0a041d4\n R13: ffffffffc0f4dba8 R14: 0000000000000000 R15: ffff976409f2c000\n FS: 00007f92fa200740(0000) GS:ffff9766cfac0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000559bd11b0000 CR3: 000000019fbaa002 CR4: 00000000001726e0\n Call Trace:\n trace_event_printf+0x5e/0x80\n trace_raw_output_kvm_nested_vmenter_failed+0x3a/0x60 [kvm]\n print_trace_line+0x1dd/0x4e0\n s_show+0x45/0x150\n seq_read_iter+0x2d5/0x4c0\n seq_read+0x106/0x150\n vfs_read+0x98/0x180\n ksys_read+0x5f/0xe0\n do_syscall_64+0x40/0xb0\n entry_SYSCALL_64_after_hwframe+0x44/0xae", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47262" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/796d3bd4ac9316e70c181189318cd2bd98af34bc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9fb088ce13bc3c59a51260207b487db3e556f275" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d046f724bbd725a24007b7e52b2d675249870888" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f31500b0d437a2464ca5972d8f5439e156b74960" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-9h2q-cwg7-7wx8/GHSA-9h2q-cwg7-7wx8.json b/advisories/unreviewed/2024/05/GHSA-9h2q-cwg7-7wx8/GHSA-9h2q-cwg7-7wx8.json new file mode 100644 index 00000000000..ac943e49c3f --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-9h2q-cwg7-7wx8/GHSA-9h2q-cwg7-7wx8.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9h2q-cwg7-7wx8", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47301" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix use-after-free error during reset\n\nCleans the next descriptor to watch (next_to_watch) when cleaning the\nTX ring.\n\nFailure to do so can cause invalid memory accesses. If igb_poll() runs\nwhile the controller is reset this can lead to the driver try to free\na skb that was already freed.\n\n(The crash is harder to reproduce with the igb driver, but the same\npotential problem exists as the code is identical to igc)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47301" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7b292608db23ccbbfbfa50cdb155d01725d7a52e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/88e0720133d42d34851c8721cf5f289a50a8710f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8e24c12f2ff6d32fd9f057382f08e748ec97194c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d3ccb18ed5ac3283c7b31ecc685b499e580d5492" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d7367f781e5a9ca5df9082b15b272b55e76931f8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f153664d8e70c11d0371341613651e1130e20240" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-9rr2-xw5v-w787/GHSA-9rr2-xw5v-w787.json b/advisories/unreviewed/2024/05/GHSA-9rr2-xw5v-w787/GHSA-9rr2-xw5v-w787.json new file mode 100644 index 00000000000..eb224e7afcc --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-9rr2-xw5v-w787/GHSA-9rr2-xw5v-w787.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9rr2-xw5v-w787", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47359" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix soft lockup during fsstress\n\nBelow traces are observed during fsstress and system got hung.\n[ 130.698396] watchdog: BUG: soft lockup - CPU#6 stuck for 26s!", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47359" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/71826b068884050d5fdd37fda857ba1539c513d3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9f6c7aff21f81ae8856da1f63847d1362d523409" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-c227-q7j7-xf88/GHSA-c227-q7j7-xf88.json b/advisories/unreviewed/2024/05/GHSA-c227-q7j7-xf88/GHSA-c227-q7j7-xf88.json new file mode 100644 index 00000000000..c6f18b561a3 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-c227-q7j7-xf88/GHSA-c227-q7j7-xf88.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c227-q7j7-xf88", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47401" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipack: ipoctal: fix stack information leak\n\nThe tty driver name is used also after registering the driver and must\nspecifically not be allocated on the stack to avoid leaking information\nto user space (or triggering an oops).\n\nDrivers should not try to encode topology information in the tty device\nname but this one snuck in through staging without anyone noticing and\nanother driver has since copied this malpractice.\n\nFixing the ABI is a separate issue, but this at least plugs the security\nhole.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47401" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0a9c36a2e06a249acbed64e8e0b84637c2ad7575" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2725925982dc96a78069cd118ea3d66759bfdad7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5f6a309a699675680df15d9b6d389114515b4426" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/741ea2670e021350e54f491106bdaa22dc50e6a0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/829f13d6079cf7a2465522f39acb43033e9b320d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8657158a3b68c85234e6da3d8eae33d6183588b7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a89936cce87d60766a75732a9e7e25c51164f47c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/acb96e782bad427ca4bb1bd94af660acd1462380" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-c5qq-qcr6-82vp/GHSA-c5qq-qcr6-82vp.json b/advisories/unreviewed/2024/05/GHSA-c5qq-qcr6-82vp/GHSA-c5qq-qcr6-82vp.json new file mode 100644 index 00000000000..bd4b3d56d39 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-c5qq-qcr6-82vp/GHSA-c5qq-qcr6-82vp.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5qq-qcr6-82vp", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47342" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix possible UAF when remounting r/o a mmp-protected file system\n\nAfter commit 618f003199c6 (\"ext4: fix memory leak in\next4_fill_super\"), after the file system is remounted read-only, there\nis a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to\npoint at freed memory, which the call to ext4_stop_mmpd() can trip\nover.\n\nFix this by only allowing kmmpd() to exit when it is stopped via\next4_stop_mmpd().\n\nBug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47342" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/61bb4a1c417e5b95d9edb4f887f131de32e419cb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7ed572cdf11081f8f9e07abd4bea56a3f2c4edbd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b663890d854403e566169f7e90aed5cd6ff64f6b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-c655-qwvw-wfqm/GHSA-c655-qwvw-wfqm.json b/advisories/unreviewed/2024/05/GHSA-c655-qwvw-wfqm/GHSA-c655-qwvw-wfqm.json new file mode 100644 index 00000000000..200c956876d --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-c655-qwvw-wfqm/GHSA-c655-qwvw-wfqm.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c655-qwvw-wfqm", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47246" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix page reclaim for dead peer hairpin\n\nWhen adding a hairpin flow, a firmware-side send queue is created for\nthe peer net device, which claims some host memory pages for its\ninternal ring buffer. If the peer net device is removed/unbound before\nthe hairpin flow is deleted, then the send queue is not destroyed which\nleads to a stack trace on pci device remove:\n\n[ 748.005230] mlx5_core 0000:08:00.2: wait_func:1094:(pid 12985): MANAGE_PAGES(0x108) timeout. Will cause a leak of a command resource\n[ 748.005231] mlx5_core 0000:08:00.2: reclaim_pages:514:(pid 12985): failed reclaiming pages: err -110\n[ 748.001835] mlx5_core 0000:08:00.2: mlx5_reclaim_root_pages:653:(pid 12985): failed reclaiming pages (-110) for func id 0x0\n[ 748.002171] ------------[ cut here ]------------\n[ 748.001177] FW pages counter is 4 after reclaiming all pages\n[ 748.001186] WARNING: CPU: 1 PID: 12985 at drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c:685 mlx5_reclaim_startup_pages+0x34b/0x460 [mlx5_core] [ +0.002771] Modules linked in: cls_flower mlx5_ib mlx5_core ptp pps_core act_mirred sch_ingress openvswitch nsh xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay fuse [last unloaded: pps_core]\n[ 748.007225] CPU: 1 PID: 12985 Comm: tee Not tainted 5.12.0+ #1\n[ 748.001376] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[ 748.002315] RIP: 0010:mlx5_reclaim_startup_pages+0x34b/0x460 [mlx5_core]\n[ 748.001679] Code: 28 00 00 00 0f 85 22 01 00 00 48 81 c4 b0 00 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 c7 c7 40 cc 19 a1 e8 9f 71 0e e2 <0f> 0b e9 30 ff ff ff 48 c7 c7 a0 cc 19 a1 e8 8c 71 0e e2 0f 0b e9\n[ 748.003781] RSP: 0018:ffff88815220faf8 EFLAGS: 00010286\n[ 748.001149] RAX: 0000000000000000 RBX: ffff8881b4900280 RCX: 0000000000000000\n[ 748.001445] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed102a441f51\n[ 748.001614] RBP: 00000000000032b9 R08: 0000000000000001 R09: ffffed1054a15ee8\n[ 748.001446] R10: ffff8882a50af73b R11: ffffed1054a15ee7 R12: fffffbfff07c1e30\n[ 748.001447] R13: dffffc0000000000 R14: ffff8881b492cba8 R15: 0000000000000000\n[ 748.001429] FS: 00007f58bd08b580(0000) GS:ffff8882a5080000(0000) knlGS:0000000000000000\n[ 748.001695] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 748.001309] CR2: 000055a026351740 CR3: 00000001d3b48006 CR4: 0000000000370ea0\n[ 748.001506] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 748.001483] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 748.001654] Call Trace:\n[ 748.000576] ? mlx5_satisfy_startup_pages+0x290/0x290 [mlx5_core]\n[ 748.001416] ? mlx5_cmd_teardown_hca+0xa2/0xd0 [mlx5_core]\n[ 748.001354] ? mlx5_cmd_init_hca+0x280/0x280 [mlx5_core]\n[ 748.001203] mlx5_function_teardown+0x30/0x60 [mlx5_core]\n[ 748.001275] mlx5_uninit_one+0xa7/0xc0 [mlx5_core]\n[ 748.001200] remove_one+0x5f/0xc0 [mlx5_core]\n[ 748.001075] pci_device_remove+0x9f/0x1d0\n[ 748.000833] device_release_driver_internal+0x1e0/0x490\n[ 748.001207] unbind_store+0x19f/0x200\n[ 748.000942] ? sysfs_file_ops+0x170/0x170\n[ 748.001000] kernfs_fop_write_iter+0x2bc/0x450\n[ 748.000970] new_sync_write+0x373/0x610\n[ 748.001124] ? new_sync_read+0x600/0x600\n[ 748.001057] ? lock_acquire+0x4d6/0x700\n[ 748.000908] ? lockdep_hardirqs_on_prepare+0x400/0x400\n[ 748.001126] ? fd_install+0x1c9/0x4d0\n[ 748.000951] vfs_write+0x4d0/0x800\n[ 748.000804] ksys_write+0xf9/0x1d0\n[ 748.000868] ? __x64_sys_read+0xb0/0xb0\n[ 748.000811] ? filp_open+0x50/0x50\n[ 748.000919] ? syscall_enter_from_user_mode+0x1d/0x50\n[ 748.001223] do_syscall_64+0x3f/0x80\n[ 748.000892] entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 748.00\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47246" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4b16118665e94c90a3e84a5190486fd0e4eedd74" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a3e5fd9314dfc4314a9567cde96e1aef83a7458a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b374c1304f6d3d4752ad1412427b7bf02bb1fd61" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/be7f3f401d224e1efe8112b2fa8b837eeb8c5e52" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-c97j-6qv5-jqj7/GHSA-c97j-6qv5-jqj7.json b/advisories/unreviewed/2024/05/GHSA-c97j-6qv5-jqj7/GHSA-c97j-6qv5-jqj7.json new file mode 100644 index 00000000000..a9777de8000 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-c97j-6qv5-jqj7/GHSA-c97j-6qv5-jqj7.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c97j-6qv5-jqj7", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47354" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Avoid data corruptions\n\nWait for all dependencies of a job to complete before\nkilling it to avoid data corruptions.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47354" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0687411e2a8858262de2fc4a1d576016fd77292e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0b10ab80695d61422337ede6ff496552d8ace99d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/50d7e03ad487cc45fc85164a299b945a41756ac0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a8e23e3c1ff9ec598ab1b3a941ace6045027781f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c32d0f0e164ffab2a56c7cf8e612584b4b740e2e" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-c989-6j3h-w4c3/GHSA-c989-6j3h-w4c3.json b/advisories/unreviewed/2024/05/GHSA-c989-6j3h-w4c3/GHSA-c989-6j3h-w4c3.json new file mode 100644 index 00000000000..1382964dc24 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-c989-6j3h-w4c3/GHSA-c989-6j3h-w4c3.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c989-6j3h-w4c3", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2024-33529" + ], + "details": "ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33529" + }, + { + "type": "WEB", + "url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170040" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-c9p5-rxmf-r4m6/GHSA-c9p5-rxmf-r4m6.json b/advisories/unreviewed/2024/05/GHSA-c9p5-rxmf-r4m6/GHSA-c9p5-rxmf-r4m6.json new file mode 100644 index 00000000000..ad2b03e77a1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-c9p5-rxmf-r4m6/GHSA-c9p5-rxmf-r4m6.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c9p5-rxmf-r4m6", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47307" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL deref in cifs_compose_mount_options()\n\nThe optional @ref parameter might contain an NULL node_name, so\nprevent dereferencing it in cifs_compose_mount_options().\n\nAddresses-Coverity: 1476408 (\"Explicit null dereferenced\")", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47307" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cc2x-949j-9v5x/GHSA-cc2x-949j-9v5x.json b/advisories/unreviewed/2024/05/GHSA-cc2x-949j-9v5x/GHSA-cc2x-949j-9v5x.json new file mode 100644 index 00000000000..7a1a12c8e99 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cc2x-949j-9v5x/GHSA-cc2x-949j-9v5x.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cc2x-949j-9v5x", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47362" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Update intermediate power state for SI\n\nUpdate the current state as boot state during dpm initialization.\nDuring the subsequent initialization, set_power_state gets called to\ntransition to the final power state. set_power_state refers to values\nfrom the current state and without current state populated, it could\nresult in NULL pointer dereference.\n\nFor ex: on platforms where PCI speed change is supported through ACPI\nATCS method, the link speed of current state needs to be queried before\ndeciding on changing to final power state's link speed. The logic to query\nATCS-support was broken on certain platforms. The issue became visible\nwhen broken ATCS-support logic got fixed with commit\nf9b7f3703ff9 (\"drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)\").\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47362" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/06a18e64256f7aecb5a27df02faa3568fcd3c105" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/68d4fbe6220cd1f3d07cab0a4901e62f8c12cc68" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ab39d3cef526ba09c4c6923b4cd7e6ec1c5d4faa" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cc8f-64j2-hxm7/GHSA-cc8f-64j2-hxm7.json b/advisories/unreviewed/2024/05/GHSA-cc8f-64j2-hxm7/GHSA-cc8f-64j2-hxm7.json new file mode 100644 index 00000000000..1c9bebb47e3 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cc8f-64j2-hxm7/GHSA-cc8f-64j2-hxm7.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cc8f-64j2-hxm7", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47364" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix memory leak in compat_insnlist()\n\n`compat_insnlist()` handles the 32-bit version of the `COMEDI_INSNLIST`\nioctl (whenwhen `CONFIG_COMPAT` is enabled). It allocates memory to\ntemporarily hold an array of `struct comedi_insn` converted from the\n32-bit version in user space. This memory is only being freed if there\nis a fault while filling the array, otherwise it is leaked.\n\nAdd a call to `kfree()` to fix the leak.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47364" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d6a21e4cd6a319b0662cbe4ad6199e276ac776a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bb509a6ffed2c8b0950f637ab5779aa818ed1596" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f217b6c1e28ed0b353634ce4d92a155b80bd1671" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-ch44-784c-7wgq/GHSA-ch44-784c-7wgq.json b/advisories/unreviewed/2024/05/GHSA-ch44-784c-7wgq/GHSA-ch44-784c-7wgq.json new file mode 100644 index 00000000000..3c61b242737 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-ch44-784c-7wgq/GHSA-ch44-784c-7wgq.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ch44-784c-7wgq", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47245" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: Fix out of bounds when parsing TCP options\n\nThe TCP option parser in synproxy (synproxy_parse_options) could read\none byte out of bounds. When the length is 1, the execution flow gets\ninto the loop, reads one byte of the opcode, and if the opcode is\nneither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds\nthe length of 1.\n\nThis fix is inspired by commit 9609dad263f8 (\"ipv4: tcp_input: fix stack\nout of bounds when parsing TCP options.\").\n\nv2 changes:\n\nAdded an early return when length < 0 to avoid calling\nskb_header_pointer with negative length.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47245" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/576c1526b4d83c44ad7b673cb841f36cbc6cb6c4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5fc177ab759418c9537433e63301096e733fb915" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/674b5f0c6a4fc5d3abce877048290cea6091fcb1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6defc77d48eff74075b80ad5925061b2fc010d98" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7d9a9a1a88a3da574e019b4de756bc73337b3b0b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9cdf299ba4e153b5e56187648420de22c6216f02" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e1eb98cfeafdd85537e7e3cefe93ca9bfbcc3ea8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f648089337cb8ed40b2bb96e244f72b9d97dc96b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-chv3-xxv6-8hvr/GHSA-chv3-xxv6-8hvr.json b/advisories/unreviewed/2024/05/GHSA-chv3-xxv6-8hvr/GHSA-chv3-xxv6-8hvr.json new file mode 100644 index 00000000000..55f25c4dbe8 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-chv3-xxv6-8hvr/GHSA-chv3-xxv6-8hvr.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-chv3-xxv6-8hvr", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47334" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/libmasm/module: Fix two use after free in ibmasm_init_one\n\nIn ibmasm_init_one, it calls ibmasm_init_remote_input_dev().\nInside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are\nallocated by input_allocate_device(), and assigned to\nsp->remote.mouse_dev and sp->remote.keybd_dev respectively.\n\nIn the err_free_devices error branch of ibmasm_init_one,\nmouse_dev and keybd_dev are freed by input_free_device(), and return\nerror. Then the execution runs into error_send_message error branch\nof ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called\nto unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.\n\nMy patch add a \"error_init_remote\" label to handle the error of\nibmasm_init_remote_input_dev(), to avoid the uaf bugs.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47334" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1512e7dc5eb08b7d92a12e2bfcd9cb8c4a1ec069" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/29ba8e2ba89ee2862a26d91204dd5fe77ceee25a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/38660031e80eaa6cc9370b031c180612f414b00d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/481a76d4749ee3a27f902ba213fdcbb4bb39720e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5b06ca113bf197aab2ab61288f42506e0049fbab" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7272b591c4cb9327c43443f67b8fbae7657dd9ae" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a7268e8a227d5a4f0bd1584f556246b0224ab274" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b9c87ce3bc6331f82811a8cf8e930423c22523a3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ef1067d2baa847d53c9988510d99fb494de4d12c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cjw7-m4qf-xc59/GHSA-cjw7-m4qf-xc59.json b/advisories/unreviewed/2024/05/GHSA-cjw7-m4qf-xc59/GHSA-cjw7-m4qf-xc59.json new file mode 100644 index 00000000000..e52ffa630f1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cjw7-m4qf-xc59/GHSA-cjw7-m4qf-xc59.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cjw7-m4qf-xc59", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47227" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Prevent state corruption in __fpu__restore_sig()\n\nThe non-compacted slowpath uses __copy_from_user() and copies the entire\nuser buffer into the kernel buffer, verbatim. This means that the kernel\nbuffer may now contain entirely invalid state on which XRSTOR will #GP.\nvalidate_user_xstate_header() can detect some of that corruption, but that\nleaves the onus on callers to clear the buffer.\n\nPrior to XSAVES support, it was possible just to reinitialize the buffer,\ncompletely, but with supervisor states that is not longer possible as the\nbuffer clearing code split got it backwards. Fixing that is possible but\nnot corrupting the state in the first place is more robust.\n\nAvoid corruption of the kernel XSAVE buffer by using copy_user_to_xstate()\nwhich validates the XSAVE header contents before copying the actual states\nto the kernel. copy_user_to_xstate() was previously only called for\ncompacted-format kernel buffers, but it works for both compacted and\nnon-compacted forms.\n\nUsing it for the non-compacted form is slower because of multiple\n__copy_from_user() operations, but that cost is less important than robust\ncode in an already slow path.\n\n[ Changelog polished by Dave Hansen ]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47227" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/076f732b16a5bf842686e1b43ab6021a2d98233e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/484cea4f362e1eeb5c869abbfb5f90eae6421b38" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ec25ea1f3f05d6f8ee51d1277efea986eafd4f2a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cm35-f8g3-r786/GHSA-cm35-f8g3-r786.json b/advisories/unreviewed/2024/05/GHSA-cm35-f8g3-r786/GHSA-cm35-f8g3-r786.json new file mode 100644 index 00000000000..dbff7104463 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cm35-f8g3-r786/GHSA-cm35-f8g3-r786.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cm35-f8g3-r786", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47323" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47323" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0015581a79bbf8e521f85dddb7d3e4a66b9f51d4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2aef07017fae21c3d8acea9656b10e3b9c0f1e04" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/522e75ed63f67e815d4ec0deace67df22d9ce78e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7c56c5508dc20a6b133bc669fc34327a6711c24c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/90b7c141132244e8e49a34a4c1e445cce33e07f4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a173e3b62cf6dd3c4a0a10c8a82eedfcae81a566" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b3c41ea5bc34d8c7b19e230d80e0e555c6f5057d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b4565a8a2d6bffb05bfbec11399d261ec16fe373" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f0feab82f6a0323f54d85e8b512a2be64f83648a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cm8p-x6g5-jp9g/GHSA-cm8p-x6g5-jp9g.json b/advisories/unreviewed/2024/05/GHSA-cm8p-x6g5-jp9g/GHSA-cm8p-x6g5-jp9g.json new file mode 100644 index 00000000000..ffef567d614 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cm8p-x6g5-jp9g/GHSA-cm8p-x6g5-jp9g.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cm8p-x6g5-jp9g", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47220" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: core: fix kernel panic when do reboot\n\nWhen do system reboot, it calls dwc3_shutdown and the whole debugfs\nfor dwc3 has removed first, when the gadget tries to do deinit, and\nremove debugfs for its endpoints, it meets NULL pointer dereference\nissue when call debugfs_lookup. Fix it by removing the whole dwc3\ndebugfs later than dwc3_drd_exit.\n\n[ 2924.958838] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000002\n....\n[ 2925.030994] pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)\n[ 2925.037005] pc : inode_permission+0x2c/0x198\n[ 2925.041281] lr : lookup_one_len_common+0xb0/0xf8\n[ 2925.045903] sp : ffff80001276ba70\n[ 2925.049218] x29: ffff80001276ba70 x28: ffff0000c01f0000 x27: 0000000000000000\n[ 2925.056364] x26: ffff800011791e70 x25: 0000000000000008 x24: dead000000000100\n[ 2925.063510] x23: dead000000000122 x22: 0000000000000000 x21: 0000000000000001\n[ 2925.070652] x20: ffff8000122c6188 x19: 0000000000000000 x18: 0000000000000000\n[ 2925.077797] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000004\n[ 2925.084943] x14: ffffffffffffffff x13: 0000000000000000 x12: 0000000000000030\n[ 2925.092087] x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f x9 : ffff8000102b2420\n[ 2925.099232] x8 : 7f7f7f7f7f7f7f7f x7 : feff73746e2f6f64 x6 : 0000000000008080\n[ 2925.106378] x5 : 61c8864680b583eb x4 : 209e6ec2d263dbb7 x3 : 000074756f307065\n[ 2925.113523] x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff8000122c6188\n[ 2925.120671] Call trace:\n[ 2925.123119] inode_permission+0x2c/0x198\n[ 2925.127042] lookup_one_len_common+0xb0/0xf8\n[ 2925.131315] lookup_one_len_unlocked+0x34/0xb0\n[ 2925.135764] lookup_positive_unlocked+0x14/0x50\n[ 2925.140296] debugfs_lookup+0x68/0xa0\n[ 2925.143964] dwc3_gadget_free_endpoints+0x84/0xb0\n[ 2925.148675] dwc3_gadget_exit+0x28/0x78\n[ 2925.152518] dwc3_drd_exit+0x100/0x1f8\n[ 2925.156267] dwc3_remove+0x11c/0x120\n[ 2925.159851] dwc3_shutdown+0x14/0x20\n[ 2925.163432] platform_shutdown+0x28/0x38\n[ 2925.167360] device_shutdown+0x15c/0x378\n[ 2925.171291] kernel_restart_prepare+0x3c/0x48\n[ 2925.175650] kernel_restart+0x1c/0x68\n[ 2925.179316] __do_sys_reboot+0x218/0x240\n[ 2925.183247] __arm64_sys_reboot+0x28/0x30\n[ 2925.187262] invoke_syscall+0x48/0x100\n[ 2925.191017] el0_svc_common.constprop.0+0x48/0xc8\n[ 2925.195726] do_el0_svc+0x28/0x88\n[ 2925.199045] el0_svc+0x20/0x30\n[ 2925.202104] el0_sync_handler+0xa8/0xb0\n[ 2925.205942] el0_sync+0x148/0x180\n[ 2925.209270] Code: a9025bf5 2a0203f5 121f0056 370802b5 (79400660)\n[ 2925.215372] ---[ end trace 124254d8e485a58b ]---\n[ 2925.220012] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n[ 2925.227676] Kernel Offset: disabled\n[ 2925.231164] CPU features: 0x00001001,20000846\n[ 2925.235521] Memory Limit: none\n[ 2925.238580] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---\n\n(cherry picked from commit 2a042767814bd0edf2619f06fecd374e266ea068)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47220" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/174c27583b3807ac96228c442735b02622d8d1c3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4bf584a03eec674975ee9fe36c8583d9d470dab1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/58b5e02c6ca0e2b7c87cd8023ff786ef3c0eef74" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7f9745ab342bcce5efd5d4d2297d0a3dd9db0eac" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fa8c413e6b74ae5d12daf911c73238c5bdacd8e6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fd7c4bd582494934be15d41aebe0dbe23790605f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ff4c63f3e8cb7af2ce51cc56b031e08fd23c758b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cqgv-cq5q-68pf/GHSA-cqgv-cq5q-68pf.json b/advisories/unreviewed/2024/05/GHSA-cqgv-cq5q-68pf/GHSA-cqgv-cq5q-68pf.json new file mode 100644 index 00000000000..253a9464851 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cqgv-cq5q-68pf/GHSA-cqgv-cq5q-68pf.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cqgv-cq5q-68pf", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47224" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ll_temac: Make sure to free skb when it is completely used\n\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\nefficient way to free the skb buffer when the frame has been transmitted.\nBut in order to avoid freeing the skb while there are still fragments from\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\nfirst.\n\nWithout this, we are doing use-after-free on the DMA side, when the first\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\nremaining BDs are still being processed.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47224" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/019ab7d044d0ebf97e1236bb8935b7809be92358" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6aa32217a9a446275440ee8724b1ecaf1838df47" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6d120ab4dc39a543c6b63361e1d0541c382900a3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e8afe05bd359ebe12a61dbdc94c06c00ea3e8d4b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cv8j-wfmq-4fjv/GHSA-cv8j-wfmq-4fjv.json b/advisories/unreviewed/2024/05/GHSA-cv8j-wfmq-4fjv/GHSA-cv8j-wfmq-4fjv.json new file mode 100644 index 00000000000..0432330e487 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cv8j-wfmq-4fjv/GHSA-cv8j-wfmq-4fjv.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cv8j-wfmq-4fjv", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47295" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix memory leak in tcindex_partial_destroy_work\n\nSyzbot reported memory leak in tcindex_set_parms(). The problem was in\nnon-freed perfect hash in tcindex_partial_destroy_work().\n\nIn tcindex_set_parms() new tcindex_data is allocated and some fields from\nold one are copied to new one, but not the perfect hash. Since\ntcindex_partial_destroy_work() is the destroy function for old\ntcindex_data, we need to free perfect hash to avoid memory leak.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47295" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d7924ce85bae64e7a67c366c7c50840f49f3a62" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8e9662fde6d63c78eb1350f6167f64c9d71a865b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cac71d27745f92ee13f0ecc668ffe151a4a9c9b1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f5051bcece50140abd1a11a2d36dc3ec5484fc32" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cwgg-8744-62hw/GHSA-cwgg-8744-62hw.json b/advisories/unreviewed/2024/05/GHSA-cwgg-8744-62hw/GHSA-cwgg-8744-62hw.json new file mode 100644 index 00000000000..75dce5c52e3 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cwgg-8744-62hw/GHSA-cwgg-8744-62hw.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cwgg-8744-62hw", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47405" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: free raw_report buffers in usbhid_stop\n\nFree the unsent raw_report buffers when the device is removed.\n\nFixes a memory leak reported by syzbot at:\nhttps://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47405" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2b704864c92dcec2b295f276fcfbfb81d9831f81" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/764ac04de056801dfe52a716da63f6e7018e7f3b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7ce4e49146612261265671b1d30d117139021030" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/965147067fa1bedff3ae1f07ce3f89f1a14d2df3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c3156fea4d8a0e643625dff69a0421e872d1fdae" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/efc5c8d29256955cc90d8d570849b2d6121ed09f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f7744fa16b96da57187dc8e5634152d3b63d72de" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f7ac4d24e1610b92689946fa88177673f1e88a3f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cwj6-5v55-7mj7/GHSA-cwj6-5v55-7mj7.json b/advisories/unreviewed/2024/05/GHSA-cwj6-5v55-7mj7/GHSA-cwj6-5v55-7mj7.json new file mode 100644 index 00000000000..db25e9378c5 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cwj6-5v55-7mj7/GHSA-cwj6-5v55-7mj7.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cwj6-5v55-7mj7", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47252" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: Avoid WARN_ON timing related checks\n\nThe soft/batadv interface for a queued OGM can be changed during the time\nthe OGM was queued for transmission and when the OGM is actually\ntransmitted by the worker.\n\nBut WARN_ON must be used to denote kernel bugs and not to print simple\nwarnings. A warning can simply be printed using pr_warn.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47252" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/282baa8104af44e04c4af3e7f933b44267c7f86f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2eb4e0b3631832a4291c8bf4c9db873f60b128c8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/45011f2973f6b52cf50db397bb27bf805f5f0e7f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6031daaaf6d5c359c99dfffa102e332df234ff09" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/77a99aad5bc3ea105806ebae6be3cbadc2fc615e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9f460ae31c4435fd022c443a6029352217a16ac1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e7fbd8184fa9e85f0d648c499841cb7ff6dec9f4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e8e9d2968a9d08bf5c683afca182f1537edebf8d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cwq4-fr9x-6844/GHSA-cwq4-fr9x-6844.json b/advisories/unreviewed/2024/05/GHSA-cwq4-fr9x-6844/GHSA-cwq4-fr9x-6844.json new file mode 100644 index 00000000000..b3d670da335 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cwq4-fr9x-6844/GHSA-cwq4-fr9x-6844.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cwq4-fr9x-6844", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47396" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211-hwsim: fix late beacon hrtimer handling\n\nThomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx\nthat our handling of the hrtimer here is wrong: If the timer fires\nlate (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot)\nthen it tries to actually rearm the timer at the next deadline,\nwhich might be in the past already:\n\n 1 2 3 N N+1\n | | | ... | |\n\n ^ intended to fire here (1)\n ^ next deadline here (2)\n ^ actually fired here\n\nThe next time it fires, it's later, but will still try to schedule\nfor the next deadline (now 3), etc. until it catches up with N,\nbut that might take a long time, causing stalls etc.\n\nNow, all of this is simulation, so we just have to fix it, but\nnote that the behaviour is wrong even per spec, since there's no\nvalue then in sending all those beacons unaligned - they should be\naligned to the TBTT (1, 2, 3, ... in the picture), and if we're a\nbit (or a lot) late, then just resume at that point.\n\nTherefore, change the code to use hrtimer_forward_now() which will\nensure that the next firing of the timer would be at N+1 (in the\npicture), i.e. the next interval point after the current time.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47396" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2c204cf594df3b9468368dc9d0b24d482d93cda7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/313bbd1990b6ddfdaa7da098d0c56b098a833572" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9bee85de2c8155388c09a2e1530a243ec1c96f05" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ed2adf69e29848d1eb9df99633dde655421c92ed" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-f353-mfhf-jfh7/GHSA-f353-mfhf-jfh7.json b/advisories/unreviewed/2024/05/GHSA-f353-mfhf-jfh7/GHSA-f353-mfhf-jfh7.json new file mode 100644 index 00000000000..5261b9a92e9 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-f353-mfhf-jfh7/GHSA-f353-mfhf-jfh7.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f353-mfhf-jfh7", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47329" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix resource leak in case of probe failure\n\nThe driver doesn't clean up all the allocated resources properly when\nscsi_add_host(), megasas_start_aen() function fails during the PCI device\nprobe.\n\nClean up all those resources.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47329" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/04b6b9ea80906e3b41ff120b45db31768947cf72" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0680db6f41920b2c91c7df3cc9cd5968701a6f74" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0c6226601c3e191a44a57d8f9f814b7e5c308959" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b5438f48fdd8e1c3f130d32637511efd32038152" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e623f79691c5104317669ab36ec316a90c05062f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-f7qf-xjhc-mhcj/GHSA-f7qf-xjhc-mhcj.json b/advisories/unreviewed/2024/05/GHSA-f7qf-xjhc-mhcj/GHSA-f7qf-xjhc-mhcj.json new file mode 100644 index 00000000000..3c41e4a3876 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-f7qf-xjhc-mhcj/GHSA-f7qf-xjhc-mhcj.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f7qf-xjhc-mhcj", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47410" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix svm_migrate_fini warning\n\nDevice manager releases device-specific resources when a driver\ndisconnects from a device, devm_memunmap_pages and\ndevm_release_mem_region calls in svm_migrate_fini are redundant.\n\nIt causes below warning trace after patch \"drm/amdgpu: Split\namdgpu_device_fini into early and late\", so remove function\nsvm_migrate_fini.\n\nBUG: https://gitlab.freedesktop.org/drm/amd/-/issues/1718\n\nWARNING: CPU: 1 PID: 3646 at drivers/base/devres.c:795\ndevm_release_action+0x51/0x60\nCall Trace:\n ? memunmap_pages+0x360/0x360\n svm_migrate_fini+0x2d/0x60 [amdgpu]\n kgd2kfd_device_exit+0x23/0xa0 [amdgpu]\n amdgpu_amdkfd_device_fini_sw+0x1d/0x30 [amdgpu]\n amdgpu_device_fini_sw+0x45/0x290 [amdgpu]\n amdgpu_driver_release_kms+0x12/0x30 [amdgpu]\n drm_dev_release+0x20/0x40 [drm]\n release_nodes+0x196/0x1e0\n device_release_driver_internal+0x104/0x1d0\n driver_detach+0x47/0x90\n bus_remove_driver+0x7a/0xd0\n pci_unregister_driver+0x3d/0x90\n amdgpu_exit+0x11/0x20 [amdgpu]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47410" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/197ae17722e989942b36e33e044787877f158574" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ac7d732b24f4061f8a732ada49b054ab38c63e15" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-f8fr-xvcp-37m8/GHSA-f8fr-xvcp-37m8.json b/advisories/unreviewed/2024/05/GHSA-f8fr-xvcp-37m8/GHSA-f8fr-xvcp-37m8.json new file mode 100644 index 00000000000..345755cb136 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-f8fr-xvcp-37m8/GHSA-f8fr-xvcp-37m8.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f8fr-xvcp-37m8", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47318" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\narch_topology: Avoid use-after-free for scale_freq_data\n\nCurrently topology_scale_freq_tick() (which gets called from\nscheduler_tick()) may end up using a pointer to \"struct\nscale_freq_data\", which was previously cleared by\ntopology_clear_scale_freq_source(), as there is no protection in place\nhere. The users of topology_clear_scale_freq_source() though needs a\nguarantee that the previously cleared scale_freq_data isn't used\nanymore, so they can free the related resources.\n\nSince topology_scale_freq_tick() is called from scheduler tick, we don't\nwant to add locking in there. Use the RCU update mechanism instead\n(which is already used by the scheduler's utilization update path) to\nguarantee race free updates here.\n\nsynchronize_rcu() makes sure that all RCU critical sections that started\nbefore it is called, will finish before it returns. And so the callers\nof topology_clear_scale_freq_source() don't need to worry about their\ncallback getting called anymore.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47318" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/83150f5d05f065fb5c12c612f119015cabdcc124" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ccdf7e073170886bc370c613e269de610a794c4a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-fhjr-hghh-2jv9/GHSA-fhjr-hghh-2jv9.json b/advisories/unreviewed/2024/05/GHSA-fhjr-hghh-2jv9/GHSA-fhjr-hghh-2jv9.json new file mode 100644 index 00000000000..94b441d7e33 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-fhjr-hghh-2jv9/GHSA-fhjr-hghh-2jv9.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fhjr-hghh-2jv9", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47321" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: Fix possible use-after-free by calling del_timer_sync()\n\nThis driver's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47321" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1a053c4d716898a53c2e31c574a70ea0c37044a3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4c05dac488a660fe2925c047ecb119e7afaaeb1e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/58606882ad8ec6c39e0f40344b922921ef94ab4d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/66ba9cf929b1c4fabf545bd4c18f6f64e23e46e4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8bec568d7518b1504a602ed5376bb322e4dbb270" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ca96b8ea5e74956071154bdb456778cc3027e79f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d0212f095ab56672f6f36aabc605bda205e1e0bf" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/db222f1477ad5692cd454709b714949807e5d111" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ecd620e0fb1ff7f78fdb593379b2e6938c99707a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-fj34-p4r2-ghh5/GHSA-fj34-p4r2-ghh5.json b/advisories/unreviewed/2024/05/GHSA-fj34-p4r2-ghh5/GHSA-fj34-p4r2-ghh5.json new file mode 100644 index 00000000000..1653f1b1212 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-fj34-p4r2-ghh5/GHSA-fj34-p4r2-ghh5.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fj34-p4r2-ghh5", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47281" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix race of snd_seq_timer_open()\n\nThe timer instance per queue is exclusive, and snd_seq_timer_open()\nshould have managed the concurrent accesses. It looks as if it's\nchecking the already existing timer instance at the beginning, but\nit's not right, because there is no protection, hence any later\nconcurrent call of snd_seq_timer_open() may override the timer\ninstance easily. This may result in UAF, as the leftover timer\ninstance can keep running while the queue itself gets closed, as\nspotted by syzkaller recently.\n\nFor avoiding the race, add a proper check at the assignment of\ntmr->timeri again, and return -EBUSY if it's been already registered.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47281" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/536a7646c00a0f14fee49e5e313109e5da2f6031" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/83e197a8414c0ba545e7e3916ce05f836f349273" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bd7d88b0874f82f7b29d1a53e574cedaf23166ba" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-fmvf-fm6q-vpjg/GHSA-fmvf-fm6q-vpjg.json b/advisories/unreviewed/2024/05/GHSA-fmvf-fm6q-vpjg/GHSA-fmvf-fm6q-vpjg.json new file mode 100644 index 00000000000..72859e1aac4 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-fmvf-fm6q-vpjg/GHSA-fmvf-fm6q-vpjg.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fmvf-fm6q-vpjg", + "modified": "2024-05-21T15:31:38Z", + "published": "2024-05-21T15:31:38Z", + "aliases": [ + "CVE-2024-35386" + ], + "details": "An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35386" + }, + { + "type": "WEB", + "url": "https://github.com/cesanta/mjs/issues/286" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T14:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-fpq3-4hc6-6rvg/GHSA-fpq3-4hc6-6rvg.json b/advisories/unreviewed/2024/05/GHSA-fpq3-4hc6-6rvg/GHSA-fpq3-4hc6-6rvg.json new file mode 100644 index 00000000000..b9aed9c0833 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-fpq3-4hc6-6rvg/GHSA-fpq3-4hc6-6rvg.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fpq3-4hc6-6rvg", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47324" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: Fix possible use-after-free in wdt_startup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47324" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0ac50a76cf3cd63db000648b3b19f3f98b8aaa76" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/146cc288fb80c662c9c35e7bc58325d1ac0a7875" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/63a3dc24bd053792f84cb4eef0168b1266202a02" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/862f2b5a7c38762ac9e369daefbf361a91aca685" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8adbbe6c86bb13e14f8a19e036ae5f4f5661fd90" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a397cb4576fc2fc802562418b3a50b8f67d60d31" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b4ebf4a4692e84163a69444c70ad515de06e2259" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c08a6b31e4917034f0ed0cb457c3bb209576f542" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dc9403097be52d57a5c9c35efa9be79d166a78af" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-fw4j-88v3-6hfw/GHSA-fw4j-88v3-6hfw.json b/advisories/unreviewed/2024/05/GHSA-fw4j-88v3-6hfw/GHSA-fw4j-88v3-6hfw.json new file mode 100644 index 00000000000..1158bc2ea74 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-fw4j-88v3-6hfw/GHSA-fw4j-88v3-6hfw.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fw4j-88v3-6hfw", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47305" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/sync_file: Don't leak fences on merge failure\n\nEach add_fence() call does a dma_fence_get() on the relevant fence. In\nthe error path, we weren't calling dma_fence_put() so all those fences\ngot leaked. Also, in the krealloc_array failure case, we weren't\nfreeing the fences array. Instead, ensure that i and fences are always\nzero-initialized and dma_fence_put() all the fences and kfree(fences) on\nevery error path.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47305" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0d514185ae792d3a1903c8e1a83899aa996705ce" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/19edcd97727aae9362444a859a24d99a8730cb27" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/19f51c2529339280d2c8c6427cd3e21ddf1ac3f8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/41f45e91c92c8480242ea448d54e28c753b13902" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e0355a0ad31a1d677b2a4514206de4902bd550e8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ffe000217c5068c5da07ccb1c0f8cce7ad767435" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-g2fc-vv42-p4pc/GHSA-g2fc-vv42-p4pc.json b/advisories/unreviewed/2024/05/GHSA-g2fc-vv42-p4pc/GHSA-g2fc-vv42-p4pc.json new file mode 100644 index 00000000000..c1dc09e90f5 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-g2fc-vv42-p4pc/GHSA-g2fc-vv42-p4pc.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g2fc-vv42-p4pc", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47399" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup\n\nThe ixgbe driver currently generates a NULL pointer dereference with\nsome machine (online cpus < 63). This is due to the fact that the\nmaximum value of num_xdp_queues is nr_cpu_ids. Code is in\n\"ixgbe_set_rss_queues\"\".\n\nHere's how the problem repeats itself:\nSome machine (online cpus < 63), And user set num_queues to 63 through\nethtool. Code is in the \"ixgbe_set_channels\",\n\tadapter->ring_feature[RING_F_FDIR].limit = count;\n\nIt becomes 63.\n\nWhen user use xdp, \"ixgbe_set_rss_queues\" will set queues num.\n\tadapter->num_rx_queues = rss_i;\n\tadapter->num_tx_queues = rss_i;\n\tadapter->num_xdp_queues = ixgbe_xdp_queues(adapter);\n\nAnd rss_i's value is from\n\tf = &adapter->ring_feature[RING_F_FDIR];\n\trss_i = f->indices = f->limit;\n\nSo \"num_rx_queues\" > \"num_xdp_queues\", when run to \"ixgbe_xdp_setup\",\n\tfor (i = 0; i < adapter->num_rx_queues; i++)\n\t\tif (adapter->xdp_ring[i]->xsk_umem)\n\nIt leads to panic.\n\nCall trace:\n[exception RIP: ixgbe_xdp+368]\nRIP: ffffffffc02a76a0 RSP: ffff9fe16202f8d0 RFLAGS: 00010297\nRAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 000000000000001c RDI: ffffffffa94ead90\nRBP: ffff92f8f24c0c18 R8: 0000000000000000 R9: 0000000000000000\nR10: ffff9fe16202f830 R11: 0000000000000000 R12: ffff92f8f24c0000\nR13: ffff9fe16202fc01 R14: 000000000000000a R15: ffffffffc02a7530\nORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n 7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc\n 8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808\n 9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235\n10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384\n11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd\n12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb\n13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88\n14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319\n15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290\n16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8\n17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64\n18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9\n19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c\n\nSo I fix ixgbe_max_channels so that it will not allow a setting of queues\nto be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup,\ntake the smaller value of num_rx_queues and num_xdp_queues.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47399" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/20f6c4a31a525edd9ea6243712b868ba0e4e331e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2744341dd52e935344ca1b4bf189ba0d182a3e8e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/513e605d7a9ce136886cb42ebb2c40e9a6eb6333" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-g3v4-6rhh-7539/GHSA-g3v4-6rhh-7539.json b/advisories/unreviewed/2024/05/GHSA-g3v4-6rhh-7539/GHSA-g3v4-6rhh-7539.json new file mode 100644 index 00000000000..d4850630c25 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-g3v4-6rhh-7539/GHSA-g3v4-6rhh-7539.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g3v4-6rhh-7539", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47254" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in gfs2_glock_shrink_scan\n\nThe GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to\nremove the glock from the lru list in __gfs2_glock_put().\n\nOn the shrink scan path, the same flag is cleared under lru_lock but because\nof cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the\nput side can be made without deleting the glock from the lru list.\n\nKeep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to\nensure correct behavior on both sides - clear GLF_LRU after list_del under\nlru_lock.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47254" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/38ce329534500bf4ae71f81df6a37a406cf187b4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/86fd5b27db743a0ce0cc245e3a34813b2aa6ec1d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/92869945cc5b78ee8a1ef90336fe070893e3458a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a61156314b66456ab6a291ed5deba1ebd002ab3c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e87ef30fe73e7e10d2c85bdcc778dcec24dca553" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-g595-9cfg-4hxm/GHSA-g595-9cfg-4hxm.json b/advisories/unreviewed/2024/05/GHSA-g595-9cfg-4hxm/GHSA-g595-9cfg-4hxm.json new file mode 100644 index 00000000000..6ebaf65c3c9 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-g595-9cfg-4hxm/GHSA-g595-9cfg-4hxm.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g595-9cfg-4hxm", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47302" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: Fix use-after-free error during reset\n\nCleans the next descriptor to watch (next_to_watch) when cleaning the\nTX ring.\n\nFailure to do so can cause invalid memory accesses. If igc_poll() runs\nwhile the controller is being reset this can lead to the driver try to\nfree a skb that was already freed.\n\nLog message:\n\n [ 101.525242] refcount_t: underflow; use-after-free.\n [ 101.525251] WARNING: CPU: 1 PID: 646 at lib/refcount.c:28 refcount_warn_saturate+0xab/0xf0\n [ 101.525259] Modules linked in: sch_etf(E) sch_mqprio(E) rfkill(E) intel_rapl_msr(E) intel_rapl_common(E)\n x86_pkg_temp_thermal(E) intel_powerclamp(E) coretemp(E) binfmt_misc(E) kvm_intel(E) kvm(E) irqbypass(E) crc32_pclmul(E)\n ghash_clmulni_intel(E) aesni_intel(E) mei_wdt(E) libaes(E) crypto_simd(E) cryptd(E) glue_helper(E) snd_hda_codec_hdmi(E)\n rapl(E) intel_cstate(E) snd_hda_intel(E) snd_intel_dspcfg(E) sg(E) soundwire_intel(E) intel_uncore(E) at24(E)\n soundwire_generic_allocation(E) iTCO_wdt(E) soundwire_cadence(E) intel_pmc_bxt(E) serio_raw(E) snd_hda_codec(E)\n iTCO_vendor_support(E) watchdog(E) snd_hda_core(E) snd_hwdep(E) snd_soc_core(E) snd_compress(E) snd_pcsp(E)\n soundwire_bus(E) snd_pcm(E) evdev(E) snd_timer(E) mei_me(E) snd(E) soundcore(E) mei(E) configfs(E) ip_tables(E) x_tables(E)\n autofs4(E) ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) sd_mod(E) t10_pi(E) crc_t10dif(E) crct10dif_generic(E)\n i915(E) ahci(E) libahci(E) ehci_pci(E) igb(E) xhci_pci(E) ehci_hcd(E)\n [ 101.525303] drm_kms_helper(E) dca(E) xhci_hcd(E) libata(E) crct10dif_pclmul(E) cec(E) crct10dif_common(E) tsn(E) igc(E)\n e1000e(E) ptp(E) i2c_i801(E) crc32c_intel(E) psmouse(E) i2c_algo_bit(E) i2c_smbus(E) scsi_mod(E) lpc_ich(E) pps_core(E)\n usbcore(E) drm(E) button(E) video(E)\n [ 101.525318] CPU: 1 PID: 646 Comm: irq/37-enp7s0-T Tainted: G E 5.10.30-rt37-tsn1-rt-ipipe #ipipe\n [ 101.525320] Hardware name: SIEMENS AG SIMATIC IPC427D/A5E31233588, BIOS V17.02.09 03/31/2017\n [ 101.525322] RIP: 0010:refcount_warn_saturate+0xab/0xf0\n [ 101.525325] Code: 05 31 48 44 01 01 e8 f0 c6 42 00 0f 0b c3 80 3d 1f 48 44 01 00 75 90 48 c7 c7 78 a8 f3 a6 c6 05 0f 48\n 44 01 01 e8 d1 c6 42 00 <0f> 0b c3 80 3d fe 47 44 01 00 0f 85 6d ff ff ff 48 c7 c7 d0 a8 f3\n [ 101.525327] RSP: 0018:ffffbdedc0917cb8 EFLAGS: 00010286\n [ 101.525329] RAX: 0000000000000000 RBX: ffff98fd6becbf40 RCX: 0000000000000001\n [ 101.525330] RDX: 0000000000000001 RSI: ffffffffa6f2700c RDI: 00000000ffffffff\n [ 101.525332] RBP: ffff98fd6becc14c R08: ffffffffa7463d00 R09: ffffbdedc0917c50\n [ 101.525333] R10: ffffffffa74c3578 R11: 0000000000000034 R12: 00000000ffffff00\n [ 101.525335] R13: ffff98fd6b0b1000 R14: 0000000000000039 R15: ffff98fd6be35c40\n [ 101.525337] FS: 0000000000000000(0000) GS:ffff98fd6e240000(0000) knlGS:0000000000000000\n [ 101.525339] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [ 101.525341] CR2: 00007f34135a3a70 CR3: 0000000150210003 CR4: 00000000001706e0\n [ 101.525343] Call Trace:\n [ 101.525346] sock_wfree+0x9c/0xa0\n [ 101.525353] unix_destruct_scm+0x7b/0xa0\n [ 101.525358] skb_release_head_state+0x40/0x90\n [ 101.525362] skb_release_all+0xe/0x30\n [ 101.525364] napi_consume_skb+0x57/0x160\n [ 101.525367] igc_poll+0xb7/0xc80 [igc]\n [ 101.525376] ? sched_clock+0x5/0x10\n [ 101.525381] ? sched_clock_cpu+0xe/0x100\n [ 101.525385] net_rx_action+0x14c/0x410\n [ 101.525388] __do_softirq+0xe9/0x2f4\n [ 101.525391] __local_bh_enable_ip+0xe3/0x110\n [ 101.525395] ? irq_finalize_oneshot.part.47+0xe0/0xe0\n [ 101.525398] irq_forced_thread_fn+0x6a/0x80\n [ 101.525401] irq_thread+0xe8/0x180\n [ 101.525403] ? wake_threads_waitq+0x30/0x30\n [ 101.525406] ? irq_thread_check_affinity+0xd0/0xd0\n [ 101.525408] kthread+0x183/0x1a0\n [ 101.525412] ? kthread_park+0x80/0x80\n [ 101.525415] ret_from_fork+0x22/0x30", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47302" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/56ea7ed103b46970e171eb1c95916f393d64eeff" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a9508e0edfe369ac95d0825bcdca976436ce780f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e15f629036bac005fc758b4ad17896cf2312add4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ea5e36b7367ea0a36ef73a163768f16d2977bd83" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-g7gx-qmj4-gxrc/GHSA-g7gx-qmj4-gxrc.json b/advisories/unreviewed/2024/05/GHSA-g7gx-qmj4-gxrc/GHSA-g7gx-qmj4-gxrc.json new file mode 100644 index 00000000000..cc9de39ebbd --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-g7gx-qmj4-gxrc/GHSA-g7gx-qmj4-gxrc.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g7gx-qmj4-gxrc", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47287" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: auxiliary bus: Fix memory leak when driver_register() fail\n\nIf driver_register() returns with error we need to free the memory\nallocated for auxdrv->driver.name before returning from\n__auxiliary_driver_register()", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47287" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4afa0c22eed33cfe0c590742387f0d16f32412f3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ce5b3de58fc21303722df46551f7eb9a91afb409" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-g8c8-mwvp-jcrr/GHSA-g8c8-mwvp-jcrr.json b/advisories/unreviewed/2024/05/GHSA-g8c8-mwvp-jcrr/GHSA-g8c8-mwvp-jcrr.json new file mode 100644 index 00000000000..919655c0cbc --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-g8c8-mwvp-jcrr/GHSA-g8c8-mwvp-jcrr.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g8c8-mwvp-jcrr", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47429" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s: Fix unrecoverable MCE calling async handler from NMI\n\nThe machine check handler is not considered NMI on 64s. The early\nhandler is the true NMI handler, and then it schedules the\nmachine_check_exception handler to run when interrupts are enabled.\n\nThis works fine except the case of an unrecoverable MCE, where the true\nNMI is taken when MSR[RI] is clear, it can not recover, so it calls\nmachine_check_exception directly so something might be done about it.\n\nCalling an async handler from NMI context can result in irq state and\nother things getting corrupted. This can also trigger the BUG at\n arch/powerpc/include/asm/interrupt.h:168\n BUG_ON(!arch_irq_disabled_regs(regs) && !(regs->msr & MSR_EE));\n\nFix this by making an _async version of the handler which is called\nin the normal case, and a NMI version that is called for unrecoverable\ninterrupts.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47429" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d7a8e38999fbd6910516e44cb43f9f4317e54f73" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f08fb25bc66986b0952724530a640d9970fa52c1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-g97v-hf56-5335/GHSA-g97v-hf56-5335.json b/advisories/unreviewed/2024/05/GHSA-g97v-hf56-5335/GHSA-g97v-hf56-5335.json new file mode 100644 index 00000000000..3788e007351 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-g97v-hf56-5335/GHSA-g97v-hf56-5335.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g97v-hf56-5335", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47258" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix error handling of scsi_host_alloc()\n\nAfter device is initialized via device_initialize(), or its name is set via\ndev_set_name(), the device has to be freed via put_device(). Otherwise\ndevice name will be leaked because it is allocated dynamically in\ndev_set_name().\n\nFix the leak by replacing kfree() with put_device(). Since\nscsi_host_dev_release() properly handles IDA and kthread removal, remove\nspecial-casing these from the error handling as well.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47258" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2dc85045ae65b9302a1d2e2ddd7ce4c030153a6a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/45d83db4728127944b237c0c8248987df9d478e7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/66a834d092930cf41d809c0e989b13cd6f9ca006" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/79296e292d67fa7b5fb8d8c27343683e823872c8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7a696ce1d5d16a33a6cd6400bbcc0339b2460e11" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8958181c1663e24a13434448e7d6b96b5d04900a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/db08ce595dd64ea9859f7d088b51cbfc8e685c66" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-gc8r-vh42-27g4/GHSA-gc8r-vh42-27g4.json b/advisories/unreviewed/2024/05/GHSA-gc8r-vh42-27g4/GHSA-gc8r-vh42-27g4.json new file mode 100644 index 00000000000..e85c79ccaab --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-gc8r-vh42-27g4/GHSA-gc8r-vh42-27g4.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gc8r-vh42-27g4", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47242" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix soft lookup in subflow_error_report()\n\nMaxim reported a soft lookup in subflow_error_report():\n\n watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [swapper/0:0]\n RIP: 0010:native_queued_spin_lock_slowpath\n RSP: 0018:ffffa859c0003bc0 EFLAGS: 00000202\n RAX: 0000000000000101 RBX: 0000000000000001 RCX: 0000000000000000\n RDX: ffff9195c2772d88 RSI: 0000000000000000 RDI: ffff9195c2772d88\n RBP: ffff9195c2772d00 R08: 00000000000067b0 R09: c6e31da9eb1e44f4\n R10: ffff9195ef379700 R11: ffff9195edb50710 R12: ffff9195c2772d88\n R13: ffff9195f500e3d0 R14: ffff9195ef379700 R15: ffff9195ef379700\n FS: 0000000000000000(0000) GS:ffff91961f400000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000c000407000 CR3: 0000000002988000 CR4: 00000000000006f0\n Call Trace:\n \n _raw_spin_lock_bh\n subflow_error_report\n mptcp_subflow_data_available\n __mptcp_move_skbs_from_subflow\n mptcp_data_ready\n tcp_data_queue\n tcp_rcv_established\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n __netif_receive_skb_one_core\n netif_receive_skb\n rtl8139_poll 8139too\n __napi_poll\n net_rx_action\n __do_softirq\n __irq_exit_rcu\n common_interrupt\n \n\nThe calling function - mptcp_subflow_data_available() - can be invoked\nfrom different contexts:\n- plain ssk socket lock\n- ssk socket lock + mptcp_data_lock\n- ssk socket lock + mptcp_data_lock + msk socket lock.\n\nSince subflow_error_report() tries to acquire the mptcp_data_lock, the\nlatter two call chains will cause soft lookup.\n\nThis change addresses the issue moving the error reporting call to\nouter functions, where the held locks list is known and the we can\nacquire only the needed one.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47242" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/27ef25c72373222aaa5fe7b5cd890ae9cfb89a8d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/499ada5073361c631f2a3c4a8aed44d53b6f82ec" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-gg86-5h5f-jrwx/GHSA-gg86-5h5f-jrwx.json b/advisories/unreviewed/2024/05/GHSA-gg86-5h5f-jrwx/GHSA-gg86-5h5f-jrwx.json new file mode 100644 index 00000000000..0a37dccdcb1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-gg86-5h5f-jrwx/GHSA-gg86-5h5f-jrwx.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gg86-5h5f-jrwx", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47253" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix potential memory leak in DMUB hw_init\n\n[Why]\nOn resume we perform DMUB hw_init which allocates memory:\ndm_resume->dm_dmub_hw_init->dc_dmub_srv_create->kzalloc\nThat results in memory leak in suspend/resume scenarios.\n\n[How]\nAllocate memory for the DC wrapper to DMUB only if it was not\nallocated before.\nNo need to reallocate it on suspend/resume.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47253" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9e8c2af010463197315fa54a6c17e74988b5259c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/aa000f828e60ac15d6340f606ec4a673966f5b0b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c5699e2d863f58221044efdc3fa712dd32d55cde" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-gh9h-qjxh-2mh7/GHSA-gh9h-qjxh-2mh7.json b/advisories/unreviewed/2024/05/GHSA-gh9h-qjxh-2mh7/GHSA-gh9h-qjxh-2mh7.json new file mode 100644 index 00000000000..07273de7884 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-gh9h-qjxh-2mh7/GHSA-gh9h-qjxh-2mh7.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gh9h-qjxh-2mh7", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47322" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix an Oops in pnfs_mark_request_commit() when doing O_DIRECT\n\nFix an Oopsable condition in pnfs_mark_request_commit() when we're\nputting a set of writes on the commit list to reschedule them after a\nfailed pNFS attempt.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47322" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3731d44bba8e0116b052b1b374476c5f6dd9a456" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5c7ef8a3705542136a1e19b070e951f0730b2153" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7aec9f862411906f8c27071ba65a1e110ad7d2fd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7c96a2ee45be41d5a167e6332d202086752c36bb" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-ghv4-3pw7-86rj/GHSA-ghv4-3pw7-86rj.json b/advisories/unreviewed/2024/05/GHSA-ghv4-3pw7-86rj/GHSA-ghv4-3pw7-86rj.json new file mode 100644 index 00000000000..367101ff642 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-ghv4-3pw7-86rj/GHSA-ghv4-3pw7-86rj.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ghv4-3pw7-86rj", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47340" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix GPF in diFree\n\nAvoid passing inode with\nJFS_SBI(inode->i_sb)->ipimap == NULL to\ndiFree()[1]. GFP will appear:\n\n\tstruct inode *ipimap = JFS_SBI(ip->i_sb)->ipimap;\n\tstruct inomap *imap = JFS_IP(ipimap)->i_imap;\n\nJFS_IP() will return invalid pointer when ipimap == NULL\n\nCall Trace:\n diFree+0x13d/0x2dc0 fs/jfs/jfs_imap.c:853 [1]\n jfs_evict_inode+0x2c9/0x370 fs/jfs/inode.c:154\n evict+0x2ed/0x750 fs/inode.c:578\n iput_final fs/inode.c:1654 [inline]\n iput.part.0+0x3fe/0x820 fs/inode.c:1680\n iput+0x58/0x70 fs/inode.c:1670", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47340" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3bb27e27240289b47d3466f647a55c567adbdc3a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/42f102ea1943ecb10a0756bf75424de5d1d5beed" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/49def1b0644892e3b113673c13d650c3060b43bc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/745c9a59422c63f661f4374ed5181740db4130a1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7bde24bde490f3139eee147efc6d60d6040fe975" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8018936950360f1c503bb385e158cfc5e4945d18" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9d574f985fe33efd6911f4d752de6f485a1ea732" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a21e5cb1a64c904f1f0ef7b2d386fc7d2b1d2ce2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/aff8d95b69051d0cf4acc3d91f22299fdbb9dfb3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-gr8g-fg7p-9238/GHSA-gr8g-fg7p-9238.json b/advisories/unreviewed/2024/05/GHSA-gr8g-fg7p-9238/GHSA-gr8g-fg7p-9238.json new file mode 100644 index 00000000000..e9c5ba480f0 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-gr8g-fg7p-9238/GHSA-gr8g-fg7p-9238.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gr8g-fg7p-9238", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47304" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix tcp_init_transfer() to not reset icsk_ca_initialized\n\nThis commit fixes a bug (found by syzkaller) that could cause spurious\ndouble-initializations for congestion control modules, which could cause\nmemory leaks or other problems for congestion control modules (like CDG)\nthat allocate memory in their init functions.\n\nThe buggy scenario constructed by syzkaller was something like:\n\n(1) create a TCP socket\n(2) initiate a TFO connect via sendto()\n(3) while socket is in TCP_SYN_SENT, call setsockopt(TCP_CONGESTION),\n which calls:\n tcp_set_congestion_control() ->\n tcp_reinit_congestion_control() ->\n tcp_init_congestion_control()\n(4) receive ACK, connection is established, call tcp_init_transfer(),\n set icsk_ca_initialized=0 (without first calling cc->release()),\n call tcp_init_congestion_control() again.\n\nNote that in this sequence tcp_init_congestion_control() is called\ntwice without a cc->release() call in between. Thus, for CC modules\nthat allocate memory in their init() function, e.g, CDG, a memory leak\nmay occur. The syzkaller tool managed to find a reproducer that\ntriggered such a leak in CDG.\n\nThe bug was introduced when that commit 8919a9b31eb4 (\"tcp: Only init\ncongestion control if not initialized already\")\nintroduced icsk_ca_initialized and set icsk_ca_initialized to 0 in\ntcp_init_transfer(), missing the possibility for a sequence like the\none above, where a process could call setsockopt(TCP_CONGESTION) in\nstate TCP_SYN_SENT (i.e. after the connect() or TFO open sendmsg()),\nwhich would call tcp_init_congestion_control(). It did not intend to\nreset any initialization that the user had already explicitly made;\nit just missed the possibility of that particular sequence (which\nsyzkaller managed to find).", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47304" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ad4ba3404931745a5977ad12db4f0c34080e52f7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/be5d1b61a2ad28c7e57fe8bfa277373e8ecffcdc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fe77b85828ca9ddc42977b79de9e40d18545b4fe" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-grfr-gx46-j682/GHSA-grfr-gx46-j682.json b/advisories/unreviewed/2024/05/GHSA-grfr-gx46-j682/GHSA-grfr-gx46-j682.json new file mode 100644 index 00000000000..31fa53b0482 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-grfr-gx46-j682/GHSA-grfr-gx46-j682.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-grfr-gx46-j682", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47244" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: Fix out of bounds when parsing TCP options\n\nThe TCP option parser in mptcp (mptcp_get_options) could read one byte\nout of bounds. When the length is 1, the execution flow gets into the\nloop, reads one byte of the opcode, and if the opcode is neither\nTCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the\nlength of 1.\n\nThis fix is inspired by commit 9609dad263f8 (\"ipv4: tcp_input: fix stack\nout of bounds when parsing TCP options.\").", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47244" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/07718be265680dcf496347d475ce1a5442f55ad7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/73eeba71dc9932970befa009e68272a3d5ec4a58" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/76e02b8905d0691e89e104a882f3bba7dd0f6037" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-grwp-8243-xpjh/GHSA-grwp-8243-xpjh.json b/advisories/unreviewed/2024/05/GHSA-grwp-8243-xpjh/GHSA-grwp-8243-xpjh.json new file mode 100644 index 00000000000..ebd5259053d --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-grwp-8243-xpjh/GHSA-grwp-8243-xpjh.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-grwp-8243-xpjh", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47251" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211: fix skb length check in ieee80211_scan_rx()\n\nReplace hard-coded compile-time constants for header length check\nwith dynamic determination based on the frame type. Otherwise, we\nhit a validation WARN_ON in cfg80211 later.\n\n[style fixes, reword commit message]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47251" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5a1cd67a801cf5ef989c4783e07b86a25b143126" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d1b949c70206178b12027f66edc088d40375b5cb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e298aa358f0ca658406d524b6639fe389cb6e11e" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-gx2j-3fvm-rqj3/GHSA-gx2j-3fvm-rqj3.json b/advisories/unreviewed/2024/05/GHSA-gx2j-3fvm-rqj3/GHSA-gx2j-3fvm-rqj3.json new file mode 100644 index 00000000000..3739e6e759c --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-gx2j-3fvm-rqj3/GHSA-gx2j-3fvm-rqj3.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gx2j-3fvm-rqj3", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47420" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix a potential ttm->sg memory leak\n\nMemory is allocated for ttm->sg by kmalloc in kfd_mem_dmamap_userptr,\nbut isn't freed by kfree in kfd_mem_dmaunmap_userptr. Free it!", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47420" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7e5ce6029b627efb4a004746cfdc1eeff850e6eb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b072ef1215aca33186e3a10109e872e528a9e516" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-h3hv-fpf3-c5jm/GHSA-h3hv-fpf3-c5jm.json b/advisories/unreviewed/2024/05/GHSA-h3hv-fpf3-c5jm/GHSA-h3hv-fpf3-c5jm.json new file mode 100644 index 00000000000..c82b2d43569 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-h3hv-fpf3-c5jm/GHSA-h3hv-fpf3-c5jm.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h3hv-fpf3-c5jm", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47336" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmackfs: restrict bytes count in smk_set_cipso()\n\nOops, I failed to update subject line.\n\nFrom 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001\nDate: Mon, 12 Apr 2021 22:25:06 +0900\nSubject: [PATCH] smackfs: restrict bytes count in smk_set_cipso()\n\nCommit 7ef4c19d245f3dc2 (\"smackfs: restrict bytes count in smackfs write\nfunctions\") missed that count > SMK_CIPSOMAX check applies to only\nformat == SMK_FIXED24_FMT case.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47336" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/135122f174c357b7a3e58f40fa5792156c5e93e6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/258fd821f69378453c071b9dd767b298810fc766" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3780348c1a0e14ffefcaf1fc521f815bcaac94b0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/49ec114a6e62d8d320037ce71c1aaf9650b3cafd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5c2dca9a7a7ff6a2df34158903515e2e4fd3d2b2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5f9880403e6b71d56924748ba331daf836243fca" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8f5c773a2871cf446e3f36b2834fb25bbb28512b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cbd87ba6a13891acf6180783f8234a8b7a3e3d4d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-h423-6g7m-qpqq/GHSA-h423-6g7m-qpqq.json b/advisories/unreviewed/2024/05/GHSA-h423-6g7m-qpqq/GHSA-h423-6g7m-qpqq.json new file mode 100644 index 00000000000..597e8e8fe67 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-h423-6g7m-qpqq/GHSA-h423-6g7m-qpqq.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h423-6g7m-qpqq", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47222" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst refcnt when egressing\n\nThe egress tunnel code uses dst_clone() and directly sets the result\nwhich is wrong because the entry might have 0 refcnt or be already deleted,\ncausing number of problems. It also triggers the WARN_ON() in dst_hold()[1]\nwhen a refcnt couldn't be taken. Fix it by using dst_hold_safe() and\nchecking if a reference was actually taken before setting the dst.\n\n[1] dmesg WARN_ON log and following refcnt errors\n WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net\n CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 <0f> 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49\n RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0\n RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001\n R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000\n R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401\n FS: 0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0\n Call Trace:\n br_handle_vlan+0xbc/0xca [bridge]\n __br_forward+0x23/0x164 [bridge]\n deliver_clone+0x41/0x48 [bridge]\n br_handle_frame_finish+0x36f/0x3aa [bridge]\n ? skb_dst+0x2e/0x38 [bridge]\n ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]\n ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n br_handle_frame+0x2c3/0x377 [bridge]\n ? __skb_pull+0x33/0x51\n ? vlan_do_receive+0x4f/0x36a\n ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n __netif_receive_skb_core+0x539/0x7c6\n ? __list_del_entry_valid+0x16e/0x1c2\n __netif_receive_skb_list_core+0x6d/0xd6\n netif_receive_skb_list_internal+0x1d9/0x1fa\n gro_normal_list+0x22/0x3e\n dev_gro_receive+0x55b/0x600\n ? detach_buf_split+0x58/0x140\n napi_gro_receive+0x94/0x12e\n virtnet_poll+0x15d/0x315 [virtio_net]\n __napi_poll+0x2c/0x1c9\n net_rx_action+0xe6/0x1fb\n __do_softirq+0x115/0x2d8\n run_ksoftirqd+0x18/0x20\n smpboot_thread_fn+0x183/0x19c\n ? smpboot_unregister_percpu_thread+0x66/0x66\n kthread+0x10a/0x10f\n ? kthread_mod_delayed_work+0xb6/0xb6\n ret_from_fork+0x22/0x30\n ---[ end trace 49f61b07f775fd2b ]---\n dst_release: dst:00000000c02d677a refcnt:-1\n dst_release underflow", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47222" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-h6gr-4677-26p9/GHSA-h6gr-4677-26p9.json b/advisories/unreviewed/2024/05/GHSA-h6gr-4677-26p9/GHSA-h6gr-4677-26p9.json new file mode 100644 index 00000000000..b06b84d9e95 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-h6gr-4677-26p9/GHSA-h6gr-4677-26p9.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h6gr-4677-26p9", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47384" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read tmp value sufficient for\n(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47384" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6cb01fe630eaffc5a2c3f7364436caddba286623" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/746011193f44f97f8784edcf8327c587946745fc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7c4fd5de39f273626a2b0f3a446d2cc85cd47616" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dd4d747ef05addab887dc8ff0d6ab9860bbcd783" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-h7hm-j4cr-jwhq/GHSA-h7hm-j4cr-jwhq.json b/advisories/unreviewed/2024/05/GHSA-h7hm-j4cr-jwhq/GHSA-h7hm-j4cr-jwhq.json new file mode 100644 index 00000000000..7a7a788333e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-h7hm-j4cr-jwhq/GHSA-h7hm-j4cr-jwhq.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h7hm-j4cr-jwhq", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47383" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: Fix out-of-bound vmalloc access in imageblit\n\nThis issue happens when a userspace program does an ioctl\nFBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct\ncontaining only the fields xres, yres, and bits_per_pixel\nwith values.\n\nIf this struct is the same as the previous ioctl, the\nvc_resize() detects it and doesn't call the resize_screen(),\nleaving the fb_var_screeninfo incomplete. And this leads to\nthe updatescrollmode() calculates a wrong value to\nfbcon_display->vrows, which makes the real_y() return a\nwrong value of y, and that value, eventually, causes\nthe imageblit to access an out-of-bound address value.\n\nTo solve this issue I made the resize_screen() be called\neven if the screen does not need any resizing, so it will\n\"fix and fill\" the fb_var_screeninfo independently.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47383" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/067c694d06040db6f0c65281bb358452ca6d85b9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3b0c406124719b625b1aba431659f5cdc24a982c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/699d926585daa6ec44be556cdc1ab89e5d54557b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/70aed03b1d5a5df974f456cdc8eedb213c94bb8b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7e71fcedfda6f7de18f850a6b36e78d78b04476f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/883f7897a25e3ce14a7f274ca4c73f49ac84002a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8a6a240f52e14356386030d8958ae8b1761d2325" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d570c48dd37dbe8fc6875d4461d01a9554ae2560" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-h9p9-4f35-pxjm/GHSA-h9p9-4f35-pxjm.json b/advisories/unreviewed/2024/05/GHSA-h9p9-4f35-pxjm/GHSA-h9p9-4f35-pxjm.json new file mode 100644 index 00000000000..a40d5c25424 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-h9p9-4f35-pxjm/GHSA-h9p9-4f35-pxjm.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h9p9-4f35-pxjm", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47419" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_taprio: properly cancel timer from taprio_destroy()\n\nThere is a comment in qdisc_create() about us not calling ops->reset()\nin some cases.\n\nerr_out4:\n\t/*\n\t * Any broken qdiscs that would require a ops->reset() here?\n\t * The qdisc was never in action so it shouldn't be necessary.\n\t */\n\nAs taprio sets a timer before actually receiving a packet, we need\nto cancel it from ops->destroy, just in case ops->reset has not\nbeen called.\n\nsyzbot reported:\n\nODEBUG: free active (active state 0) object type: hrtimer hint: advance_sched+0x0/0x9a0 arch/x86/include/asm/atomic64_64.h:22\nWARNING: CPU: 0 PID: 8441 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505\nModules linked in:\nCPU: 0 PID: 8441 Comm: syz-executor813 Not tainted 5.14.0-rc6-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505\nCode: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 d3 e3 89 4c 89 ee 48 c7 c7 e0 c7 e3 89 e8 5b 86 11 05 <0f> 0b 83 05 85 03 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3\nRSP: 0018:ffffc9000130f330 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000\nRDX: ffff88802baeb880 RSI: ffffffff815d87b5 RDI: fffff52000261e58\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff815d25ee R11: 0000000000000000 R12: ffffffff898dd020\nR13: ffffffff89e3ce20 R14: ffffffff81653630 R15: dffffc0000000000\nFS: 0000000000f0d300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffb64b3e000 CR3: 0000000036557000 CR4: 00000000001506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n __debug_check_no_obj_freed lib/debugobjects.c:987 [inline]\n debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1018\n slab_free_hook mm/slub.c:1603 [inline]\n slab_free_freelist_hook+0x171/0x240 mm/slub.c:1653\n slab_free mm/slub.c:3213 [inline]\n kfree+0xe4/0x540 mm/slub.c:4267\n qdisc_create+0xbcf/0x1320 net/sched/sch_api.c:1299\n tc_modify_qdisc+0x4c8/0x1a60 net/sched/sch_api.c:1663\n rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504\n netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340\n netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:724\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2403\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2457\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47419" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3ec73ffeef54596c32aff0e73fe60971b9c8b866" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7a1c1af341041221b3acb9d7036cc2b43e0efa75" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a56d447f196fa9973c568f54c0d76d5391c3b0c0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c951c08a5996365aecbc5f1a9bddec3905e1ddfc" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hf7w-m8fc-q8fp/GHSA-hf7w-m8fc-q8fp.json b/advisories/unreviewed/2024/05/GHSA-hf7w-m8fc-q8fp/GHSA-hf7w-m8fc-q8fp.json new file mode 100644 index 00000000000..2ffa3d9d54e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hf7w-m8fc-q8fp/GHSA-hf7w-m8fc-q8fp.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hf7w-m8fc-q8fp", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47424" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix freeing of uninitialized misc IRQ vector\n\nWhen VSI set up failed in i40e_probe() as part of PF switch set up\ndriver was trying to free misc IRQ vectors in\ni40e_clear_interrupt_scheme and produced a kernel Oops:\n\n Trying to free already-free IRQ 266\n WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300\n Workqueue: events work_for_cpu_fn\n RIP: 0010:__free_irq+0x9a/0x300\n Call Trace:\n ? synchronize_irq+0x3a/0xa0\n free_irq+0x2e/0x60\n i40e_clear_interrupt_scheme+0x53/0x190 [i40e]\n i40e_probe.part.108+0x134b/0x1a40 [i40e]\n ? kmem_cache_alloc+0x158/0x1c0\n ? acpi_ut_update_ref_count.part.1+0x8e/0x345\n ? acpi_ut_update_object_reference+0x15e/0x1e2\n ? strstr+0x21/0x70\n ? irq_get_irq_data+0xa/0x20\n ? mp_check_pin_attr+0x13/0xc0\n ? irq_get_irq_data+0xa/0x20\n ? mp_map_pin_to_irq+0xd3/0x2f0\n ? acpi_register_gsi_ioapic+0x93/0x170\n ? pci_conf1_read+0xa4/0x100\n ? pci_bus_read_config_word+0x49/0x70\n ? do_pci_enable_device+0xcc/0x100\n local_pci_probe+0x41/0x90\n work_for_cpu_fn+0x16/0x20\n process_one_work+0x1a7/0x360\n worker_thread+0x1cf/0x390\n ? create_worker+0x1a0/0x1a0\n kthread+0x112/0x130\n ? kthread_flush_work_fn+0x10/0x10\n ret_from_fork+0x1f/0x40\n\nThe problem is that at that point misc IRQ vectors\nwere not allocated yet and we get a call trace\nthat driver is trying to free already free IRQ vectors.\n\nAdd a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED\nPF state before calling i40e_free_misc_vector. This state is set only if\nmisc IRQ vectors were properly initialized.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47424" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/17063cac4088b8e2fc0f633abddca5426ed58312" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2e5a20573a926302b233b0c2e1077f5debc7ab2e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/60ad4cde0ad28921f9ea25b0201c774b95ffa4b4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/75099439209d3cda439a1d9b00d19a50f0066fef" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/97aeed72af4f83ae51534f0a2473ff52f8d66236" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hh94-frj2-pf9r/GHSA-hh94-frj2-pf9r.json b/advisories/unreviewed/2024/05/GHSA-hh94-frj2-pf9r/GHSA-hh94-frj2-pf9r.json new file mode 100644 index 00000000000..75c8e5d0d40 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hh94-frj2-pf9r/GHSA-hh94-frj2-pf9r.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hh94-frj2-pf9r", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47241" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: strset: fix message length calculation\n\nOuter nest for ETHTOOL_A_STRSET_STRINGSETS is not accounted for.\nThis may result in ETHTOOL_MSG_STRSET_GET producing a warning like:\n\n calculated message payload length (684) not sufficient\n WARNING: CPU: 0 PID: 30967 at net/ethtool/netlink.c:369 ethnl_default_doit+0x87a/0xa20\n\nand a splat.\n\nAs usually with such warnings three conditions must be met for the warning\nto trigger:\n - there must be no skb size rounding up (e.g. reply_size of 684);\n - string set must be per-device (so that the header gets populated);\n - the device name must be at least 12 characters long.\n\nall in all with current user space it looks like reading priv flags\nis the only place this could potentially happen. Or with syzbot :)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47241" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cfc7f0e70d649e6d2233fba0d9390b525677d971" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e175aef902697826d344ce3a12189329848fe898" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fb3a948143688e14e2cfd2a2812877923d0e5e92" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hjv5-8xv5-vmfp/GHSA-hjv5-8xv5-vmfp.json b/advisories/unreviewed/2024/05/GHSA-hjv5-8xv5-vmfp/GHSA-hjv5-8xv5-vmfp.json new file mode 100644 index 00000000000..bbac22b6d65 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hjv5-8xv5-vmfp/GHSA-hjv5-8xv5-vmfp.json @@ -0,0 +1,71 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hjv5-8xv5-vmfp", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47315" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: fsl_ifc: fix leak of IO mapping on probe failure\n\nOn probe error the driver should unmap the IO memory. Smatch reports:\n\n drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47315" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/28f71fd81ebd3b386bf5c7c5539664156f7d72c1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3b132ab67fc7a358fff35e808fa65d4bea452521" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6b3b002de90738e3c85853a682ce7e0fa078d42b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/83af5816308b490b05fc8fa27fc1bdc769df200a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d071d270afba468708faca5f7b6d9e656f75e27" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/94bc2fe46102d1e060fc749c0c19511e76c9995f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b7a2bcb4a3731d68f938207f75ed3e1d41774510" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bd051b3e184fa56eeb6276ee913ba4d48069024b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d0d04b95e8ed0223844a1d58497c686fe2e4a955" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d9213d4f372d30b5bc4d921795d6bed0c0e3eebf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hm5p-668j-x4q6/GHSA-hm5p-668j-x4q6.json b/advisories/unreviewed/2024/05/GHSA-hm5p-668j-x4q6/GHSA-hm5p-668j-x4q6.json new file mode 100644 index 00000000000..c63f63278e6 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hm5p-668j-x4q6/GHSA-hm5p-668j-x4q6.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hm5p-668j-x4q6", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47344" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: zr364xx: fix memory leak in zr364xx_start_readpipe\n\nsyzbot reported memory leak in zr364xx driver.\nThe problem was in non-freed urb in case of\nusb_submit_urb() fail.\n\nbacktrace:\n [] kmalloc include/linux/slab.h:561 [inline]\n [] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74\n [] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022\n [] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline]\n [] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516\n [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n [] really_probe+0x159/0x500 drivers/base/dd.c:576", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47344" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/021c294dff030f3ba38eb81e400ba123db32ecbc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0a045eac8d0427b64577a24d74bb8347c905ac65" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0edd6759167295ea9969e89283b81017b4c688aa" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5f3f81f1c96b501d180021c23c25e9f48eaab235" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b0633051a6cb24186ff04ce1af99c7de18c1987e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bbc80a972a3c5d7eba3f6c9c07af8fea42f5c513" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c57b2bd3247925e253729dce283d6bf6abc9339d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c57bfd8000d7677bf435873b440eec0c47f73a08" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d69b39d89f362cfeeb54a68690768d0d257b2c8f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hq29-fr4v-2847/GHSA-hq29-fr4v-2847.json b/advisories/unreviewed/2024/05/GHSA-hq29-fr4v-2847/GHSA-hq29-fr4v-2847.json new file mode 100644 index 00000000000..a14c8f3cfe3 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hq29-fr4v-2847/GHSA-hq29-fr4v-2847.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hq29-fr4v-2847", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47369" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: fix NULL deref in qeth_clear_working_pool_list()\n\nWhen qeth_set_online() calls qeth_clear_working_pool_list() to roll\nback after an error exit from qeth_hardsetup_card(), we are at risk of\naccessing card->qdio.in_q before it was allocated by\nqeth_alloc_qdio_queues() via qeth_mpc_initialize().\n\nqeth_clear_working_pool_list() then dereferences NULL, and by writing to\nqueue->bufs[i].pool_entry scribbles all over the CPU's lowcore.\nResulting in a crash when those lowcore areas are used next (eg. on\nthe next machine-check interrupt).\n\nSuch a scenario would typically happen when the device is first set\nonline and its queues aren't allocated yet. An early IO error or certain\nmisconfigs (eg. mismatched transport mode, bad portno) then cause us to\nerror out from qeth_hardsetup_card() with card->qdio.in_q still being\nNULL.\n\nFix it by checking the pointer for NULL before accessing it.\n\nNote that we also have (rare) paths inside qeth_mpc_initialize() where\na configuration change can cause us to free the existing queues,\nexpecting that subsequent code will allocate them again. If we then\nerror out before that re-allocation happens, the same bug occurs.\n\nRoot-caused-by: Heiko Carstens ", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47369" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/248f064af222a1f97ee02c84a98013dfbccad386" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9b00fb12cdc9d8d1c3ffe82a78e74738127803fc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/db94f89e1dadf693c15c2d60de0c34777cea5779" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hw2j-3fc3-hf74/GHSA-hw2j-3fc3-hf74.json b/advisories/unreviewed/2024/05/GHSA-hw2j-3fc3-hf74/GHSA-hw2j-3fc3-hf74.json new file mode 100644 index 00000000000..e76e71cdf15 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hw2j-3fc3-hf74/GHSA-hw2j-3fc3-hf74.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hw2j-3fc3-hf74", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47286" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: core: Validate channel ID when processing command completions\n\nMHI reads the channel ID from the event ring element sent by the\ndevice which can be any value between 0 and 255. In order to\nprevent any out of bound accesses, add a check against the maximum\nnumber of channels supported by the controller and those channels\nnot configured yet so as to skip processing of that event ring\nelement.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47286" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3efec3b4b16fc7af25676a94230a8ab2a3bb867c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/546362a9ef2ef40b57c6605f14e88ced507f8dd0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/aed4f5b51aba41e2afd7cfda20a0571a6a67dfe9" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hxcf-7gwm-65p8/GHSA-hxcf-7gwm-65p8.json b/advisories/unreviewed/2024/05/GHSA-hxcf-7gwm-65p8/GHSA-hxcf-7gwm-65p8.json new file mode 100644 index 00000000000..30594a50036 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hxcf-7gwm-65p8/GHSA-hxcf-7gwm-65p8.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hxcf-7gwm-65p8", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47352" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: Add validation for used length\n\nThis adds validation for used length (might come\nfrom an untrusted device) to avoid data corruption\nor loss.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47352" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3133e01514c3c498f2b01ff210ee6134b70c663c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ad993a95c508417acdeb15244109e009e50d8758" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ba710baa1cc1b17a0483f7befe03e696efd17292" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c92298d228f61589dd21657af2bea95fc866b813" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hxrw-3c72-p9hc/GHSA-hxrw-3c72-p9hc.json b/advisories/unreviewed/2024/05/GHSA-hxrw-3c72-p9hc/GHSA-hxrw-3c72-p9hc.json new file mode 100644 index 00000000000..fbe24baeab1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hxrw-3c72-p9hc/GHSA-hxrw-3c72-p9hc.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hxrw-3c72-p9hc", + "modified": "2024-05-21T15:31:38Z", + "published": "2024-05-21T15:31:38Z", + "aliases": [ + "CVE-2024-4452" + ], + "details": "The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4452" + }, + { + "type": "WEB", + "url": "https://wpmet.com/plugin/elementskit" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/488ac848-786e-4100-a387-5a40e8fc4175?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T14:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-j2r5-7q65-9hjq/GHSA-j2r5-7q65-9hjq.json b/advisories/unreviewed/2024/05/GHSA-j2r5-7q65-9hjq/GHSA-j2r5-7q65-9hjq.json new file mode 100644 index 00000000000..c6fbd9ce670 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-j2r5-7q65-9hjq/GHSA-j2r5-7q65-9hjq.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j2r5-7q65-9hjq", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2024-33526" + ], + "details": "A Stored Cross-site Scripting (XSS) vulnerability in the \"Import of user role and title of user role\" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33526" + }, + { + "type": "WEB", + "url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-j469-qwv3-79fj/GHSA-j469-qwv3-79fj.json b/advisories/unreviewed/2024/05/GHSA-j469-qwv3-79fj/GHSA-j469-qwv3-79fj.json new file mode 100644 index 00000000000..ee6e4b5cde9 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-j469-qwv3-79fj/GHSA-j469-qwv3-79fj.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j469-qwv3-79fj", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47355" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: nicstar: Fix possible use-after-free in nicstar_cleanup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47355" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2f958b6f6ba0854b39be748d21dfe71e0fe6580f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/34e7434ba4e97f4b85c1423a59b2922ba7dff2ea" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4e2a0848ea2cab0716d46f85a8ccd5fa9a493e51" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5b991df8881088448cb223e769e37cab8dd40706" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/99779c9d9ffc7775da6f7fd8a7c93ac61657bed5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a7a7b2848312cc4c3a42b6e42a8ab2e441857aba" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a7f7c42e31157d1f0871d6a8e1a0b73a6b4ea785" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bdf5334250c69fabf555b7322c75249ea7d5f148" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c471569632654e57c83512e0fc1ba0dbb4544ad6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-j8cp-h624-v86v/GHSA-j8cp-h624-v86v.json b/advisories/unreviewed/2024/05/GHSA-j8cp-h624-v86v/GHSA-j8cp-h624-v86v.json new file mode 100644 index 00000000000..c9d7b8a98b3 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-j8cp-h624-v86v/GHSA-j8cp-h624-v86v.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j8cp-h624-v86v", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47416" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: mdio: fix memory leak\n\nSyzbot reported memory leak in MDIO bus interface, the problem was in\nwrong state logic.\n\nMDIOBUS_ALLOCATED indicates 2 states:\n\t1. Bus is only allocated\n\t2. Bus allocated and __mdiobus_register() fails, but\n\t device_register() was called\n\nIn case of device_register() has been called we should call put_device()\nto correctly free the memory allocated for this device, but mdiobus_free()\ncalls just kfree(dev) in case of MDIOBUS_ALLOCATED state\n\nTo avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED\n_before_ calling device_register(), because put_device() should be\ncalled even in case of device_register() failure.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47416" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/064c2616234a7394867c924b5c1303974f3a4f4d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0d2dd40a7be61b89a7c99dae8ee96389d27b413a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2250392d930bd0d989f24d355d6355b0150256e7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2397b9e118721292429fea8807a698e71b94795f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/25e9f88c7e3cc35f5e3d3db199660d28a15df639" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/414bb4ead1362ef2c8592db723c017258f213988" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ca6e11c337daf7925ff8a2aac8e84490a8691905" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f4f502a04ee1e543825af78f47eb7785015cd9f6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-j8g9-5p8g-4f3x/GHSA-j8g9-5p8g-4f3x.json b/advisories/unreviewed/2024/05/GHSA-j8g9-5p8g-4f3x/GHSA-j8g9-5p8g-4f3x.json new file mode 100644 index 00000000000..8184ebe7ca4 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-j8g9-5p8g-4f3x/GHSA-j8g9-5p8g-4f3x.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j8g9-5p8g-4f3x", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47306" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fddi: fix UAF in fza_probe\n\nfp is netdev private data and it cannot be\nused after free_netdev() call. Using fp after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() after error message.\n\nTURBOchannel adapter\")", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47306" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/04b06716838bfc26742dbed3ae1d3697fe5317ee" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bdfbb51f7a437ae8ea91317a5c133ec13adf3c47" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/deb7178eb940e2c5caca1b1db084a69b2e59b4c9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f33605908a9b6063525e9f68e62d739948c5fccf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-j8hx-6rxw-p4r9/GHSA-j8hx-6rxw-p4r9.json b/advisories/unreviewed/2024/05/GHSA-j8hx-6rxw-p4r9/GHSA-j8hx-6rxw-p4r9.json new file mode 100644 index 00000000000..550ff80b791 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-j8hx-6rxw-p4r9/GHSA-j8hx-6rxw-p4r9.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j8hx-6rxw-p4r9", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47230" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Immediately reset the MMU context when the SMM flag is cleared\n\nImmediately reset the MMU context when the vCPU's SMM flag is cleared so\nthat the SMM flag in the MMU role is always synchronized with the vCPU's\nflag. If RSM fails (which isn't correctly emulated), KVM will bail\nwithout calling post_leave_smm() and leave the MMU in a bad state.\n\nThe bad MMU role can lead to a NULL pointer dereference when grabbing a\nshadow page's rmap for a page fault as the initial lookups for the gfn\nwill happen with the vCPU's SMM flag (=0), whereas the rmap lookup will\nuse the shadow page's SMM flag, which comes from the MMU (=1). SMM has\nan entirely different set of memslots, and so the initial lookup can find\na memslot (SMM=0) and then explode on the rmap memslot lookup (SMM=1).\n\n general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n CPU: 1 PID: 8410 Comm: syz-executor382 Not tainted 5.13.0-rc5-syzkaller #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n RIP: 0010:__gfn_to_rmap arch/x86/kvm/mmu/mmu.c:935 [inline]\n RIP: 0010:gfn_to_rmap+0x2b0/0x4d0 arch/x86/kvm/mmu/mmu.c:947\n Code: <42> 80 3c 20 00 74 08 4c 89 ff e8 f1 79 a9 00 4c 89 fb 4d 8b 37 44\n RSP: 0018:ffffc90000ffef98 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff888015b9f414 RCX: ffff888019669c40\n RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001\n RBP: 0000000000000001 R08: ffffffff811d9cdb R09: ffffed10065a6002\n R10: ffffed10065a6002 R11: 0000000000000000 R12: dffffc0000000000\n R13: 0000000000000003 R14: 0000000000000001 R15: 0000000000000000\n FS: 000000000124b300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 0000000028e31000 CR4: 00000000001526e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n rmap_add arch/x86/kvm/mmu/mmu.c:965 [inline]\n mmu_set_spte+0x862/0xe60 arch/x86/kvm/mmu/mmu.c:2604\n __direct_map arch/x86/kvm/mmu/mmu.c:2862 [inline]\n direct_page_fault+0x1f74/0x2b70 arch/x86/kvm/mmu/mmu.c:3769\n kvm_mmu_do_page_fault arch/x86/kvm/mmu.h:124 [inline]\n kvm_mmu_page_fault+0x199/0x1440 arch/x86/kvm/mmu/mmu.c:5065\n vmx_handle_exit+0x26/0x160 arch/x86/kvm/vmx/vmx.c:6122\n vcpu_enter_guest+0x3bdd/0x9630 arch/x86/kvm/x86.c:9428\n vcpu_run+0x416/0xc20 arch/x86/kvm/x86.c:9494\n kvm_arch_vcpu_ioctl_run+0x4e8/0xa40 arch/x86/kvm/x86.c:9722\n kvm_vcpu_ioctl+0x70f/0xbb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3460\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:1069 [inline]\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:1055\n do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x440ce9", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47230" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/669a8866e468fd020d34eb00e08cb41d3774b71b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/78fcb2c91adfec8ce3a2ba6b4d0dda89f2f4a7c6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cbb425f62df9df7abee4b3f068f7ed6ffc3561e2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/df9a40cfb3be2cbeb1c17bb67c59251ba16630f3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jhg5-q2mj-r9vh/GHSA-jhg5-q2mj-r9vh.json b/advisories/unreviewed/2024/05/GHSA-jhg5-q2mj-r9vh/GHSA-jhg5-q2mj-r9vh.json new file mode 100644 index 00000000000..5957d625aa1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jhg5-q2mj-r9vh/GHSA-jhg5-q2mj-r9vh.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jhg5-q2mj-r9vh", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47312" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: Fix dereference of null pointer flow\n\nIn the case where chain->flags & NFT_CHAIN_HW_OFFLOAD is false then\nnft_flow_rule_create is not called and flow is NULL. The subsequent\nerror handling execution via label err_destroy_flow_rule will lead\nto a null pointer dereference on flow when calling nft_flow_rule_destroy.\nSince the error path to err_destroy_flow_rule has to cater for null\nand non-null flows, only call nft_flow_rule_destroy if flow is non-null\nto fix this issue.\n\nAddresses-Coverity: (\"Explicity null dereference\")", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47312" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4ca041f919f13783b0b03894783deee00dbca19a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/70a5a1950cca02c5cd161bb3846b4d983eed97d3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jmm7-6r74-7f4p/GHSA-jmm7-6r74-7f4p.json b/advisories/unreviewed/2024/05/GHSA-jmm7-6r74-7f4p/GHSA-jmm7-6r74-7f4p.json new file mode 100644 index 00000000000..c38aa028c66 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jmm7-6r74-7f4p/GHSA-jmm7-6r74-7f4p.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jmm7-6r74-7f4p", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47403" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipack: ipoctal: fix module reference leak\n\nA reference to the carrier module was taken on every open but was only\nreleased once when the final reference to the tty struct was dropped.\n\nFix this by taking the module reference and initialising the tty driver\ndata when installing the tty.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47403" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/31398849b84ebae0d43a1cf379cb9895597f221a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3253c87e1e5bc0107aab773af2f135ebccf38666" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7cea848678470daadbfdaa6a112b823c290f900c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/811178f296b16af30264def74c8d2179a72d5562" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9c5b77a7ffc983b2429ce158b50497c5d3c86a69" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bb8a4fcb2136508224c596a7e665bdba1d7c3c27" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c0adb5a947dec6cff7050ec56d78ecd3916f9ce6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dde4c1429b97383689f755ce92b4ed1e84a9c92b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jpfh-4v99-5m27/GHSA-jpfh-4v99-5m27.json b/advisories/unreviewed/2024/05/GHSA-jpfh-4v99-5m27/GHSA-jpfh-4v99-5m27.json new file mode 100644 index 00000000000..661abb6115c --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jpfh-4v99-5m27/GHSA-jpfh-4v99-5m27.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jpfh-4v99-5m27", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47272" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL\n\nThere exists a possible scenario in which dwc3_gadget_init() can fail:\nduring during host -> peripheral mode switch in dwc3_set_mode(), and\na pending gadget driver fails to bind. Then, if the DRD undergoes\nanother mode switch from peripheral->host the resulting\ndwc3_gadget_exit() will attempt to reference an invalid and dangling\ndwc->gadget pointer as well as call dma_free_coherent() on unmapped\nDMA pointers.\n\nThe exact scenario can be reproduced as follows:\n - Start DWC3 in peripheral mode\n - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)\n - Run FunctionFS userspace application (open EPs, write descriptors, etc)\n - Bind gadget driver to DWC3's UDC\n - Switch DWC3 to host mode\n => dwc3_gadget_exit() is called. usb_del_gadget() will put the\n\tConfigFS driver instance on the gadget_driver_pending_list\n - Stop FunctionFS application (closes the ep files)\n - Switch DWC3 to peripheral mode\n => dwc3_gadget_init() fails as usb_add_gadget() calls\n\tcheck_pending_gadget_drivers() and attempts to rebind the UDC\n\tto the ConfigFS gadget but fails with -19 (-ENODEV) because the\n\tFFS instance is not in FFS_ACTIVE state (userspace has not\n\tre-opened and written the descriptors yet, i.e. desc_ready!=0).\n - Switch DWC3 back to host mode\n => dwc3_gadget_exit() is called again, but this time dwc->gadget\n\tis invalid.\n\nAlthough it can be argued that userspace should take responsibility\nfor ensuring that the FunctionFS application be ready prior to\nallowing the composite driver bind to the UDC, failure to do so\nshould not result in a panic from the kernel driver.\n\nFix this by setting dwc->gadget to NULL in the failure path of\ndwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out\nunless the gadget pointer is valid.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47272" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jq29-8xm6-ccxq/GHSA-jq29-8xm6-ccxq.json b/advisories/unreviewed/2024/05/GHSA-jq29-8xm6-ccxq/GHSA-jq29-8xm6-ccxq.json new file mode 100644 index 00000000000..5bebf116ab3 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jq29-8xm6-ccxq/GHSA-jq29-8xm6-ccxq.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jq29-8xm6-ccxq", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47348" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid HDCP over-read and corruption\n\nInstead of reading the desired 5 bytes of the actual target field,\nthe code was reading 8. This could result in a corrupted value if the\ntrailing 3 bytes were non-zero, so instead use an appropriately sized\nand zero-initialized bounce buffer, and read only 5 bytes before casting\nto u64.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47348" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/06888d571b513cbfc0b41949948def6cb81021b2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3b2b93a485fb7a970bc8b5daef16f4cf579d172f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/44c7c901cb368a9f2493748f213b247b5872639f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c5b518f4b98dbb2bc31b6a55e6aaa1e0e2948f2e" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jq6v-72pf-8j24/GHSA-jq6v-72pf-8j24.json b/advisories/unreviewed/2024/05/GHSA-jq6v-72pf-8j24/GHSA-jq6v-72pf-8j24.json new file mode 100644 index 00000000000..124b1871701 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jq6v-72pf-8j24/GHSA-jq6v-72pf-8j24.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jq6v-72pf-8j24", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47361" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmcb: fix error handling in mcb_alloc_bus()\n\nThere are two bugs:\n1) If ida_simple_get() fails then this code calls put_device(carrier)\n but we haven't yet called get_device(carrier) and probably that\n leads to a use after free.\n2) After device_initialize() then we need to use put_device() to\n release the bus. This will free the internal resources tied to the\n device and call mcb_free_bus() which will free the rest.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47361" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/115b07d9f47e3996430b8f2007edd9768e1f807f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/25a1433216489de4abc889910f744e952cb6dbae" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/66f74ba9be9daf9c47fface6af3677f602774f6b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7751f609eadf36b1f53712bae430019c53a16eb0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8a558261fa57a6deefb0925ab1829f698b194aea" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/91e4ad05bf18322b5921d1a6c9b603f6eb1694f0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9fc198f415dee070a1de957bb5bf5921d8df3499" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jqwg-pjjq-gqv5/GHSA-jqwg-pjjq-gqv5.json b/advisories/unreviewed/2024/05/GHSA-jqwg-pjjq-gqv5/GHSA-jqwg-pjjq-gqv5.json new file mode 100644 index 00000000000..b3cab6cd876 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jqwg-pjjq-gqv5/GHSA-jqwg-pjjq-gqv5.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jqwg-pjjq-gqv5", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47423" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/debugfs: fix file release memory leak\n\nWhen using single_open() for opening, single_release() should be\ncalled, otherwise the 'op' allocated in single_open() will be leaked.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47423" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/11cd944bb87d9e575b94c07c952105eda745b459" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1508b09945bde393326a9dab73b1fc35f672d771" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/88c3610045ca6e699331b6bb5c095c5565f30721" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9f9d4c88b2edc7924e19c44909cfc3fa4e4d3d43" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/df0c9418923679bc6d0060bdb1b5bf2c755159e0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f5a8703a9c418c6fc54eb772712dfe7641e3991c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f69556a42043b5444ca712ee889829ba89fdcba8" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jv5x-8v9f-frx2/GHSA-jv5x-8v9f-frx2.json b/advisories/unreviewed/2024/05/GHSA-jv5x-8v9f-frx2/GHSA-jv5x-8v9f-frx2.json new file mode 100644 index 00000000000..1e83d4aec96 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jv5x-8v9f-frx2/GHSA-jv5x-8v9f-frx2.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jv5x-8v9f-frx2", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47238" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix memory leak in ip_mc_add1_src\n\nBUG: memory leak\nunreferenced object 0xffff888101bc4c00 (size 32):\n comm \"syz-executor527\", pid 360, jiffies 4294807421 (age 19.329s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................\n backtrace:\n [<00000000f17c5244>] kmalloc include/linux/slab.h:558 [inline]\n [<00000000f17c5244>] kzalloc include/linux/slab.h:688 [inline]\n [<00000000f17c5244>] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline]\n [<00000000f17c5244>] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095\n [<000000001cb99709>] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416\n [<0000000052cf19ed>] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline]\n [<0000000052cf19ed>] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423\n [<00000000477edfbc>] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857\n [<00000000e75ca9bb>] __sys_setsockopt+0x158/0x270 net/socket.c:2117\n [<00000000bdb993a8>] __do_sys_setsockopt net/socket.c:2128 [inline]\n [<00000000bdb993a8>] __se_sys_setsockopt net/socket.c:2125 [inline]\n [<00000000bdb993a8>] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125\n [<000000006a1ffdbd>] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47\n [<00000000b11467c4>] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nIn commit 24803f38a5c0 (\"igmp: do not remove igmp souce list info when set\nlink down\"), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed,\nbecause it was also called in igmpv3_clear_delrec().\n\nRough callgraph:\n\ninetdev_destroy\n-> ip_mc_destroy_dev\n -> igmpv3_clear_delrec\n -> ip_mc_clear_src\n-> RCU_INIT_POINTER(dev->ip_ptr, NULL)\n\nHowever, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn't\nrelease in_dev->mc_list->sources. And RCU_INIT_POINTER() assigns the\nNULL to dev->ip_ptr. As a result, in_dev cannot be obtained through\ninetdev_by_index() and then in_dev->mc_list->sources cannot be released\nby ip_mc_del1_src() in the sock_close. Rough call sequence goes like:\n\nsock_close\n-> __sock_release\n -> inet_release\n -> ip_mc_drop_socket\n -> inetdev_by_index\n -> ip_mc_leave_src\n -> ip_mc_del_src\n -> ip_mc_del1_src\n\nSo we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free\nin_dev->mc_list->sources.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47238" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0dc13e75507faa17ac9f7562b4ef7bf8fcd78422" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1e28018b5c83d5073f74a6fb72eabe8370b2f501" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3dd2aeac2e9624cff9fa634710837e4f2e352758" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6cff57eea3347f79f1867cc53e1093b6614138d8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/77de6ee73f54a9a89c0afa0bf4c53b239aa9953a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ac31cc837cafb57a271babad8ccffbf733caa076" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d8e2973029b8b2ce477b564824431f3385c77083" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jwv9-vf83-vjmw/GHSA-jwv9-vf83-vjmw.json b/advisories/unreviewed/2024/05/GHSA-jwv9-vf83-vjmw/GHSA-jwv9-vf83-vjmw.json new file mode 100644 index 00000000000..fc0d7c6dd50 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jwv9-vf83-vjmw/GHSA-jwv9-vf83-vjmw.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jwv9-vf83-vjmw", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47387" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: schedutil: Use kobject release() method to free sugov_tunables\n\nThe struct sugov_tunables is protected by the kobject, so we can't free\nit directly. Otherwise we would get a call trace like this:\n ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30\n WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100\n Modules linked in:\n CPU: 3 PID: 720 Comm: a.sh Tainted: G W 5.14.0-rc1-next-20210715-yocto-standard+ #507\n Hardware name: Marvell OcteonTX CN96XX board (DT)\n pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--)\n pc : debug_print_object+0xb8/0x100\n lr : debug_print_object+0xb8/0x100\n sp : ffff80001ecaf910\n x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80\n x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000\n x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20\n x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010\n x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365\n x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69\n x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0\n x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001\n x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000\n x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000\n Call trace:\n debug_print_object+0xb8/0x100\n __debug_check_no_obj_freed+0x1c0/0x230\n debug_check_no_obj_freed+0x20/0x88\n slab_free_freelist_hook+0x154/0x1c8\n kfree+0x114/0x5d0\n sugov_exit+0xbc/0xc0\n cpufreq_exit_governor+0x44/0x90\n cpufreq_set_policy+0x268/0x4a8\n store_scaling_governor+0xe0/0x128\n store+0xc0/0xf0\n sysfs_kf_write+0x54/0x80\n kernfs_fop_write_iter+0x128/0x1c0\n new_sync_write+0xf0/0x190\n vfs_write+0x2d4/0x478\n ksys_write+0x74/0x100\n __arm64_sys_write+0x24/0x30\n invoke_syscall.constprop.0+0x54/0xe0\n do_el0_svc+0x64/0x158\n el0_svc+0x2c/0xb0\n el0t_64_sync_handler+0xb0/0xb8\n el0t_64_sync+0x198/0x19c\n irq event stamp: 5518\n hardirqs last enabled at (5517): [] console_unlock+0x554/0x6c8\n hardirqs last disabled at (5518): [] el1_dbg+0x28/0xa0\n softirqs last enabled at (5504): [] __do_softirq+0x4d0/0x6c0\n softirqs last disabled at (5483): [] irq_exit+0x1b0/0x1b8\n\nSo split the original sugov_tunables_free() into two functions,\nsugov_clear_global_tunables() is just used to clear the global_tunables\nand the new sugov_tunables_free() is used as kobj_type::release to\nrelease the sugov_tunables safely.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47387" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/30d57cf2c4116ca6d34ecd1cac94ad84f8bc446c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/463c46705f321201090b69c4ad5da0cd2ce614c9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/67c98e023135ff81b8d52998a6fdb8ca0c518d82" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d62aec52a8c5b1d25a2364b243fcc5098a2ede9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a7d4fc84404d45d72f4490417e8cc3efa4af93f1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cb4a53ba37532c861a5f3f22803391018a41849a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e5c6b312ce3cc97e90ea159446e6bfa06645364d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-m2r9-3c4r-qv68/GHSA-m2r9-3c4r-qv68.json b/advisories/unreviewed/2024/05/GHSA-m2r9-3c4r-qv68/GHSA-m2r9-3c4r-qv68.json new file mode 100644 index 00000000000..72f664abe92 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-m2r9-3c4r-qv68/GHSA-m2r9-3c4r-qv68.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2r9-3c4r-qv68", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47338" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbmem: Do not delete the mode that is still in use\n\nThe execution of fb_delete_videomode() is not based on the result of the\nprevious fbcon_mode_deleted(). As a result, the mode is directly deleted,\nregardless of whether it is still in use, which may cause UAF.\n\n==================================================================\nBUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \\\ndrivers/video/fbdev/core/modedb.c:924\nRead of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962\n\nCPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x137/0x1be lib/dump_stack.c:118\n print_address_description+0x6c/0x640 mm/kasan/report.c:385\n __kasan_report mm/kasan/report.c:545 [inline]\n kasan_report+0x13d/0x1e0 mm/kasan/report.c:562\n fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924\n fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746\n fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFreed by task 18960:\n kasan_save_stack mm/kasan/common.c:48 [inline]\n kasan_set_track+0x3d/0x70 mm/kasan/common.c:56\n kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355\n __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422\n slab_free_hook mm/slub.c:1541 [inline]\n slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574\n slab_free mm/slub.c:3139 [inline]\n kfree+0xca/0x3d0 mm/slub.c:4121\n fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104\n fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xa9", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47338" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/087bff9acd2ec6db3f61aceb3224bde90fe0f7f8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0af778269a522c988ef0b4188556aba97fb420cc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/359311b85ebec7c07c3a08ae2f3def946cad33fa" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d6e76469157d8f240e5dec6f8411aa8d306b1126" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f193509afc7ff37a46862610c93b896044d5b693" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-m2xg-x7vq-c628/GHSA-m2xg-x7vq-c628.json b/advisories/unreviewed/2024/05/GHSA-m2xg-x7vq-c628/GHSA-m2xg-x7vq-c628.json new file mode 100644 index 00000000000..9243d714c02 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-m2xg-x7vq-c628/GHSA-m2xg-x7vq-c628.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2xg-x7vq-c628", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47309" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: validate lwtstate->data before returning from skb_tunnel_info()\n\nskb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info\ntype without validation. lwtstate->data can have various types such as\nmpls_iptunnel_encap, etc and these are not compatible.\nSo skb_tunnel_info() should validate before returning that pointer.\n\nSplat looks like:\nBUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan]\nRead of size 2 at addr ffff888106ec2698 by task ping/811\n\nCPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195\nCall Trace:\n dump_stack_lvl+0x56/0x7b\n print_address_description.constprop.8.cold.13+0x13/0x2ee\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n kasan_report.cold.14+0x83/0xdf\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n vxlan_get_route+0x418/0x4b0 [vxlan]\n [ ... ]\n vxlan_xmit_one+0x148b/0x32b0 [vxlan]\n [ ... ]\n vxlan_xmit+0x25c5/0x4780 [vxlan]\n [ ... ]\n dev_hard_start_xmit+0x1ae/0x6e0\n __dev_queue_xmit+0x1f39/0x31a0\n [ ... ]\n neigh_xmit+0x2f9/0x940\n mpls_xmit+0x911/0x1600 [mpls_iptunnel]\n lwtunnel_xmit+0x18f/0x450\n ip_finish_output2+0x867/0x2040\n [ ... ]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47309" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2179d96ec702cc33ead02a9ce40ece599b8538c5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/67a9c94317402b826fc3db32afc8f39336803d97" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8aa13a86964cdec4fd969ef677c6614ff068641a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8bb1589c89e61e3b182dd546f1021928ebb5c2a6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a915379594f1e045421635c6316d8f3ffa018c58" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b61d327cd3cc5ea591f3bf751dd11e034f388bb5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e7f3c9df40515a6c6b46f36c4c94cf48a043f887" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-m9r6-94f7-4j6m/GHSA-m9r6-94f7-4j6m.json b/advisories/unreviewed/2024/05/GHSA-m9r6-94f7-4j6m/GHSA-m9r6-94f7-4j6m.json new file mode 100644 index 00000000000..903d3d67dd4 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-m9r6-94f7-4j6m/GHSA-m9r6-94f7-4j6m.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m9r6-94f7-4j6m", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47373" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Fix potential VPE leak on error\n\nIn its_vpe_irq_domain_alloc, when its_vpe_init() returns an error,\nthere is an off-by-one in the number of VPEs to be freed.\n\nFix it by simply passing the number of VPEs allocated, which is the\nindex of the loop iterating over the VPEs.\n\n[maz: fixed commit message]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47373" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/280bef512933b2dda01d681d8cbe499b98fc5bdd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/42d3711c23781045e7a5cd28536c774b9a66d20b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/568662e37f927e3dc3e475f3ff7cf4ab7719c5e7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5701e8bff314c155e7afdc467b1e0389d86853d0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7d39992d45acd6f2d6b2f62389c55b61fb3d486b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e0c1c2e5da19685a20557a50f10c6aa4fa26aa84" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-mgmg-f25r-3gfh/GHSA-mgmg-f25r-3gfh.json b/advisories/unreviewed/2024/05/GHSA-mgmg-f25r-3gfh/GHSA-mgmg-f25r-3gfh.json new file mode 100644 index 00000000000..ddbe2dd152d --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-mgmg-f25r-3gfh/GHSA-mgmg-f25r-3gfh.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mgmg-f25r-3gfh", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47431" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix gart.bo pin_count leak\n\ngmc_v{9,10}_0_gart_disable() isn't called matched with\ncorrespoding gart_enbale function in SRIOV case. This will\nlead to gart.bo pin_count leak on driver unload.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47431" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/18d1c5ea3798ba42cfa0f8b2264d873463facb03" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/621ddffb70db824eabd63d18ac635180fe9500f9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/66805763a97f8f7bdf742fc0851d85c02ed9411f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/83d857d6b0967b6709cd38750c3ce2ed8ced1a95" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-mjhg-c85c-62fv/GHSA-mjhg-c85c-62fv.json b/advisories/unreviewed/2024/05/GHSA-mjhg-c85c-62fv/GHSA-mjhg-c85c-62fv.json new file mode 100644 index 00000000000..57a5039493a --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-mjhg-c85c-62fv/GHSA-mjhg-c85c-62fv.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mjhg-c85c-62fv", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47265" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA: Verify port when creating flow rule\n\nValidate port value provided by the user and with that remove no longer\nneeded validation by the driver. The missing check in the mlx5_ib driver\ncould cause to the below oops.\n\nCall trace:\n _create_flow_rule+0x2d4/0xf28 [mlx5_ib]\n mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib]\n ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs]\n ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs]\n ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs]\n ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs]\n do_vfs_ioctl+0xd0/0xaf0\n ksys_ioctl+0x84/0xb4\n __arm64_sys_ioctl+0x28/0xc4\n el0_svc_common.constprop.3+0xa4/0x254\n el0_svc_handler+0x84/0xa0\n el0_svc+0x10/0x26c\n Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47265" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2adcb4c5a52a2623cd2b43efa7041e74d19f3a5e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8dc1b0e0ca204596c50bcd159ee069ae0f998176" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-mpm3-wjp6-8g7x/GHSA-mpm3-wjp6-8g7x.json b/advisories/unreviewed/2024/05/GHSA-mpm3-wjp6-8g7x/GHSA-mpm3-wjp6-8g7x.json new file mode 100644 index 00000000000..421f174e383 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-mpm3-wjp6-8g7x/GHSA-mpm3-wjp6-8g7x.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mpm3-wjp6-8g7x", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47225" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211: fix deadlock in AP/VLAN handling\n\nSyzbot reports that when you have AP_VLAN interfaces that are up\nand close the AP interface they belong to, we get a deadlock. No\nsurprise - since we dev_close() them with the wiphy mutex held,\nwhich goes back into the netdev notifier in cfg80211 and tries to\nacquire the wiphy mutex there.\n\nTo fix this, we need to do two things:\n 1) prevent changing iftype while AP_VLANs are up, we can't\n easily fix this case since cfg80211 already calls us with\n the wiphy mutex held, but change_interface() is relatively\n rare in drivers anyway, so changing iftype isn't used much\n (and userspace has to fall back to down/change/up anyway)\n 2) pull the dev_close() loop over VLANs out of the wiphy mutex\n section in the normal stop case", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47225" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8043903fcb72f545c52e3ec74d6fd82ef79ce7c5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d5befb224edbe53056c2c18999d630dafb4a08b9" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-mrm7-vh23-g98v/GHSA-mrm7-vh23-g98v.json b/advisories/unreviewed/2024/05/GHSA-mrm7-vh23-g98v/GHSA-mrm7-vh23-g98v.json new file mode 100644 index 00000000000..6180e1e0c14 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-mrm7-vh23-g98v/GHSA-mrm7-vh23-g98v.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mrm7-vh23-g98v", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47292" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix memleak in io_init_wq_offload()\n\nI got memory leak report when doing fuzz test:\n\nBUG: memory leak\nunreferenced object 0xffff888107310a80 (size 96):\ncomm \"syz-executor.6\", pid 4610, jiffies 4295140240 (age 20.135s)\nhex dump (first 32 bytes):\n01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........\nbacktrace:\n[<000000001974933b>] kmalloc include/linux/slab.h:591 [inline]\n[<000000001974933b>] kzalloc include/linux/slab.h:721 [inline]\n[<000000001974933b>] io_init_wq_offload fs/io_uring.c:7920 [inline]\n[<000000001974933b>] io_uring_alloc_task_context+0x466/0x640 fs/io_uring.c:7955\n[<0000000039d0800d>] __io_uring_add_tctx_node+0x256/0x360 fs/io_uring.c:9016\n[<000000008482e78c>] io_uring_add_tctx_node fs/io_uring.c:9052 [inline]\n[<000000008482e78c>] __do_sys_io_uring_enter fs/io_uring.c:9354 [inline]\n[<000000008482e78c>] __se_sys_io_uring_enter fs/io_uring.c:9301 [inline]\n[<000000008482e78c>] __x64_sys_io_uring_enter+0xabc/0xc20 fs/io_uring.c:9301\n[<00000000b875f18f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n[<00000000b875f18f>] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80\n[<000000006b0a8484>] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nCPU0 CPU1\nio_uring_enter io_uring_enter\nio_uring_add_tctx_node io_uring_add_tctx_node\n__io_uring_add_tctx_node __io_uring_add_tctx_node\nio_uring_alloc_task_context io_uring_alloc_task_context\nio_init_wq_offload io_init_wq_offload\nhash = kzalloc hash = kzalloc\nctx->hash_map = hash ctx->hash_map = hash <- one of the hash is leaked\n\nWhen calling io_uring_enter() in parallel, the 'hash_map' will be leaked,\nadd uring_lock to protect 'hash_map'.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47292" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/362a9e65289284f36403058eea2462d0330c1f24" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/502731a03f27cba1513fbbff77e508185ffce5bb" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-mv9f-845w-2cgm/GHSA-mv9f-845w-2cgm.json b/advisories/unreviewed/2024/05/GHSA-mv9f-845w-2cgm/GHSA-mv9f-845w-2cgm.json new file mode 100644 index 00000000000..8e4d9bdf647 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-mv9f-845w-2cgm/GHSA-mv9f-845w-2cgm.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mv9f-845w-2cgm", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47234" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()\n\nUse clk_disable_unprepare() in the error path of mtk_phy_init() to fix\nsome resource leaks.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47234" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6472955af5e88b5489b6d78316082ad56ea3e489" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9a17907946232d01aa2ec109da5f93b8d31dd425" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/aaac9a1bd370338ce372669eb9a6059d16b929aa" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-mxwx-46p7-hcm6/GHSA-mxwx-46p7-hcm6.json b/advisories/unreviewed/2024/05/GHSA-mxwx-46p7-hcm6/GHSA-mxwx-46p7-hcm6.json new file mode 100644 index 00000000000..ea19e47348d --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-mxwx-46p7-hcm6/GHSA-mxwx-46p7-hcm6.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mxwx-46p7-hcm6", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47313" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init\n\nIt's a classic example of memleak, we allocate something, we fail and\nnever free the resources.\n\nMake sure we free all resources on policy ->init() failures.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47313" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b775383355755885b19d2acef977f1ca132e80a3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e1b2b2b61d30d7ce057ec17237c217d152ed97f2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fe2535a44904a77615a3af8e8fd7dafb98fb0e1b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-p2qw-28x5-q4gw/GHSA-p2qw-28x5-q4gw.json b/advisories/unreviewed/2024/05/GHSA-p2qw-28x5-q4gw/GHSA-p2qw-28x5-q4gw.json new file mode 100644 index 00000000000..f490e958cbc --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-p2qw-28x5-q4gw/GHSA-p2qw-28x5-q4gw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p2qw-28x5-q4gw", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47394" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unlink table before deleting it\n\nsyzbot reports following UAF:\nBUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955\n nla_strcmp+0xf2/0x130 lib/nlattr.c:836\n nft_table_lookup.part.0+0x1a2/0x460 net/netfilter/nf_tables_api.c:570\n nft_table_lookup net/netfilter/nf_tables_api.c:4064 [inline]\n nf_tables_getset+0x1b3/0x860 net/netfilter/nf_tables_api.c:4064\n nfnetlink_rcv_msg+0x659/0x13f0 net/netfilter/nfnetlink.c:285\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504\n\nProblem is that all get operations are lockless, so the commit_mutex\nheld by nft_rcv_nl_event() isn't enough to stop a parallel GET request\nfrom doing read-accesses to the table object even after synchronize_rcu().\n\nTo avoid this, unlink the table first and store the table objects in\non-stack scratch space.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47394" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a499b03bf36b0c2e3b958a381d828678ab0ffc5e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f65c73d3aabb87d4353e0bc4a718b5ae8c43fd04" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-p47x-q59q-2mpw/GHSA-p47x-q59q-2mpw.json b/advisories/unreviewed/2024/05/GHSA-p47x-q59q-2mpw/GHSA-p47x-q59q-2mpw.json new file mode 100644 index 00000000000..84e04e5fde5 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-p47x-q59q-2mpw/GHSA-p47x-q59q-2mpw.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p47x-q59q-2mpw", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47231" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcba_usb: fix memory leak in mcba_usb\n\nSyzbot reported memory leak in SocketCAN driver for Microchip CAN BUS\nAnalyzer Tool. The problem was in unfreed usb_coherent.\n\nIn mcba_usb_start() 20 coherent buffers are allocated and there is\nnothing, that frees them:\n\n1) In callback function the urb is resubmitted and that's all\n2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER\n is not set (see mcba_usb_start) and this flag cannot be used with\n coherent buffers.\n\nFail log:\n| [ 1354.053291][ T8413] mcba_usb 1-1:0.0 can0: device disconnected\n| [ 1367.059384][ T8420] kmemleak: 20 new suspected memory leaks (see /sys/kernel/debug/kmem)\n\nSo, all allocated buffers should be freed with usb_free_coherent()\nexplicitly\n\nNOTE:\nThe same pattern for allocating and freeing coherent buffers\nis used in drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47231" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6bd3d80d1f019cefa7011056c54b323f1d8b8e83" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6f87c0e21ad20dd3d22108e33db1c552dfa352a0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/89df95ce32be204eef2e7d4b2f6fb552fb191a68" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/91c02557174be7f72e46ed7311e3bea1939840b0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a115198caaab6d663bef75823a3c5f0802306d60" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d0760a4ef85697bc756d06eae17ae27f3f055401" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-p52g-5qgx-4crw/GHSA-p52g-5qgx-4crw.json b/advisories/unreviewed/2024/05/GHSA-p52g-5qgx-4crw/GHSA-p52g-5qgx-4crw.json new file mode 100644 index 00000000000..4a583baa016 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-p52g-5qgx-4crw/GHSA-p52g-5qgx-4crw.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p52g-5qgx-4crw", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47256" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/memory-failure: make sure wait for page writeback in memory_failure\n\nOur syzkaller trigger the \"BUG_ON(!list_empty(&inode->i_wb_list))\" in\nclear_inode:\n\n kernel BUG at fs/inode.c:519!\n Internal error: Oops - BUG: 0 [#1] SMP\n Modules linked in:\n Process syz-executor.0 (pid: 249, stack limit = 0x00000000a12409d7)\n CPU: 1 PID: 249 Comm: syz-executor.0 Not tainted 4.19.95\n Hardware name: linux,dummy-virt (DT)\n pstate: 80000005 (Nzcv daif -PAN -UAO)\n pc : clear_inode+0x280/0x2a8\n lr : clear_inode+0x280/0x2a8\n Call trace:\n clear_inode+0x280/0x2a8\n ext4_clear_inode+0x38/0xe8\n ext4_free_inode+0x130/0xc68\n ext4_evict_inode+0xb20/0xcb8\n evict+0x1a8/0x3c0\n iput+0x344/0x460\n do_unlinkat+0x260/0x410\n __arm64_sys_unlinkat+0x6c/0xc0\n el0_svc_common+0xdc/0x3b0\n el0_svc_handler+0xf8/0x160\n el0_svc+0x10/0x218\n Kernel panic - not syncing: Fatal exception\n\nA crash dump of this problem show that someone called __munlock_pagevec\nto clear page LRU without lock_page: do_mmap -> mmap_region -> do_munmap\n-> munlock_vma_pages_range -> __munlock_pagevec.\n\nAs a result memory_failure will call identify_page_state without\nwait_on_page_writeback. And after truncate_error_page clear the mapping\nof this page. end_page_writeback won't call sb_clear_inode_writeback to\nclear inode->i_wb_list. That will trigger BUG_ON in clear_inode!\n\nFix it by checking PageWriteback too to help determine should we skip\nwait_on_page_writeback.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47256" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/28788dc5c70597395b6b451dae4549bbaa8e2c56" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/566345aaabac853aa866f53a219c4b02a6beb527" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6d210d547adc2218ef8b5bcf23518c5f2f1fd872" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9e379da727a7a031be9b877cde7b9c34a0fb8306" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d05267fd27a5c4f54e06daefa3035995d765ca0c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e8675d291ac007e1c636870db880f837a9ea112a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-p793-3f2h-38xw/GHSA-p793-3f2h-38xw.json b/advisories/unreviewed/2024/05/GHSA-p793-3f2h-38xw/GHSA-p793-3f2h-38xw.json new file mode 100644 index 00000000000..3dcf9a3e277 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-p793-3f2h-38xw/GHSA-p793-3f2h-38xw.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p793-3f2h-38xw", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47376" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add oversize check before call kvcalloc()\n\nCommit 7661809d493b (\"mm: don't allow oversized kvmalloc() calls\") add the\noversize check. When the allocation is larger than what kmalloc() supports,\nthe following warning triggered:\n\nWARNING: CPU: 0 PID: 8408 at mm/util.c:597 kvmalloc_node+0x108/0x110 mm/util.c:597\nModules linked in:\nCPU: 0 PID: 8408 Comm: syz-executor221 Not tainted 5.14.0-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:kvmalloc_node+0x108/0x110 mm/util.c:597\nCall Trace:\n kvmalloc include/linux/mm.h:806 [inline]\n kvmalloc_array include/linux/mm.h:824 [inline]\n kvcalloc include/linux/mm.h:829 [inline]\n check_btf_line kernel/bpf/verifier.c:9925 [inline]\n check_btf_info kernel/bpf/verifier.c:10049 [inline]\n bpf_check+0xd634/0x150d0 kernel/bpf/verifier.c:13759\n bpf_prog_load kernel/bpf/syscall.c:2301 [inline]\n __sys_bpf+0x11181/0x126e0 kernel/bpf/syscall.c:4587\n __do_sys_bpf kernel/bpf/syscall.c:4691 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:4689 [inline]\n __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4689\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47376" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0e6491b559704da720f6da09dd0a52c4df44c514" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6345a0bee80139ea00a341c4202ebfd1534b5eb0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/93937596e0652d50973f9dc944fea1694ac8cdfd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b5fe7cdfee5901ce5513c30e554d51536e003bde" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-pcr5-v468-562j/GHSA-pcr5-v468-562j.json b/advisories/unreviewed/2024/05/GHSA-pcr5-v468-562j/GHSA-pcr5-v468-562j.json new file mode 100644 index 00000000000..1fd73532153 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-pcr5-v468-562j/GHSA-pcr5-v468-562j.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pcr5-v468-562j", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47235" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: fix potential use-after-free in ec_bhf_remove\n\nstatic void ec_bhf_remove(struct pci_dev *dev)\n{\n...\n\tstruct ec_bhf_priv *priv = netdev_priv(net_dev);\n\n\tunregister_netdev(net_dev);\n\tfree_netdev(net_dev);\n\n\tpci_iounmap(dev, priv->dma_io);\n\tpci_iounmap(dev, priv->io);\n...\n}\n\npriv is netdev private data, but it is used\nafter free_netdev(). It can cause use-after-free when accessing priv\npointer. So, fix it by moving free_netdev() after pci_iounmap()\ncalls.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47235" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0260916843cc74f3906acf8b6f256693e01530a2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/19f88ca68ccf8771276a606765239b167654f84a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1cafc540b7bf1b6a5a77dc000205fe337ef6eba6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/95deeb29d831e2fae608439e243e7a520611e7ea" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9cca0c2d70149160407bda9a9446ce0c29b6e6c6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b1ad283755095a4b9d1431aeb357d7df1a33d3bb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d11d79e52ba080ee567cb7d7eb42a5ade60a8130" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/db2bc3cfd2bc01621014d4f17cdfc74611f339c8" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-pcwf-v3ph-3p9v/GHSA-pcwf-v3ph-3p9v.json b/advisories/unreviewed/2024/05/GHSA-pcwf-v3ph-3p9v/GHSA-pcwf-v3ph-3p9v.json new file mode 100644 index 00000000000..d568c63133b --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-pcwf-v3ph-3p9v/GHSA-pcwf-v3ph-3p9v.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pcwf-v3ph-3p9v", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47284" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nisdn: mISDN: netjet: Fix crash in nj_probe:\n\n'nj_setup' in netjet.c might fail with -EIO and in this case\n'card->irq' is initialized and is bigger than zero. A subsequent call to\n'nj_release' will free the irq that has not been requested.\n\nFix this bug by deleting the previous assignment to 'card->irq' and just\nkeep the assignment before 'request_irq'.\n\nThe KASAN's log reveals it:\n\n[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826\nfree_irq+0x100/0x480\n[ 3.355112 ] Modules linked in:\n[ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted\n5.13.0-rc1-00144-g25a1298726e #13\n[ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[ 3.356552 ] RIP: 0010:free_irq+0x100/0x480\n[ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18\n4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5\nff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80\n[ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082\n[ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:\n0000000000000000\n[ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:\n00000000ffffffff\n[ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:\n0000000000000000\n[ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:\n0000000000000000\n[ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:\nffff888104dc80a8\n[ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000)\nknlGS:0000000000000000\n[ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4:\n00000000000006f0\n[ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n0000000000000000\n[ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:\n0000000000000400\n[ 3.362175 ] Call Trace:\n[ 3.362175 ] nj_release+0x51/0x1e0\n[ 3.362175 ] nj_probe+0x450/0x950\n[ 3.362175 ] ? pci_device_remove+0x110/0x110\n[ 3.362175 ] local_pci_probe+0x45/0xa0\n[ 3.362175 ] pci_device_probe+0x12b/0x1d0\n[ 3.362175 ] really_probe+0x2a9/0x610\n[ 3.362175 ] driver_probe_device+0x90/0x1d0\n[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20\n[ 3.362175 ] device_driver_attach+0x68/0x70\n[ 3.362175 ] __driver_attach+0x124/0x1b0\n[ 3.362175 ] ? device_driver_attach+0x70/0x70\n[ 3.362175 ] bus_for_each_dev+0xbb/0x110\n[ 3.362175 ] ? rdinit_setup+0x45/0x45\n[ 3.362175 ] driver_attach+0x27/0x30\n[ 3.362175 ] bus_add_driver+0x1eb/0x2a0\n[ 3.362175 ] driver_register+0xa9/0x180\n[ 3.362175 ] __pci_register_driver+0x82/0x90\n[ 3.362175 ] ? w6692_init+0x38/0x38\n[ 3.362175 ] nj_init+0x36/0x38\n[ 3.362175 ] do_one_initcall+0x7f/0x3d0\n[ 3.362175 ] ? rdinit_setup+0x45/0x45\n[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80\n[ 3.362175 ] kernel_init_freeable+0x2aa/0x301\n[ 3.362175 ] ? rest_init+0x2c0/0x2c0\n[ 3.362175 ] kernel_init+0x18/0x190\n[ 3.362175 ] ? rest_init+0x2c0/0x2c0\n[ 3.362175 ] ? rest_init+0x2c0/0x2c0\n[ 3.362175 ] ret_from_fork+0x1f/0x30\n[ 3.362175 ] Kernel panic - not syncing: panic_on_warn set ...\n[ 3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted\n5.13.0-rc1-00144-g25a1298726e #13\n[ 3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[ 3.362175 ] Call Trace:\n[ 3.362175 ] dump_stack+0xba/0xf5\n[ 3.362175 ] ? free_irq+0x100/0x480\n[ 3.362175 ] panic+0x15a/0x3f2\n[ 3.362175 ] ? __warn+0xf2/0x150\n[ 3.362175 ] ? free_irq+0x100/0x480\n[ 3.362175 ] __warn+0x108/0x150\n[ 3.362175 ] ? free_irq+0x100/0x480\n[ 3.362175 ] report_bug+0x119/0x1c0\n[ 3.362175 ] handle_bug+0x3b/0x80\n[ 3.362175 ] exc_invalid_op+0x18/0x70\n[ 3.362175 ] asm_exc_invalid_op+0x12/0x20\n[ 3.362175 ] RIP: 0010:free_irq+0x100\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47284" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/143fc7220961220eecc04669e5909af8847bf8c8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4c1fcb6ec964b44edbf84235134582a5ffae1521" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6249193e03709ea625e10706ecaf17fea0427d3d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/958cb1078ca60d214826fd90a0961a447fade59a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9d7d4649dc1c53acf76df260fd519db698ed20d7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9f6f852550d0e1b7735651228116ae9d300f69b3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a0a37e4454ca1c0b424edc2c9c2487c2c46a1be6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bf78e25bd3f487208e042c67c8a31706c2dba265" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-pmmh-7pm7-hc62/GHSA-pmmh-7pm7-hc62.json b/advisories/unreviewed/2024/05/GHSA-pmmh-7pm7-hc62/GHSA-pmmh-7pm7-hc62.json new file mode 100644 index 00000000000..6f1509ccce6 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-pmmh-7pm7-hc62/GHSA-pmmh-7pm7-hc62.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pmmh-7pm7-hc62", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47233" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: rt4801: Fix NULL pointer dereference if priv->enable_gpios is NULL\n\ndevm_gpiod_get_array_optional may return NULL if no GPIO was assigned.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47233" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ba8a26a7ce8617f9f3d6230de34b2302df086b41" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cb2381cbecb81a8893b2d1e1af29bc2e5531df27" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dc68f0c9e4a001e02376fe87f4bdcacadb27e8a1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-pmrx-2gv3-hv52/GHSA-pmrx-2gv3-hv52.json b/advisories/unreviewed/2024/05/GHSA-pmrx-2gv3-hv52/GHSA-pmrx-2gv3-hv52.json new file mode 100644 index 00000000000..95020ecca31 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-pmrx-2gv3-hv52/GHSA-pmrx-2gv3-hv52.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pmrx-2gv3-hv52", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47332" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: Don't call free_pages_exact() with NULL address\n\nUnlike some other functions, we can't pass NULL pointer to\nfree_pages_exact(). Add a proper NULL check for avoiding possible\nOops.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47332" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7d7f30cf182e55023fa8fde4c084b2d37c6be69d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/82e5ee742fdd8874fe996181b87fafe1eb5f1196" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/88262229b778f4f7a896da828d966f94dcb35d19" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bee295f5e03510252d18b25cc1d26230256eb87a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cae0cf651adccee2c3f376e78f30fbd788d0829f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-ppm9-9qx2-3mjr/GHSA-ppm9-9qx2-3mjr.json b/advisories/unreviewed/2024/05/GHSA-ppm9-9qx2-3mjr/GHSA-ppm9-9qx2-3mjr.json new file mode 100644 index 00000000000..4dff53d40cf --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-ppm9-9qx2-3mjr/GHSA-ppm9-9qx2-3mjr.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ppm9-9qx2-3mjr", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47326" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/signal: Detect and prevent an alternate signal stack overflow\n\nThe kernel pushes context on to the userspace stack to prepare for the\nuser's signal handler. When the user has supplied an alternate signal\nstack, via sigaltstack(2), it is easy for the kernel to verify that the\nstack size is sufficient for the current hardware context.\n\nCheck if writing the hardware context to the alternate stack will exceed\nit's size. If yes, then instead of corrupting user-data and proceeding with\nthe original signal handler, an immediate SIGSEGV signal is delivered.\n\nRefactor the stack pointer check code from on_sig_stack() and use the new\nhelper.\n\nWhile the kernel allows new source code to discover and use a sufficient\nalternate signal stack size, this check is still necessary to protect\nbinaries with insufficient alternate signal stack size from data\ncorruption.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47326" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/00fcd8f33e9b9f57115c3b1cfc4cb96450c18796" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2beb4a53fc3f1081cedc1c1a198c7f56cc4fc60c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/74569cb9ed7bc60e395927f55d3dc3be143a0164" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/74d6fcea1d896800e60f1c675137efebd1a6c9a6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/afb04d0b5543a5bf8e157b9119fbfc52606f4c11" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-prq2-qj2r-jcgv/GHSA-prq2-qj2r-jcgv.json b/advisories/unreviewed/2024/05/GHSA-prq2-qj2r-jcgv/GHSA-prq2-qj2r-jcgv.json new file mode 100644 index 00000000000..a620ab737b0 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-prq2-qj2r-jcgv/GHSA-prq2-qj2r-jcgv.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-prq2-qj2r-jcgv", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47249" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix memory leak in rds_recvmsg\n\nSyzbot reported memory leak in rds. The problem\nwas in unputted refcount in case of error.\n\nint rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,\n\t\tint msg_flags)\n{\n...\n\n\tif (!rds_next_incoming(rs, &inc)) {\n\t\t...\n\t}\n\nAfter this \"if\" inc refcount incremented and\n\n\tif (rds_cmsg_recv(inc, msg, rs)) {\n\t\tret = -EFAULT;\n\t\tgoto out;\n\t}\n...\nout:\n\treturn ret;\n}\n\nin case of rds_cmsg_recv() fail the refcount won't be\ndecremented. And it's easy to see from ftrace log, that\nrds_inc_addref() don't have rds_inc_put() pair in\nrds_recvmsg() after rds_cmsg_recv()\n\n 1) | rds_recvmsg() {\n 1) 3.721 us | rds_inc_addref();\n 1) 3.853 us | rds_message_inc_copy_to_user();\n 1) + 10.395 us | rds_cmsg_recv();\n 1) + 34.260 us | }", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47249" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/06b7cb0194bd1ede0dd27f3a946e7c0279fba44a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1f79bc8ae81c05eb112a53f981cb2c244ee50d02" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2038cd15eacdf7512755c27686822e0052eb9042" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/423c6939758fb3b9cf5abbd1e7792068a5c4ae8c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/49bfcbfd989a8f1f23e705759a6bb099de2cff9f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5946fbf48355f5a8caeff72580c7658da5966b86" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8c3ec88b03e9e4ca117dcdc4204fd3edcd02084f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b25b60d076164edb3025e85aabd2cf50a5215b91" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-pv65-xqrg-hc85/GHSA-pv65-xqrg-hc85.json b/advisories/unreviewed/2024/05/GHSA-pv65-xqrg-hc85/GHSA-pv65-xqrg-hc85.json new file mode 100644 index 00000000000..7dbe32d8c73 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-pv65-xqrg-hc85/GHSA-pv65-xqrg-hc85.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pv65-xqrg-hc85", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47345" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix rdma_resolve_route() memory leak\n\nFix a memory leak when \"mda_resolve_route() is called more than once on\nthe same \"rdma_cm_id\".\n\nThis is possible if cma_query_handler() triggers the\nRDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and\nallows rdma_resolve_route() to be called again.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47345" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/032c68b4f5be128a2167f35b558b7cec88fe4972" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/07583ba2e2d8947c3d365d97608cb436510885ac" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3d08b5917984f737f32d5bee9737b9075c3895c6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/40b613db3a95bc27998e4097d74c2f7e5d083a0b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4893c938f2a140a74be91779e45e4a7fa111198f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/74f160ead74bfe5f2b38afb4fcf86189f9ff40c9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e2da8ce2a9543f3ca5c93369bd1fe6eeb572101a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e4e062da082a199357ba4911145f331d40139ad8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f4f553d67236145fa5fd203ed7b35b9377e19939" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-pwqm-5jrg-2v3g/GHSA-pwqm-5jrg-2v3g.json b/advisories/unreviewed/2024/05/GHSA-pwqm-5jrg-2v3g/GHSA-pwqm-5jrg-2v3g.json new file mode 100644 index 00000000000..70a37489611 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-pwqm-5jrg-2v3g/GHSA-pwqm-5jrg-2v3g.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pwqm-5jrg-2v3g", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47320" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: fix acl memory leak of posix_acl_create()\n\nWhen looking into another nfs xfstests report, I found acl and\ndefault_acl in nfs3_proc_create() and nfs3_proc_mknod() error\npaths are possibly leaked. Fix them in advance.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47320" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0704f617040c397ae73c1f88f3956787ec5d6529" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1fcb6fcd74a222d9ead54d405842fc763bb86262" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2e3960f276b4574a9bb0dfa31a7497302f6363b2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4b515308ab875c7e8ada8e606fe0c64762da5ed4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/687cf32865b2d6960214bce523f2afac58dd3cd2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8a2b308a54c5ec224fedc753617f99b29ffcd883" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c8fc86e9df6a6a03f5a8e15a3b7a5c75fd05aa38" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cef9d9acb7c80ed6bace894b6334557fd493863b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d0b32dc1409f7e65e4fcc34e236462268e69a357" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-px85-vjfw-cm92/GHSA-px85-vjfw-cm92.json b/advisories/unreviewed/2024/05/GHSA-px85-vjfw-cm92/GHSA-px85-vjfw-cm92.json new file mode 100644 index 00000000000..47937ca7f1a --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-px85-vjfw-cm92/GHSA-px85-vjfw-cm92.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-px85-vjfw-cm92", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47274" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Correct the length check which causes memory corruption\n\nWe've suffered from severe kernel crashes due to memory corruption on\nour production environment, like,\n\nCall Trace:\n[1640542.554277] general protection fault: 0000 [#1] SMP PTI\n[1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G\n[1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190\n[1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286\n[1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX:\n0000000006e931bf\n[1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI:\nffff9a45ff004300\n[1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09:\n0000000000000000\n[1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12:\nffffffff9a20608d\n[1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15:\n696c662f65636976\n[1640542.563128] FS: 00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000)\nknlGS:0000000000000000\n[1640542.563937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4:\n00000000003606e0\n[1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n0000000000000000\n[1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:\n0000000000000400\n[1640542.566742] Call Trace:\n[1640542.567009] anon_vma_clone+0x5d/0x170\n[1640542.567417] __split_vma+0x91/0x1a0\n[1640542.567777] do_munmap+0x2c6/0x320\n[1640542.568128] vm_munmap+0x54/0x70\n[1640542.569990] __x64_sys_munmap+0x22/0x30\n[1640542.572005] do_syscall_64+0x5b/0x1b0\n[1640542.573724] entry_SYSCALL_64_after_hwframe+0x44/0xa9\n[1640542.575642] RIP: 0033:0x7f45d6e61e27\n\nJames Wang has reproduced it stably on the latest 4.19 LTS.\nAfter some debugging, we finally proved that it's due to ftrace\nbuffer out-of-bound access using a debug tool as follows:\n[ 86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000\n[ 86.780806] no_context+0xdf/0x3c0\n[ 86.784327] __do_page_fault+0x252/0x470\n[ 86.788367] do_page_fault+0x32/0x140\n[ 86.792145] page_fault+0x1e/0x30\n[ 86.795576] strncpy_from_unsafe+0x66/0xb0\n[ 86.799789] fetch_memory_string+0x25/0x40\n[ 86.804002] fetch_deref_string+0x51/0x60\n[ 86.808134] kprobe_trace_func+0x32d/0x3a0\n[ 86.812347] kprobe_dispatcher+0x45/0x50\n[ 86.816385] kprobe_ftrace_handler+0x90/0xf0\n[ 86.820779] ftrace_ops_assist_func+0xa1/0x140\n[ 86.825340] 0xffffffffc00750bf\n[ 86.828603] do_sys_open+0x5/0x1f0\n[ 86.832124] do_syscall_64+0x5b/0x1b0\n[ 86.835900] entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\ncommit b220c049d519 (\"tracing: Check length before giving out\nthe filter buffer\") adds length check to protect trace data\noverflow introduced in 0fc1b09ff1ff, seems that this fix can't prevent\noverflow entirely, the length check should also take the sizeof\nentry->array[0] into account, since this array[0] is filled the\nlength of trace data and occupy addtional space and risk overflow.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47274" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2d598902799886d67947406f26ee8e5fd2ca097f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/31ceae385556c37e4d286cb6378696448f566883" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3e08a9f9760f4a70d633c328a76408e62d6f80a3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/43c32c22254b9328d7abb1c2b0f689dc67838e60" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b16a249eca2230c2cd66fa1d4b94743bd9b6ef92" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d63f00ec908b3be635ead5d6029cc94246e1f38d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/edcce01e0e50840a9aa6a70baed21477bdd2c9f9" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-pxqq-3ph7-mw6w/GHSA-pxqq-3ph7-mw6w.json b/advisories/unreviewed/2024/05/GHSA-pxqq-3ph7-mw6w/GHSA-pxqq-3ph7-mw6w.json new file mode 100644 index 00000000000..5f23bb62627 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-pxqq-3ph7-mw6w/GHSA-pxqq-3ph7-mw6w.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pxqq-3ph7-mw6w", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47421" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume\n\nIn current code, when a PCI error state pci_channel_io_normal is detectd,\nit will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI\ndriver will continue the execution of PCI resume callback report_resume by\npci_walk_bridge, and the callback will go into amdgpu_pci_resume\nfinally, where write lock is releasd unconditionally without acquiring\nsuch lock first. In this case, a deadlock will happen when other threads\nstart to acquire the read lock.\n\nTo fix this, add a member in amdgpu_device strucutre to cache\npci_channel_state, and only continue the execution in amdgpu_pci_resume\nwhen it's pci_channel_io_frozen.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47421" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/248b061689a40f4fed05252ee2c89f87cf26d7d8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/72e9a1bf9b722628c28092e0c2cd8717edd201dc" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-q44p-8h6w-57m6/GHSA-q44p-8h6w-57m6.json b/advisories/unreviewed/2024/05/GHSA-q44p-8h6w-57m6/GHSA-q44p-8h6w-57m6.json new file mode 100644 index 00000000000..0db535af94e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-q44p-8h6w-57m6/GHSA-q44p-8h6w-57m6.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q44p-8h6w-57m6", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47388" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211: fix use-after-free in CCMP/GCMP RX\n\nWhen PN checking is done in mac80211, for fragmentation we need\nto copy the PN to the RX struct so we can later use it to do a\ncomparison, since commit bf30ca922a0c (\"mac80211: check defrag\nPN against current frame\").\n\nUnfortunately, in that commit I used the 'hdr' variable without\nit being necessarily valid, so use-after-free could occur if it\nwas necessary to reallocate (parts of) the frame.\n\nFix this by reloading the variable after the code that results\nin the reallocations, if any.\n\nThis fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47388" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4dd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-q77h-85v7-m3mw/GHSA-q77h-85v7-m3mw.json b/advisories/unreviewed/2024/05/GHSA-q77h-85v7-m3mw/GHSA-q77h-85v7-m3mw.json new file mode 100644 index 00000000000..e70b8e081aa --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-q77h-85v7-m3mw/GHSA-q77h-85v7-m3mw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q77h-85v7-m3mw", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47382" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: fix deadlock during failing recovery\n\nCommit 0b9902c1fcc5 (\"s390/qeth: fix deadlock during recovery\") removed\ntaking discipline_mutex inside qeth_do_reset(), fixing potential\ndeadlocks. An error path was missed though, that still takes\ndiscipline_mutex and thus has the original deadlock potential.\n\nIntermittent deadlocks were seen when a qeth channel path is configured\noffline, causing a race between qeth_do_reset and ccwgroup_remove.\nCall qeth_set_offline() directly in the qeth_do_reset() error case and\nthen a new variant of ccwgroup_set_offline(), without taking\ndiscipline_mutex.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47382" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0bfe741741327822d1482c7edef0184636d08b40" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qh8g-p933-67r9/GHSA-qh8g-p933-67r9.json b/advisories/unreviewed/2024/05/GHSA-qh8g-p933-67r9/GHSA-qh8g-p933-67r9.json new file mode 100644 index 00000000000..1797eb3df37 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qh8g-p933-67r9/GHSA-qh8g-p933-67r9.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qh8g-p933-67r9", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47398" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Fix kernel pointer leak\n\nPointers should be printed with %p or %px rather than cast to 'unsigned\nlong long' and printed with %llx. Change %llx to %p to print the secured\npointer.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47398" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/714bfabe5f2901d96902e271d7217601fe4703e5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7d5cfafe8b4006a75b55c2f1fdfdb363f9a5cc98" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qj4q-cgq8-w2m4/GHSA-qj4q-cgq8-w2m4.json b/advisories/unreviewed/2024/05/GHSA-qj4q-cgq8-w2m4/GHSA-qj4q-cgq8-w2m4.json new file mode 100644 index 00000000000..87957ce2c84 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qj4q-cgq8-w2m4/GHSA-qj4q-cgq8-w2m4.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qj4q-cgq8-w2m4", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47413" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle\n\nWhen passing 'phys' in the devicetree to describe the USB PHY phandle\n(which is the recommended way according to\nDocumentation/devicetree/bindings/usb/ci-hdrc-usb2.txt) the\nfollowing NULL pointer dereference is observed on i.MX7 and i.MX8MM:\n\n[ 1.489344] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098\n[ 1.498170] Mem abort info:\n[ 1.500966] ESR = 0x96000044\n[ 1.504030] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 1.509356] SET = 0, FnV = 0\n[ 1.512416] EA = 0, S1PTW = 0\n[ 1.515569] FSC = 0x04: level 0 translation fault\n[ 1.520458] Data abort info:\n[ 1.523349] ISV = 0, ISS = 0x00000044\n[ 1.527196] CM = 0, WnR = 1\n[ 1.530176] [0000000000000098] user address but active_mm is swapper\n[ 1.536544] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 1.542125] Modules linked in:\n[ 1.545190] CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.14.0-dirty #3\n[ 1.551901] Hardware name: Kontron i.MX8MM N801X S (DT)\n[ 1.557133] Workqueue: events_unbound deferred_probe_work_func\n[ 1.562984] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)\n[ 1.568998] pc : imx7d_charger_detection+0x3f0/0x510\n[ 1.573973] lr : imx7d_charger_detection+0x22c/0x510\n\nThis happens because the charger functions check for the phy presence\ninside the imx_usbmisc_data structure (data->usb_phy), but the chipidea\ncore populates the usb_phy passed via 'phys' inside 'struct ci_hdrc'\n(ci->usb_phy) instead.\n\nThis causes the NULL pointer dereference inside imx7d_charger_detection().\n\nFix it by also searching for 'phys' in case 'fsl,usbphy' is not found.\n\nTested on a imx7s-warp board.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47413" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/66dd03b10e1c0b2fae006c6e34c18ea8ee033e7b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8253a34bfae3278baca52fc1209b7c29270486ca" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b3265b88e83b16c7be762fa5fb7e0632bce0002c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qj68-9gpw-8pq2/GHSA-qj68-9gpw-8pq2.json b/advisories/unreviewed/2024/05/GHSA-qj68-9gpw-8pq2/GHSA-qj68-9gpw-8pq2.json new file mode 100644 index 00000000000..0ddb62ea9f8 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qj68-9gpw-8pq2/GHSA-qj68-9gpw-8pq2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qj68-9gpw-8pq2", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47275" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: avoid oversized read request in cache missing code path\n\nIn the cache missing code path of cached device, if a proper location\nfrom the internal B+ tree is matched for a cache miss range, function\ncached_dev_cache_miss() will be called in cache_lookup_fn() in the\nfollowing code block,\n[code block 1]\n 526 unsigned int sectors = KEY_INODE(k) == s->iop.inode\n 527 ? min_t(uint64_t, INT_MAX,\n 528 KEY_START(k) - bio->bi_iter.bi_sector)\n 529 : INT_MAX;\n 530 int ret = s->d->cache_miss(b, s, bio, sectors);\n\nHere s->d->cache_miss() is the call backfunction pointer initialized as\ncached_dev_cache_miss(), the last parameter 'sectors' is an important\nhint to calculate the size of read request to backing device of the\nmissing cache data.\n\nCurrent calculation in above code block may generate oversized value of\n'sectors', which consequently may trigger 2 different potential kernel\npanics by BUG() or BUG_ON() as listed below,\n\n1) BUG_ON() inside bch_btree_insert_key(),\n[code block 2]\n 886 BUG_ON(b->ops->is_extents && !KEY_SIZE(k));\n2) BUG() inside biovec_slab(),\n[code block 3]\n 51 default:\n 52 BUG();\n 53 return NULL;\n\nAll the above panics are original from cached_dev_cache_miss() by the\noversized parameter 'sectors'.\n\nInside cached_dev_cache_miss(), parameter 'sectors' is used to calculate\nthe size of data read from backing device for the cache missing. This\nsize is stored in s->insert_bio_sectors by the following lines of code,\n[code block 4]\n 909 s->insert_bio_sectors = min(sectors, bio_sectors(bio) + reada);\n\nThen the actual key inserting to the internal B+ tree is generated and\nstored in s->iop.replace_key by the following lines of code,\n[code block 5]\n 911 s->iop.replace_key = KEY(s->iop.inode,\n 912 bio->bi_iter.bi_sector + s->insert_bio_sectors,\n 913 s->insert_bio_sectors);\nThe oversized parameter 'sectors' may trigger panic 1) by BUG_ON() from\nthe above code block.\n\nAnd the bio sending to backing device for the missing data is allocated\nwith hint from s->insert_bio_sectors by the following lines of code,\n[code block 6]\n 926 cache_bio = bio_alloc_bioset(GFP_NOWAIT,\n 927 DIV_ROUND_UP(s->insert_bio_sectors, PAGE_SECTORS),\n 928 &dc->disk.bio_split);\nThe oversized parameter 'sectors' may trigger panic 2) by BUG() from the\nagove code block.\n\nNow let me explain how the panics happen with the oversized 'sectors'.\nIn code block 5, replace_key is generated by macro KEY(). From the\ndefinition of macro KEY(),\n[code block 7]\n 71 #define KEY(inode, offset, size) \\\n 72 ((struct bkey) { \\\n 73 .high = (1ULL << 63) | ((__u64) (size) << 20) | (inode), \\\n 74 .low = (offset) \\\n 75 })\n\nHere 'size' is 16bits width embedded in 64bits member 'high' of struct\nbkey. But in code block 1, if \"KEY_START(k) - bio->bi_iter.bi_sector\" is\nvery probably to be larger than (1<<16) - 1, which makes the bkey size\ncalculation in code block 5 is overflowed. In one bug report the value\nof parameter 'sectors' is 131072 (= 1 << 17), the overflowed 'sectors'\nresults the overflowed s->insert_bio_sectors in code block 4, then makes\nsize field of s->iop.replace_key to be 0 in code block 5. Then the 0-\nsized s->iop.replace_key is inserted into the internal B+ tree as cache\nmissing check key (a special key to detect and avoid a racing between\nnormal write request and cache missing read request) as,\n[code block 8]\n 915 ret = bch_btree_insert_check_key(b, &s->op, &s->iop.replace_key);\n\nThen the 0-sized s->iop.replace_key as 3rd parameter triggers the bkey\nsize check BUG_ON() in code block 2, and causes the kernel panic 1).\n\nAnother ke\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47275" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/41fe8d088e96472f63164e213de44ec77be69478" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/555002a840ab88468e252b0eedf0b05e2ce7099c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qp63-w47q-g9vj/GHSA-qp63-w47q-g9vj.json b/advisories/unreviewed/2024/05/GHSA-qp63-w47q-g9vj/GHSA-qp63-w47q-g9vj.json new file mode 100644 index 00000000000..b227b66f121 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qp63-w47q-g9vj/GHSA-qp63-w47q-g9vj.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qp63-w47q-g9vj", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47269" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: ep0: fix NULL pointer exception\n\nThere is no validation of the index from dwc3_wIndex_to_dep() and we might\nbe referring a non-existing ep and trigger a NULL pointer exception. In\ncertain configurations we might use fewer eps and the index might wrongly\nindicate a larger ep index than existing.\n\nBy adding this validation from the patch we can actually report a wrong\nindex back to the caller.\n\nIn our usecase we are using a composite device on an older kernel, but\nupstream might use this fix also. Unfortunately, I cannot describe the\nhardware for others to reproduce the issue as it is a proprietary\nimplementation.\n\n[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4\n[ 82.966891] Mem abort info:\n[ 82.969663] ESR = 0x96000006\n[ 82.972703] Exception class = DABT (current EL), IL = 32 bits\n[ 82.978603] SET = 0, FnV = 0\n[ 82.981642] EA = 0, S1PTW = 0\n[ 82.984765] Data abort info:\n[ 82.987631] ISV = 0, ISS = 0x00000006\n[ 82.991449] CM = 0, WnR = 0\n[ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc\n[ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000\n[ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP\n[ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)\n[ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1\n[ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)\n[ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c\n[ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94\n\n...\n\n[ 83.141788] Call trace:\n[ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c\n[ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94\n[ 83.181546] ---[ end trace aac6b5267d84c32f ]---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47269" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qpf6-m6mq-hcmq/GHSA-qpf6-m6mq-hcmq.json b/advisories/unreviewed/2024/05/GHSA-qpf6-m6mq-hcmq/GHSA-qpf6-m6mq-hcmq.json new file mode 100644 index 00000000000..d29101dd1ac --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qpf6-m6mq-hcmq/GHSA-qpf6-m6mq-hcmq.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qpf6-m6mq-hcmq", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47380" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: Fix potential NULL pointer dereference\n\ndevm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at\nregistration that will cause NULL pointer dereference since\ncorresponding data is not initialized yet. The patch moves\ninitialization of data before devm_add_action_or_reset().\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[jkosina@suse.cz: rebase]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47380" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/283e4bee701dfcd409dd293f19a268bb2bc8ff38" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d46ef750ed58cbeeba2d9a55c99231c30a172764" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qqw5-j897-27cf/GHSA-qqw5-j897-27cf.json b/advisories/unreviewed/2024/05/GHSA-qqw5-j897-27cf/GHSA-qqw5-j897-27cf.json new file mode 100644 index 00000000000..7ae0d40a99f --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qqw5-j897-27cf/GHSA-qqw5-j897-27cf.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qqw5-j897-27cf", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47293" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_skbmod: Skip non-Ethernet packets\n\nCurrently tcf_skbmod_act() assumes that packets use Ethernet as their L2\nprotocol, which is not always the case. As an example, for CAN devices:\n\n\t$ ip link add dev vcan0 type vcan\n\t$ ip link set up vcan0\n\t$ tc qdisc add dev vcan0 root handle 1: htb\n\t$ tc filter add dev vcan0 parent 1: protocol ip prio 10 \\\n\t\tmatchall action skbmod swap mac\n\nDoing the above silently corrupts all the packets. Do not perform skbmod\nactions for non-Ethernet packets.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47293" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/071729150be9e1d1b851b70efb6d91ee9269d57b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/34f1e1f657fae2891b485a3b2b95fe4d2aef9f0d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/727d6a8b7ef3d25080fad228b2c4a1d4da5999c6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a88414fb1117f2fe65fb88e45ba694e1d09d5024" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e4fdca366806f6bab374d1a95e626a10a3854b0c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qr6c-mgw3-xxq8/GHSA-qr6c-mgw3-xxq8.json b/advisories/unreviewed/2024/05/GHSA-qr6c-mgw3-xxq8/GHSA-qr6c-mgw3-xxq8.json new file mode 100644 index 00000000000..8dd37a6418d --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qr6c-mgw3-xxq8/GHSA-qr6c-mgw3-xxq8.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qr6c-mgw3-xxq8", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47357" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: iphase: fix possible use-after-free in ia_module_exit()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47357" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1c72e6ab66b9598cac741ed397438a52065a8f1f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/89ce0b0747f319eb70f85bc820dcc43cebbd5417" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9e161687855175334ca93c6c3ccb221731194479" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a832ee2f2145f57443b2d565f8cb5490e8339f42" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b58d246a058ae88484758cd4ab27b3180fd5ecf8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bcdd2be48edd8c6867fb44112cb8d18086beae29" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c9172498d4d62c9b64e5fb37c1ee0343e65fe51b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d1fb12412874c94ad037e11d0ecdd1140a439297" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e759ff76ebbbfcdcf83b6634c54dc47828573d8b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qvgm-cw57-rm8q/GHSA-qvgm-cw57-rm8q.json b/advisories/unreviewed/2024/05/GHSA-qvgm-cw57-rm8q/GHSA-qvgm-cw57-rm8q.json new file mode 100644 index 00000000000..85bfe57f93c --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qvgm-cw57-rm8q/GHSA-qvgm-cw57-rm8q.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qvgm-cw57-rm8q", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47343" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: assign new_root only when removal succeeds\n\nremove_raw() in dm_btree_remove() may fail due to IO read error\n(e.g. read the content of origin block fails during shadowing),\nand the value of shadow_spine::root is uninitialized, but\nthe uninitialized value is still assign to new_root in the\nend of dm_btree_remove().\n\nFor dm-thin, the value of pmd->details_root or pmd->root will become\nan uninitialized value, so if trying to read details_info tree again\nout-of-bound memory may occur as showed below:\n\n general protection fault, probably for non-canonical address 0x3fdcb14c8d7520\n CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6\n Hardware name: QEMU Standard PC\n RIP: 0010:metadata_ll_load_ie+0x14/0x30\n Call Trace:\n sm_metadata_count_is_more_than_one+0xb9/0xe0\n dm_tm_shadow_block+0x52/0x1c0\n shadow_step+0x59/0xf0\n remove_raw+0xb2/0x170\n dm_btree_remove+0xf4/0x1c0\n dm_pool_delete_thin_device+0xc3/0x140\n pool_message+0x218/0x2b0\n target_message+0x251/0x290\n ctl_ioctl+0x1c4/0x4d0\n dm_ctl_ioctl+0xe/0x20\n __x64_sys_ioctl+0x7b/0xb0\n do_syscall_64+0x40/0xb0\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixing it by only assign new_root when removal succeeds", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47343" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4c84b3e0728ffe10d89c633694c35a02b5c477dc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/73f27adaa73e3057a9ec464e33c4f54d34ea5de3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/89bf942314b78d454db92427201421b5dec132d9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8fbae4a1bdb5b889490cdee929e68540151536e5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/964d57d1962d7e68f0f578f05d9ae4a104d74851" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ad365e9351ac2b450e7e79932ff6abf59342d91a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b6e58b5466b2959f83034bead2e2e1395cca8aeb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ba47e65a5de3e0e8270301a409fc63d3129fdb9e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c154775619186781aaf8a99333ac07437a1768d5" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qxvg-qh99-hg66/GHSA-qxvg-qh99-hg66.json b/advisories/unreviewed/2024/05/GHSA-qxvg-qh99-hg66/GHSA-qxvg-qh99-hg66.json new file mode 100644 index 00000000000..b4664624732 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qxvg-qh99-hg66/GHSA-qxvg-qh99-hg66.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qxvg-qh99-hg66", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47264" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: core: Fix Null-point-dereference in fmt_single_name()\n\nCheck the return value of devm_kstrdup() in case of\nNull-point-dereference.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47264" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/047fd16015a79180771650aa6ce71f68b2c23368" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0e2c9aeb00289f279b8181fbd4c20765127d8943" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/41daf6ba594d55f201c50280ebcd430590441da1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-r2r3-fm28-9g3h/GHSA-r2r3-fm28-9g3h.json b/advisories/unreviewed/2024/05/GHSA-r2r3-fm28-9g3h/GHSA-r2r3-fm28-9g3h.json new file mode 100644 index 00000000000..7449238d916 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-r2r3-fm28-9g3h/GHSA-r2r3-fm28-9g3h.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r2r3-fm28-9g3h", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47390" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()\n\nKASAN reports the following issue:\n\n BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm]\n Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798\n\n CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G X --------- ---\n Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020\n Call Trace:\n dump_stack+0xa5/0xe6\n print_address_description.constprop.0+0x18/0x130\n ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm]\n __kasan_report.cold+0x7f/0x114\n ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm]\n kasan_report+0x38/0x50\n kasan_check_range+0xf5/0x1d0\n kvm_make_vcpus_request_mask+0x174/0x440 [kvm]\n kvm_make_scan_ioapic_request_mask+0x84/0xc0 [kvm]\n ? kvm_arch_exit+0x110/0x110 [kvm]\n ? sched_clock+0x5/0x10\n ioapic_write_indirect+0x59f/0x9e0 [kvm]\n ? static_obj+0xc0/0xc0\n ? __lock_acquired+0x1d2/0x8c0\n ? kvm_ioapic_eoi_inject_work+0x120/0x120 [kvm]\n\nThe problem appears to be that 'vcpu_bitmap' is allocated as a single long\non stack and it should really be KVM_MAX_VCPUS long. We also seem to clear\nthe lower 16 bits of it with bitmap_zero() for no particular reason (my\nguess would be that 'bitmap' and 'vcpu_bitmap' variables in\nkvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed\n16-bit long, the later should accommodate all possible vCPUs).", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47390" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2f9b68f57c6278c322793a06063181deded0ad69" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/99a9e9b80f19fc63be005a33d76211dd23114792" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bebabb76ad9acca8858e0371e102fb60d708e25b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-rcjv-j3v6-r6cv/GHSA-rcjv-j3v6-r6cv.json b/advisories/unreviewed/2024/05/GHSA-rcjv-j3v6-r6cv/GHSA-rcjv-j3v6-r6cv.json new file mode 100644 index 00000000000..e1c149ddb58 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-rcjv-j3v6-r6cv/GHSA-rcjv-j3v6-r6cv.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcjv-j3v6-r6cv", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47280" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix use-after-free read in drm_getunique()\n\nThere is a time-of-check-to-time-of-use error in drm_getunique() due\nto retrieving file_priv->master prior to locking the device's master\nmutex.\n\nAn example can be seen in the crash report of the use-after-free error\nfound by Syzbot:\nhttps://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803\n\nIn the report, the master pointer was used after being freed. This is\nbecause another process had acquired the device's master mutex in\ndrm_setmaster_ioctl(), then overwrote fpriv->master in\ndrm_new_set_master(). The old value of fpriv->master was subsequently\nfreed before the mutex was unlocked.\n\nTo fix this, we lock the device's master mutex before retrieving the\npointer from from fpriv->master. This patch passes the Syzbot\nreproducer test.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47280" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/17dab9326ff263c62dab1dbac4492e2938a049e4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/491d52e0078860b33b6c14f0a7ac74ca1b603bd6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7d233ba700ceb593905ea82b42dadb4ec8ef85e9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b246b4c70c1250e7814f409b243000f9c0bf79a3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b436acd1cf7fac0ba987abd22955d98025c80c2b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f773f8cccac13c7e7bbd9182e7996c727742488e" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-rgj4-j68m-986v/GHSA-rgj4-j68m-986v.json b/advisories/unreviewed/2024/05/GHSA-rgj4-j68m-986v/GHSA-rgj4-j68m-986v.json new file mode 100644 index 00000000000..a8267b0201c --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-rgj4-j68m-986v/GHSA-rgj4-j68m-986v.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rgj4-j68m-986v", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47276" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Do not blindly read the ip address in ftrace_bug()\n\nIt was reported that a bug on arm64 caused a bad ip address to be used for\nupdating into a nop in ftrace_init(), but the error path (rightfully)\nreturned -EINVAL and not -EFAULT, as the bug caused more than one error to\noccur. But because -EINVAL was returned, the ftrace_bug() tried to report\nwhat was at the location of the ip address, and read it directly. This\ncaused the machine to panic, as the ip was not pointing to a valid memory\naddress.\n\nInstead, read the ip address with copy_from_kernel_nofault() to safely\naccess the memory, and if it faults, report that the address faulted,\notherwise report what was in that location.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47276" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0bc62e398bbd9e600959e610def5109957437b28" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3e4ddeb68751fb4fb657199aed9cfd5d02796875" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4aedc2bc2b32c93555f47c95610efb89cc1ec09b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6c14133d2d3f768e0a35128faac8aa6ed4815051" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7e4e824b109f1d41ccf223fbb0565d877d6223a2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/862dcc14f2803c556bdd73b43c27b023fafce2fb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/97524384762c1fb9b3ded931498dd2047bd0de81" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/acf671ba79c1feccc3ec7cfdcffead4efcec49e7" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-rmqp-6x5x-g7fg/GHSA-rmqp-6x5x-g7fg.json b/advisories/unreviewed/2024/05/GHSA-rmqp-6x5x-g7fg/GHSA-rmqp-6x5x-g7fg.json new file mode 100644 index 00000000000..705c39c0fdd --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-rmqp-6x5x-g7fg/GHSA-rmqp-6x5x-g7fg.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rmqp-6x5x-g7fg", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47232" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: fix Use-after-Free, hold skb ref while in use\n\nThis patch fixes a Use-after-Free found by the syzbot.\n\nThe problem is that a skb is taken from the per-session skb queue,\nwithout incrementing the ref count. This leads to a Use-after-Free if\nthe skb is taken concurrently from the session queue due to a CTS.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47232" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1071065eeb33d32b7d98c2ce7591881ae7381705" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2030043e616cab40f510299f09b636285e0a3678" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/22cba878abf646cd3a02ee7c8c2cef7afe66a256" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/509ab6bfdd0c76daebbad0f0af07da712116de22" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-rr3f-v8j5-mmr6/GHSA-rr3f-v8j5-mmr6.json b/advisories/unreviewed/2024/05/GHSA-rr3f-v8j5-mmr6/GHSA-rr3f-v8j5-mmr6.json new file mode 100644 index 00000000000..6452d389ccb --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-rr3f-v8j5-mmr6/GHSA-rr3f-v8j5-mmr6.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rr3f-v8j5-mmr6", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47248" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix race between close() and udp_abort()\n\nKaustubh reported and diagnosed a panic in udp_lib_lookup().\nThe root cause is udp_abort() racing with close(). Both\nracing functions acquire the socket lock, but udp{v6}_destroy_sock()\nrelease it before performing destructive actions.\n\nWe can't easily extend the socket lock scope to avoid the race,\ninstead use the SOCK_DEAD flag to prevent udp_abort from doing\nany action when the critical race happens.\n\nDiagnosed-and-tested-by: Kaustubh Pandey ", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47248" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2f73448041bd0682d4b552cfd314ace66107f1ad" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5a88477c1c85e4baa51e91f2d40f2166235daa56" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/65310b0aff86980a011c7c7bfa487a333d4ca241" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8729ec8a2238152a4afc212a331a6cd2c61aeeac" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a0882f68f54f7a8b6308261acee9bd4faab5a69e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a8b897c7bcd47f4147d066e22cc01d1026d7640e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e3c36c773aed0fef8b1d3d555b43393ec564400f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-rxcf-2w24-j9pq/GHSA-rxcf-2w24-j9pq.json b/advisories/unreviewed/2024/05/GHSA-rxcf-2w24-j9pq/GHSA-rxcf-2w24-j9pq.json new file mode 100644 index 00000000000..64d15a79b58 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-rxcf-2w24-j9pq/GHSA-rxcf-2w24-j9pq.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rxcf-2w24-j9pq", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47427" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi: Fix iscsi_task use after free\n\nCommit d39df158518c (\"scsi: iscsi: Have abort handler get ref to conn\")\nadded iscsi_get_conn()/iscsi_put_conn() calls during abort handling but\nthen also changed the handling of the case where we detect an already\ncompleted task where we now end up doing a goto to the common put/cleanup\ncode. This results in a iscsi_task use after free, because the common\ncleanup code will do a put on the iscsi_task.\n\nThis reverts the goto and moves the iscsi_get_conn() to after we've checked\nif the iscsi_task is valid.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47427" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1642f51ac0d4f2b55d5748094c49ff8f7191b93c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/258aad75c62146453d03028a44f2f1590d58e1f6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-v5r4-g8jp-rvxf/GHSA-v5r4-g8jp-rvxf.json b/advisories/unreviewed/2024/05/GHSA-v5r4-g8jp-rvxf/GHSA-v5r4-g8jp-rvxf.json new file mode 100644 index 00000000000..6eadbef7509 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-v5r4-g8jp-rvxf/GHSA-v5r4-g8jp-rvxf.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v5r4-g8jp-rvxf", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47353" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix NULL pointer dereference in udf_symlink function\n\nIn function udf_symlink, epos.bh is assigned with the value returned\nby udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c\nand returns the value of sb_getblk function that could be NULL.\nThen, epos.bh is used without any check, causing a possible\nNULL pointer dereference when sb_getblk fails.\n\nThis fix adds a check to validate the value of epos.bh.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47353" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/21bf1414580c36ffc8d8de043beb3508cf812238" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2f3d9ddd32a28803baa547e6274983b67d5e287c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3638705ecd5ad2785e996f820121c0ad15ce64b5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/371566f63cbd0bb6fbb25b8fe9d5798268d35af9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5150877e4d99f85057a458daac7cd7c01005d5c6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/80d505aee6398cf8beb72475c7edcf1733c1c68b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/aebed6b19e51a34003d998da5ebb1dfdd2cb1d02" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/baea588a42d675e35daeaddd10fbc9700550bc4d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-v8p3-mfrc-9v8j/GHSA-v8p3-mfrc-9v8j.json b/advisories/unreviewed/2024/05/GHSA-v8p3-mfrc-9v8j/GHSA-v8p3-mfrc-9v8j.json new file mode 100644 index 00000000000..759437812bd --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-v8p3-mfrc-9v8j/GHSA-v8p3-mfrc-9v8j.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v8p3-mfrc-9v8j", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47397" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb\n\nWe should always check if skb_header_pointer's return is NULL before\nusing it, otherwise it may cause null-ptr-deref, as syzbot reported:\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline]\n RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196\n Call Trace:\n \n sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109\n ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422\n ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463\n NF_HOOK include/linux/netfilter.h:307 [inline]\n NF_HOOK include/linux/netfilter.h:301 [inline]\n ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472\n dst_input include/net/dst.h:460 [inline]\n ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]\n NF_HOOK include/linux/netfilter.h:307 [inline]\n NF_HOOK include/linux/netfilter.h:301 [inline]\n ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47397" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/77bc7dcf0fcc1519341a91788d7a2914fcfddf6d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8180611c238e11676612eb2a9828b1c7a3a4d77b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8c630a7b4f9dec63f08bd881ab77984a724a5124" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9c6591ae8e63f93c895ad5e2703c36c548aac997" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ec018021cf445abbe8e2f3e2a7f1dcc813cb8ea1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f7e745f8e94492a8ac0b0a26e25f2b19d342918f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-vp78-5x9p-m27h/GHSA-vp78-5x9p-m27h.json b/advisories/unreviewed/2024/05/GHSA-vp78-5x9p-m27h/GHSA-vp78-5x9p-m27h.json new file mode 100644 index 00000000000..b97446fe1b5 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-vp78-5x9p-m27h/GHSA-vp78-5x9p-m27h.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vp78-5x9p-m27h", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47341" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio\n\nBUG: KASAN: use-after-free in kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\nRead of size 8 at addr ffff0000c03a2500 by task syz-executor083/4269\n\nCPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7\nHardware name: linux,dummy-virt (DT)\nCall trace:\n dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132\n show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x110/0x164 lib/dump_stack.c:118\n print_address_description+0x78/0x5c8 mm/kasan/report.c:385\n __kasan_report mm/kasan/report.c:545 [inline]\n kasan_report+0x148/0x1e4 mm/kasan/report.c:562\n check_memory_region_inline mm/kasan/generic.c:183 [inline]\n __asan_load8+0xb4/0xbc mm/kasan/generic.c:252\n kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\n\nAllocated by task 4269:\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\n kasan_save_stack mm/kasan/common.c:48 [inline]\n kasan_set_track mm/kasan/common.c:56 [inline]\n __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475\n kmem_cache_alloc_trace include/linux/slab.h:450 [inline]\n kmalloc include/linux/slab.h:552 [inline]\n kzalloc include/linux/slab.h:664 [inline]\n kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146\n kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3746\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\n\nFreed by task 4269:\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\n kasan_save_stack mm/kasan/common.c:48 [inline]\n kasan_set_track+0x38/0x6c mm/kasan/common.c:56\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355\n __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422\n kasan_slab_free+0x10/0x1c mm/kasan/common.c:431\n slab_free_hook mm/slub.c:1544 [inline]\n slab_free_freelist_hook mm/slub.c:1577 [inline]\n slab_free mm/slub.c:3142 [inline]\n kfree+0x104/0x38c mm/slub.c:4124\n coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102\n kvm_iodevice_destructor include/kvm/iodev.h:61 [inline]\n kvm_io_bus_unregister_dev+0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374\n kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:186\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\n invoke_syscall arch/arm64/kernel/sys\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47341" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-vrx5-g53m-hhm7/GHSA-vrx5-g53m-hhm7.json b/advisories/unreviewed/2024/05/GHSA-vrx5-g53m-hhm7/GHSA-vrx5-g53m-hhm7.json new file mode 100644 index 00000000000..d56647c44e9 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-vrx5-g53m-hhm7/GHSA-vrx5-g53m-hhm7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vrx5-g53m-hhm7", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47389" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: fix missing sev_decommission in sev_receive_start\n\nDECOMMISSION the current SEV context if binding an ASID fails after\nRECEIVE_START. Per AMD's SEV API, RECEIVE_START generates a new guest\ncontext and thus needs to be paired with DECOMMISSION:\n\n The RECEIVE_START command is the only command other than the LAUNCH_START\n command that generates a new guest context and guest handle.\n\nThe missing DECOMMISSION can result in subsequent SEV launch failures,\nas the firmware leaks memory and might not able to allocate more SEV\nguest contexts in the future.\n\nNote, LAUNCH_START suffered the same bug, but was previously fixed by\ncommit 934002cd660b (\"KVM: SVM: Call SEV Guest Decommission if ASID\nbinding fails\").", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47389" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/efd7866e114dcb44f86d151e843f8276b7efbc67" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f1815e0aa770f2127c5df31eb5c2f0e37b60fa77" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w2mr-3frj-pxv2/GHSA-w2mr-3frj-pxv2.json b/advisories/unreviewed/2024/05/GHSA-w2mr-3frj-pxv2/GHSA-w2mr-3frj-pxv2.json new file mode 100644 index 00000000000..c7aadad0740 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w2mr-3frj-pxv2/GHSA-w2mr-3frj-pxv2.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w2mr-3frj-pxv2", + "modified": "2024-05-21T15:31:38Z", + "published": "2024-05-21T15:31:38Z", + "aliases": [ + "CVE-2024-35361" + ], + "details": "MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. An attacker can execute arbitrary SQL statements through this vulnerability without requiring any user rights.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35361" + }, + { + "type": "WEB", + "url": "https://github.com/Hebing123/cve/issues/37" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T13:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w5h4-c4xx-3r8p/GHSA-w5h4-c4xx-3r8p.json b/advisories/unreviewed/2024/05/GHSA-w5h4-c4xx-3r8p/GHSA-w5h4-c4xx-3r8p.json new file mode 100644 index 00000000000..0ab64f55f8b --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w5h4-c4xx-3r8p/GHSA-w5h4-c4xx-3r8p.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w5h4-c4xx-3r8p", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47300" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix tail_call_reachable rejection for interpreter when jit failed\n\nDuring testing of f263a81451c1 (\"bpf: Track subprog poke descriptors correctly\nand fix use-after-free\") under various failure conditions, for example, when\njit_subprogs() fails and tries to clean up the program to be run under the\ninterpreter, we ran into the following freeze:\n\n [...]\n #127/8 tailcall_bpf2bpf_3:FAIL\n [...]\n [ 92.041251] BUG: KASAN: slab-out-of-bounds in ___bpf_prog_run+0x1b9d/0x2e20\n [ 92.042408] Read of size 8 at addr ffff88800da67f68 by task test_progs/682\n [ 92.043707]\n [ 92.044030] CPU: 1 PID: 682 Comm: test_progs Tainted: G O 5.13.0-53301-ge6c08cb33a30-dirty #87\n [ 92.045542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014\n [ 92.046785] Call Trace:\n [ 92.047171] ? __bpf_prog_run_args64+0xc0/0xc0\n [ 92.047773] ? __bpf_prog_run_args32+0x8b/0xb0\n [ 92.048389] ? __bpf_prog_run_args64+0xc0/0xc0\n [ 92.049019] ? ktime_get+0x117/0x130\n [...] // few hundred [similar] lines more\n [ 92.659025] ? ktime_get+0x117/0x130\n [ 92.659845] ? __bpf_prog_run_args64+0xc0/0xc0\n [ 92.660738] ? __bpf_prog_run_args32+0x8b/0xb0\n [ 92.661528] ? __bpf_prog_run_args64+0xc0/0xc0\n [ 92.662378] ? print_usage_bug+0x50/0x50\n [ 92.663221] ? print_usage_bug+0x50/0x50\n [ 92.664077] ? bpf_ksym_find+0x9c/0xe0\n [ 92.664887] ? ktime_get+0x117/0x130\n [ 92.665624] ? kernel_text_address+0xf5/0x100\n [ 92.666529] ? __kernel_text_address+0xe/0x30\n [ 92.667725] ? unwind_get_return_address+0x2f/0x50\n [ 92.668854] ? ___bpf_prog_run+0x15d4/0x2e20\n [ 92.670185] ? ktime_get+0x117/0x130\n [ 92.671130] ? __bpf_prog_run_args64+0xc0/0xc0\n [ 92.672020] ? __bpf_prog_run_args32+0x8b/0xb0\n [ 92.672860] ? __bpf_prog_run_args64+0xc0/0xc0\n [ 92.675159] ? ktime_get+0x117/0x130\n [ 92.677074] ? lock_is_held_type+0xd5/0x130\n [ 92.678662] ? ___bpf_prog_run+0x15d4/0x2e20\n [ 92.680046] ? ktime_get+0x117/0x130\n [ 92.681285] ? __bpf_prog_run32+0x6b/0x90\n [ 92.682601] ? __bpf_prog_run64+0x90/0x90\n [ 92.683636] ? lock_downgrade+0x370/0x370\n [ 92.684647] ? mark_held_locks+0x44/0x90\n [ 92.685652] ? ktime_get+0x117/0x130\n [ 92.686752] ? lockdep_hardirqs_on+0x79/0x100\n [ 92.688004] ? ktime_get+0x117/0x130\n [ 92.688573] ? __cant_migrate+0x2b/0x80\n [ 92.689192] ? bpf_test_run+0x2f4/0x510\n [ 92.689869] ? bpf_test_timer_continue+0x1c0/0x1c0\n [ 92.690856] ? rcu_read_lock_bh_held+0x90/0x90\n [ 92.691506] ? __kasan_slab_alloc+0x61/0x80\n [ 92.692128] ? eth_type_trans+0x128/0x240\n [ 92.692737] ? __build_skb+0x46/0x50\n [ 92.693252] ? bpf_prog_test_run_skb+0x65e/0xc50\n [ 92.693954] ? bpf_prog_test_run_raw_tp+0x2d0/0x2d0\n [ 92.694639] ? __fget_light+0xa1/0x100\n [ 92.695162] ? bpf_prog_inc+0x23/0x30\n [ 92.695685] ? __sys_bpf+0xb40/0x2c80\n [ 92.696324] ? bpf_link_get_from_fd+0x90/0x90\n [ 92.697150] ? mark_held_locks+0x24/0x90\n [ 92.698007] ? lockdep_hardirqs_on_prepare+0x124/0x220\n [ 92.699045] ? finish_task_switch+0xe6/0x370\n [ 92.700072] ? lockdep_hardirqs_on+0x79/0x100\n [ 92.701233] ? finish_task_switch+0x11d/0x370\n [ 92.702264] ? __switch_to+0x2c0/0x740\n [ 92.703148] ? mark_held_locks+0x24/0x90\n [ 92.704155] ? __x64_sys_bpf+0x45/0x50\n [ 92.705146] ? do_syscall_64+0x35/0x80\n [ 92.706953] ? entry_SYSCALL_64_after_hwframe+0x44/0xae\n [...]\n\nTurns out that the program rejection from e411901c0b77 (\"bpf: allow for tailcalls\nin BPF subprograms for x64 JIT\") is buggy since env->prog->aux->tail_call_reachable\nis never true. Commit ebf7d1f508a7 (\"bpf, x64: rework pro/epilogue and tailcall\nhandling in JIT\") added a tracker into check_max_stack_depth() which propagates\nthe tail_call_reachable condition throughout the subprograms. This info is then\nassigned to the subprogram's \n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47300" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/39f1735c8107ef43a53c4daf82f330d880488d8f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5dd0a6b8582ffbfa88351949d50eccd5b6694ade" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cbb086074dab631ac43f8645cbac1d7b148e05c4" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w5h9-gvgr-jhpg/GHSA-w5h9-gvgr-jhpg.json b/advisories/unreviewed/2024/05/GHSA-w5h9-gvgr-jhpg/GHSA-w5h9-gvgr-jhpg.json new file mode 100644 index 00000000000..839e26b0541 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w5h9-gvgr-jhpg/GHSA-w5h9-gvgr-jhpg.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w5h9-gvgr-jhpg", + "modified": "2024-05-21T15:31:39Z", + "published": "2024-05-21T15:31:39Z", + "aliases": [ + "CVE-2021-47228" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ioremap: Map EFI-reserved memory as encrypted for SEV\n\nSome drivers require memory that is marked as EFI boot services\ndata. In order for this memory to not be re-used by the kernel\nafter ExitBootServices(), efi_mem_reserve() is used to preserve it\nby inserting a new EFI memory descriptor and marking it with the\nEFI_MEMORY_RUNTIME attribute.\n\nUnder SEV, memory marked with the EFI_MEMORY_RUNTIME attribute needs to\nbe mapped encrypted by Linux, otherwise the kernel might crash at boot\nlike below:\n\n EFI Variables Facility v0.08 2004-May-17\n general protection fault, probably for non-canonical address 0x3597688770a868b2: 0000 [#1] SMP NOPTI\n CPU: 13 PID: 1 Comm: swapper/0 Not tainted 5.12.4-2-default #1 openSUSE Tumbleweed\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:efi_mokvar_entry_next\n [...]\n Call Trace:\n efi_mokvar_sysfs_init\n ? efi_mokvar_table_init\n do_one_initcall\n ? __kmalloc\n kernel_init_freeable\n ? rest_init\n kernel_init\n ret_from_fork\n\nExpand the __ioremap_check_other() function to additionally check for\nthis other type of boot data reserved at runtime and indicate that it\nshould be mapped encrypted for an SEV guest.\n\n [ bp: Massage commit message. ]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47228" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/208bb686e7fa7fff16e8fa78ff0db34aa9acdbd7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d651ee9c71bb12fc0c8eb2786b66cbe5aa3e43b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b7a05aba39f733ec337c5b952e112dd2dc4fc404" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w7j7-m99g-gcgq/GHSA-w7j7-m99g-gcgq.json b/advisories/unreviewed/2024/05/GHSA-w7j7-m99g-gcgq/GHSA-w7j7-m99g-gcgq.json new file mode 100644 index 00000000000..e727b68d600 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w7j7-m99g-gcgq/GHSA-w7j7-m99g-gcgq.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w7j7-m99g-gcgq", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47259" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix use-after-free in nfs4_init_client()\n\nKASAN reports a use-after-free when attempting to mount two different\nexports through two different NICs that belong to the same server.\n\nOlga was able to hit this with kernels starting somewhere between 5.7\nand 5.10, but I traced the patch that introduced the clear_bit() call to\n4.13. So something must have changed in the refcounting of the clp\npointer to make this call to nfs_put_client() the very last one.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47259" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329ab" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w825-9xqr-f6q3/GHSA-w825-9xqr-f6q3.json b/advisories/unreviewed/2024/05/GHSA-w825-9xqr-f6q3/GHSA-w825-9xqr-f6q3.json new file mode 100644 index 00000000000..b22b5e348c3 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w825-9xqr-f6q3/GHSA-w825-9xqr-f6q3.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w825-9xqr-f6q3", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47303" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Track subprog poke descriptors correctly and fix use-after-free\n\nSubprograms are calling map_poke_track(), but on program release there is no\nhook to call map_poke_untrack(). However, on program release, the aux memory\n(and poke descriptor table) is freed even though we still have a reference to\nit in the element list of the map aux data. When we run map_poke_run(), we then\nend up accessing free'd memory, triggering KASAN in prog_array_map_poke_run():\n\n [...]\n [ 402.824689] BUG: KASAN: use-after-free in prog_array_map_poke_run+0xc2/0x34e\n [ 402.824698] Read of size 4 at addr ffff8881905a7940 by task hubble-fgs/4337\n [ 402.824705] CPU: 1 PID: 4337 Comm: hubble-fgs Tainted: G I 5.12.0+ #399\n [ 402.824715] Call Trace:\n [ 402.824719] dump_stack+0x93/0xc2\n [ 402.824727] print_address_description.constprop.0+0x1a/0x140\n [ 402.824736] ? prog_array_map_poke_run+0xc2/0x34e\n [ 402.824740] ? prog_array_map_poke_run+0xc2/0x34e\n [ 402.824744] kasan_report.cold+0x7c/0xd8\n [ 402.824752] ? prog_array_map_poke_run+0xc2/0x34e\n [ 402.824757] prog_array_map_poke_run+0xc2/0x34e\n [ 402.824765] bpf_fd_array_map_update_elem+0x124/0x1a0\n [...]\n\nThe elements concerned are walked as follows:\n\n for (i = 0; i < elem->aux->size_poke_tab; i++) {\n poke = &elem->aux->poke_tab[i];\n [...]\n\nThe access to size_poke_tab is a 4 byte read, verified by checking offsets\nin the KASAN dump:\n\n [ 402.825004] The buggy address belongs to the object at ffff8881905a7800\n which belongs to the cache kmalloc-1k of size 1024\n [ 402.825008] The buggy address is located 320 bytes inside of\n 1024-byte region [ffff8881905a7800, ffff8881905a7c00)\n\nThe pahole output of bpf_prog_aux:\n\n struct bpf_prog_aux {\n [...]\n /* --- cacheline 5 boundary (320 bytes) --- */\n u32 size_poke_tab; /* 320 4 */\n [...]\n\nIn general, subprograms do not necessarily manage their own data structures.\nFor example, BTF func_info and linfo are just pointers to the main program\nstructure. This allows reference counting and cleanup to be done on the latter\nwhich simplifies their management a bit. The aux->poke_tab struct, however,\ndid not follow this logic. The initial proposed fix for this use-after-free\nbug further embedded poke data tracking into the subprogram with proper\nreference counting. However, Daniel and Alexei questioned why we were treating\nthese objects special; I agree, its unnecessary. The fix here removes the per\nsubprogram poke table allocation and map tracking and instead simply points\nthe aux->poke_tab pointer at the main programs poke table. This way, map\ntracking is simplified to the main program and we do not need to manage them\nper subprogram.\n\nThis also means, bpf_prog_free_deferred(), which unwinds the program reference\ncounting and kfrees objects, needs to ensure that we don't try to double free\nthe poke_tab when free'ing the subprog structures. This is easily solved by\nNULL'ing the poke_tab pointer. The second detail is to ensure that per\nsubprogram JIT logic only does fixups on poke_tab[] entries it owns. To do\nthis, we add a pointer in the poke structure to point at the subprogram value\nso JITs can easily check while walking the poke_tab structure if the current\nentry belongs to the current program. The aux pointer is stable and therefore\nsuitable for such comparison. On the jit_subprogs() error path, we omit\ncleaning up the poke->aux field because these are only ever referenced from\nthe JIT side, but on error we will never make it to the JIT, so its fine to\nleave them dangling. Removing these pointers would complicate the error path\nfor no reason. However, we do need to untrack all poke descriptors from the\nmain program as otherwise they could race with the freeing of JIT memory from\nthe subprograms. Lastly, a748c6975dea3 (\"bpf: propagate poke des\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47303" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/599148d40366bd5d1d504a3a8fcd65e21107e500" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a9f36bf3613c65cb587c70fac655c775d911409b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f263a81451c12da5a342d90572e317e611846f2c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w883-jj58-rv96/GHSA-w883-jj58-rv96.json b/advisories/unreviewed/2024/05/GHSA-w883-jj58-rv96/GHSA-w883-jj58-rv96.json new file mode 100644 index 00000000000..75eae120501 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w883-jj58-rv96/GHSA-w883-jj58-rv96.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w883-jj58-rv96", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47404" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: betop: fix slab-out-of-bounds Write in betop_probe\n\nSyzbot reported slab-out-of-bounds Write bug in hid-betopff driver.\nThe problem is the driver assumes the device must have an input report but\nsome malicious devices violate this assumption.\n\nSo this patch checks hid_device's input is non empty before it's been used.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47404" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1c83c38dec83d57bc18d0c01d82c413d3b34ccb9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1e4ce418b1cb1a810256b5fb3fd33d22d1325993" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6fc4476dda58f6c00097c7ddec3b772513f57525" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/708107b80aa616976d1c5fa60ac0c1390749db5e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a4faa7153b87fbcfe4be15f4278676f79ca6e019" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bb8b72374db69afa25a5b65cf1c092860c6fe914" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dedfc35a2de2bae9fa3da8210a05bfd515f83fee" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fe9bb925e7096509711660d39c0493a1546e9550" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w9cr-rpv2-57qv/GHSA-w9cr-rpv2-57qv.json b/advisories/unreviewed/2024/05/GHSA-w9cr-rpv2-57qv/GHSA-w9cr-rpv2-57qv.json new file mode 100644 index 00000000000..e8a9730dbfb --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w9cr-rpv2-57qv/GHSA-w9cr-rpv2-57qv.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9cr-rpv2-57qv", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47379" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd\n\nKASAN reports a use-after-free report when doing fuzz test:\n\n[693354.104835] ==================================================================\n[693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338\n\n[693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147\n[693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018\n[693354.105612] Call Trace:\n[693354.105621] dump_stack+0xf1/0x19b\n[693354.105626] ? show_regs_print_info+0x5/0x5\n[693354.105634] ? printk+0x9c/0xc3\n[693354.105638] ? cpumask_weight+0x1f/0x1f\n[693354.105648] print_address_description+0x70/0x360\n[693354.105654] kasan_report+0x1b2/0x330\n[693354.105659] ? bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105670] bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105675] ? bfq_cpd_init+0x20/0x20\n[693354.105683] cgroup_file_write+0x3aa/0x510\n[693354.105693] ? ___slab_alloc+0x507/0x540\n[693354.105698] ? cgroup_file_poll+0x60/0x60\n[693354.105702] ? 0xffffffff89600000\n[693354.105708] ? usercopy_abort+0x90/0x90\n[693354.105716] ? mutex_lock+0xef/0x180\n[693354.105726] kernfs_fop_write+0x1ab/0x280\n[693354.105732] ? cgroup_file_poll+0x60/0x60\n[693354.105738] vfs_write+0xe7/0x230\n[693354.105744] ksys_write+0xb0/0x140\n[693354.105749] ? __ia32_sys_read+0x50/0x50\n[693354.105760] do_syscall_64+0x112/0x370\n[693354.105766] ? syscall_return_slowpath+0x260/0x260\n[693354.105772] ? do_page_fault+0x9b/0x270\n[693354.105779] ? prepare_exit_to_usermode+0xf9/0x1a0\n[693354.105784] ? enter_from_user_mode+0x30/0x30\n[693354.105793] entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.105875] Allocated by task 1453337:\n[693354.106001] kasan_kmalloc+0xa0/0xd0\n[693354.106006] kmem_cache_alloc_node_trace+0x108/0x220\n[693354.106010] bfq_pd_alloc+0x96/0x120\n[693354.106015] blkcg_activate_policy+0x1b7/0x2b0\n[693354.106020] bfq_create_group_hierarchy+0x1e/0x80\n[693354.106026] bfq_init_queue+0x678/0x8c0\n[693354.106031] blk_mq_init_sched+0x1f8/0x460\n[693354.106037] elevator_switch_mq+0xe1/0x240\n[693354.106041] elevator_switch+0x25/0x40\n[693354.106045] elv_iosched_store+0x1a1/0x230\n[693354.106049] queue_attr_store+0x78/0xb0\n[693354.106053] kernfs_fop_write+0x1ab/0x280\n[693354.106056] vfs_write+0xe7/0x230\n[693354.106060] ksys_write+0xb0/0x140\n[693354.106064] do_syscall_64+0x112/0x370\n[693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.106114] Freed by task 1453336:\n[693354.106225] __kasan_slab_free+0x130/0x180\n[693354.106229] kfree+0x90/0x1b0\n[693354.106233] blkcg_deactivate_policy+0x12c/0x220\n[693354.106238] bfq_exit_queue+0xf5/0x110\n[693354.106241] blk_mq_exit_sched+0x104/0x130\n[693354.106245] __elevator_exit+0x45/0x60\n[693354.106249] elevator_switch_mq+0xd6/0x240\n[693354.106253] elevator_switch+0x25/0x40\n[693354.106257] elv_iosched_store+0x1a1/0x230\n[693354.106261] queue_attr_store+0x78/0xb0\n[693354.106264] kernfs_fop_write+0x1ab/0x280\n[693354.106268] vfs_write+0xe7/0x230\n[693354.106271] ksys_write+0xb0/0x140\n[693354.106275] do_syscall_64+0x112/0x370\n[693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.106329] The buggy address belongs to the object at ffff888be0a35580\n which belongs to the cache kmalloc-1k of size 1024\n[693354.106736] The buggy address is located 228 bytes inside of\n 1024-byte region [ffff888be0a35580, ffff888be0a35980)\n[693354.107114] The buggy address belongs to the page:\n[693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0\n[693354.107606] flags: 0x17ffffc0008100(slab|head)\n[693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080\n[693354.108020] r\n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47379" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7c2c69e010431b0157c9454adcdd2305809bf9fb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/858560b27645e7e97aca37ee8f232cccd658fbd2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d12ddd843f1877de1f7dd2aeea4907cf9ff3ac08" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f58d305887ad7b24986d58e881f6806bb81b2bdf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w9fp-75mc-76ff/GHSA-w9fp-75mc-76ff.json b/advisories/unreviewed/2024/05/GHSA-w9fp-75mc-76ff/GHSA-w9fp-75mc-76ff.json new file mode 100644 index 00000000000..e0e4f5bdff6 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w9fp-75mc-76ff/GHSA-w9fp-75mc-76ff.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9fp-75mc-76ff", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47333" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: alcor_pci: fix null-ptr-deref when there is no PCI bridge\n\nThere is an issue with the ASPM(optional) capability checking function.\nA device might be attached to root complex directly, in this case,\nbus->self(bridge) will be NULL, thus priv->parent_pdev is NULL.\nSince alcor_pci_init_check_aspm(priv->parent_pdev) checks the PCI link's\nASPM capability and populate parent_cap_off, which will be used later by\nalcor_pci_aspm_ctrl() to dynamically turn on/off device, what we can do\nhere is to avoid checking the capability if we are on the root complex.\nThis will make pdev_cap_off 0 and alcor_pci_aspm_ctrl() will simply\nreturn when bring called, effectively disable ASPM for the device.\n\n[ 1.246492] BUG: kernel NULL pointer dereference, address: 00000000000000c0\n[ 1.248731] RIP: 0010:pci_read_config_byte+0x5/0x40\n[ 1.253998] Call Trace:\n[ 1.254131] ? alcor_pci_find_cap_offset.isra.0+0x3a/0x100 [alcor_pci]\n[ 1.254476] alcor_pci_probe+0x169/0x2d5 [alcor_pci]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47333" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/09d154990ca82d14aed2b72796f6c8845e2e605d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3ce3e45cc333da707d4d6eb433574b990bcc26f5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/58f69684ba03e5b0e0a3ae844a845280c0f06309" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/717cf5ae52322ddbdf3ac2c584b34c5970b0d174" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d2639ffdcad463b358b6bef8645ff81715daffcb" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-wc9c-rv2v-442r/GHSA-wc9c-rv2v-442r.json b/advisories/unreviewed/2024/05/GHSA-wc9c-rv2v-442r/GHSA-wc9c-rv2v-442r.json new file mode 100644 index 00000000000..4b542053a93 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-wc9c-rv2v-442r/GHSA-wc9c-rv2v-442r.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wc9c-rv2v-442r", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47294" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: Decrease sock refcount when sock timers expire\n\nCommit 63346650c1a9 (\"netrom: switch to sock timer API\") switched to use\nsock timer API. It replaces mod_timer() by sk_reset_timer(), and\ndel_timer() by sk_stop_timer().\n\nFunction sk_reset_timer() will increase the refcount of sock if it is\ncalled on an inactive timer, hence, in case the timer expires, we need to\ndecrease the refcount ourselves in the handler, otherwise, the sock\nrefcount will be unbalanced and the sock will never be freed.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47294" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/25df44e90ff5959b5c24ad361b648504a7e39ef3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/48866fd5c361ea417ed24b43fc2a7dc2f5b060ef" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/517a16b1a88bdb6b530f48d5d153478b2552d9a8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6811744bd0efb9e472cb15d066cdb460beb8cb8a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/853262355518cd1247515b74e83fabf038aa6c29" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9619cc7d97c3aa8ed3cfd2b8678b74fb6d6c7950" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a01634bf91f2b6c42583770eb6815fb6d1e251cf" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bc1660206c3723c37ed4d622ad81781f1e987250" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-wf38-7v3f-5mjp/GHSA-wf38-7v3f-5mjp.json b/advisories/unreviewed/2024/05/GHSA-wf38-7v3f-5mjp/GHSA-wf38-7v3f-5mjp.json new file mode 100644 index 00000000000..540fc958f33 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-wf38-7v3f-5mjp/GHSA-wf38-7v3f-5mjp.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wf38-7v3f-5mjp", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47267" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: fix various gadget panics on 10gbps cabling\n\nusb_assign_descriptors() is called with 5 parameters,\nthe last 4 of which are the usb_descriptor_header for:\n full-speed (USB1.1 - 12Mbps [including USB1.0 low-speed @ 1.5Mbps),\n high-speed (USB2.0 - 480Mbps),\n super-speed (USB3.0 - 5Gbps),\n super-speed-plus (USB3.1 - 10Gbps).\n\nThe differences between full/high/super-speed descriptors are usually\nsubstantial (due to changes in the maximum usb block size from 64 to 512\nto 1024 bytes and other differences in the specs), while the difference\nbetween 5 and 10Gbps descriptors may be as little as nothing\n(in many cases the same tuning is simply good enough).\n\nHowever if a gadget driver calls usb_assign_descriptors() with\na NULL descriptor for super-speed-plus and is then used on a max 10gbps\nconfiguration, the kernel will crash with a null pointer dereference,\nwhen a 10gbps capable device port + cable + host port combination shows up.\n(This wouldn't happen if the gadget max-speed was set to 5gbps, but\nit of course defaults to the maximum, and there's no real reason to\nartificially limit it)\n\nThe fix is to simply use the 5gbps descriptor as the 10gbps descriptor,\nif a 10gbps descriptor wasn't provided.\n\nObviously this won't fix the problem if the 5gbps descriptor is also\nNULL, but such cases can't be so trivially solved (and any such gadgets\nare unlikely to be used with USB3 ports any way).", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47267" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/032e288097a553db5653af552dd8035cd2a0ba96" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/45f9a2fe737dc0a5df270787f2231aee8985cd59" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5ef23506695b01d5d56a13a092a97f2478069d75" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/70cd19cb5bd94bbb5bacfc9c1e4ee0071699a604" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b972eff874637402ddc4a7dd11fb22538a0b6d28" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ca6bc277430d90375452b60b047763a090b7673e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fd24be23abf3e94260be0f00bb42c7e91d495f87" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-wgwm-v825-xmjx/GHSA-wgwm-v825-xmjx.json b/advisories/unreviewed/2024/05/GHSA-wgwm-v825-xmjx/GHSA-wgwm-v825-xmjx.json new file mode 100644 index 00000000000..a44d04a2eb1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-wgwm-v825-xmjx/GHSA-wgwm-v825-xmjx.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wgwm-v825-xmjx", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47255" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkvm: LAPIC: Restore guard to prevent illegal APIC register access\n\nPer the SDM, \"any access that touches bytes 4 through 15 of an APIC\nregister may cause undefined behavior and must not be executed.\"\nWorse, such an access in kvm_lapic_reg_read can result in a leak of\nkernel stack contents. Prior to commit 01402cf81051 (\"kvm: LAPIC:\nwrite down valid APIC registers\"), such an access was explicitly\ndisallowed. Restore the guard that was removed in that commit.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47255" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/018685461a5b9a9a70e664ac77aef0d7415a3fd5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/218bf772bddd221489c38dde6ef8e917131161f6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a2aff09807fbe4018c269d3773a629949058b210" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bf99ea52970caeb4583bdba1192c1f9b53b12c84" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-whrp-vxvh-9rj2/GHSA-whrp-vxvh-9rj2.json b/advisories/unreviewed/2024/05/GHSA-whrp-vxvh-9rj2/GHSA-whrp-vxvh-9rj2.json new file mode 100644 index 00000000000..f5da1d4679a --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-whrp-vxvh-9rj2/GHSA-whrp-vxvh-9rj2.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-whrp-vxvh-9rj2", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47414" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Flush current cpu icache before other cpus\n\nOn SiFive Unmatched, I recently fell onto the following BUG when booting:\n\n[ 0.000000] ftrace: allocating 36610 entries in 144 pages\n[ 0.000000] Oops - illegal instruction [#1]\n[ 0.000000] Modules linked in:\n[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.13.1+ #5\n[ 0.000000] Hardware name: SiFive HiFive Unmatched A00 (DT)\n[ 0.000000] epc : riscv_cpuid_to_hartid_mask+0x6/0xae\n[ 0.000000] ra : __sbi_rfence_v02+0xc8/0x10a\n[ 0.000000] epc : ffffffff80007240 ra : ffffffff80009964 sp : ffffffff81803e10\n[ 0.000000] gp : ffffffff81a1ea70 tp : ffffffff8180f500 t0 : ffffffe07fe30000\n[ 0.000000] t1 : 0000000000000004 t2 : 0000000000000000 s0 : ffffffff81803e60\n[ 0.000000] s1 : 0000000000000000 a0 : ffffffff81a22238 a1 : ffffffff81803e10\n[ 0.000000] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000\n[ 0.000000] a5 : 0000000000000000 a6 : ffffffff8000989c a7 : 0000000052464e43\n[ 0.000000] s2 : ffffffff81a220c8 s3 : 0000000000000000 s4 : 0000000000000000\n[ 0.000000] s5 : 0000000000000000 s6 : 0000000200000100 s7 : 0000000000000001\n[ 0.000000] s8 : ffffffe07fe04040 s9 : ffffffff81a22c80 s10: 0000000000001000\n[ 0.000000] s11: 0000000000000004 t3 : 0000000000000001 t4 : 0000000000000008\n[ 0.000000] t5 : ffffffcf04000808 t6 : ffffffe3ffddf188\n[ 0.000000] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000002\n[ 0.000000] [] riscv_cpuid_to_hartid_mask+0x6/0xae\n[ 0.000000] [] sbi_remote_fence_i+0x1e/0x26\n[ 0.000000] [] flush_icache_all+0x12/0x1a\n[ 0.000000] [] patch_text_nosync+0x26/0x32\n[ 0.000000] [] ftrace_init_nop+0x52/0x8c\n[ 0.000000] [] ftrace_process_locs.isra.0+0x29c/0x360\n[ 0.000000] [] ftrace_init+0x80/0x130\n[ 0.000000] [] start_kernel+0x5c4/0x8f6\n[ 0.000000] ---[ end trace f67eb9af4d8d492b ]---\n[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task!\n[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---\n\nWhile ftrace is looping over a list of addresses to patch, it always failed\nwhen patching the same function: riscv_cpuid_to_hartid_mask. Looking at the\nbacktrace, the illegal instruction is encountered in this same function.\nHowever, patch_text_nosync, after patching the instructions, calls\nflush_icache_range. But looking at what happens in this function:\n\nflush_icache_range -> flush_icache_all\n -> sbi_remote_fence_i\n -> __sbi_rfence_v02\n -> riscv_cpuid_to_hartid_mask\n\nThe icache and dcache of the current cpu are never synchronized between the\npatching of riscv_cpuid_to_hartid_mask and calling this same function.\n\nSo fix this by flushing the current cpu's icache before asking for the other\ncpus to do the same.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47414" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/427faa29e06f0709476ea1bd59758f997ec8b64e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bb8958d5dc79acbd071397abb57b8756375fe1ce" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f1c7aa87c423e765e3862349c2f095fdfccdd9b3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-wr5g-85mp-25c9/GHSA-wr5g-85mp-25c9.json b/advisories/unreviewed/2024/05/GHSA-wr5g-85mp-25c9/GHSA-wr5g-85mp-25c9.json new file mode 100644 index 00000000000..83887fdd121 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-wr5g-85mp-25c9/GHSA-wr5g-85mp-25c9.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wr5g-85mp-25c9", + "modified": "2024-05-21T15:31:40Z", + "published": "2024-05-21T15:31:40Z", + "aliases": [ + "CVE-2021-47250" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix memory leak in netlbl_cipsov4_add_std\n\nReported by syzkaller:\nBUG: memory leak\nunreferenced object 0xffff888105df7000 (size 64):\ncomm \"syz-executor842\", pid 360, jiffies 4294824824 (age 22.546s)\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nbacktrace:\n[<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline]\n[<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline]\n[<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline]\n[<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416\n[<0000000006040154>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739\n[<00000000204d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n[<00000000204d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800\n[<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504\n[<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811\n[<000000009733081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n[<000000009733081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340\n[<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929\n[<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline]\n[<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674\n[<00000000321d1969>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350\n[<00000000964e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404\n[<000000001615e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433\n[<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47\n[<00000000171c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe memory of doi_def->map.std pointing is allocated in\nnetlbl_cipsov4_add_std, but no place has freed it. It should be\nfreed in cipso_v4_doi_free which frees the cipso DOI resource.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47250" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/086e92b1d68c6338535f715aad173f8cf4bfbc8c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0ffb460be3abac86f884a8c548bb02724ec370f4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/212166510582631994be4f4b3fe15e10a03c1dd4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/398a24447eb60f060c8994221cb5ae6caf355fa1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5340858147e3dc60913fb3dd0cbb758ec4a26e66" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6dcea66d3bb519b426282588f38e884e07893c1f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d612c3f3fae221e7ea736d196581c2217304bbbc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/deeeb65c6ee404f2d1fb80b38b2730645c0f4663" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-wr76-p7r7-8vjv/GHSA-wr76-p7r7-8vjv.json b/advisories/unreviewed/2024/05/GHSA-wr76-p7r7-8vjv/GHSA-wr76-p7r7-8vjv.json new file mode 100644 index 00000000000..8a25a85d9aa --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-wr76-p7r7-8vjv/GHSA-wr76-p7r7-8vjv.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wr76-p7r7-8vjv", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47400" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: do not allow call hns3_nic_net_open repeatedly\n\nhns3_nic_net_open() is not allowed to called repeatly, but there\nis no checking for this. When doing device reset and setup tc\nconcurrently, there is a small oppotunity to call hns3_nic_net_open\nrepeatedly, and cause kernel bug by calling napi_enable twice.\n\nThe calltrace information is like below:\n[ 3078.222780] ------------[ cut here ]------------\n[ 3078.230255] kernel BUG at net/core/dev.c:6991!\n[ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP\n[ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O)\n[ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1\n[ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021\n[ 3078.276801] Workqueue: hclge hclge_service_task [hclge]\n[ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--)\n[ 3078.296168] pc : napi_enable+0x80/0x84\ntc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3]\n\n[ 3078.314771] sp : ffff8000108abb20\n[ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300\n[ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000\n[ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880\n[ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000\n[ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930\n[ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4\n[ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8\n[ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344\n[ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938\n[ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0\n[ 3078.414657] Call trace:\n[ 3078.418517] napi_enable+0x80/0x84\n[ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3]\n[ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3]\n[ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge]\n[ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge]\n[ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge]\n[ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge]\n[ 3078.475675] process_one_work+0x1dc/0x48c\n[ 3078.481888] worker_thread+0x15c/0x464\n[ 3078.487104] kthread+0x160/0x170\n[ 3078.492479] ret_from_fork+0x10/0x18\n[ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000)\n[ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]---\n\nOnce hns3_nic_net_open() is excute success, the flag\nHNS3_NIC_STATE_DOWN will be cleared. So add checking for this\nflag, directly return when HNS3_NIC_STATE_DOWN is no set.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47400" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3dac38bdce7932901b9f0b71c62331852c809e61" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5a31d4e73ada8022427b69b10fd1f01a6a8d4b3d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5b09e88e1bf7fe86540fab4b5f3eece8abead39e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f8ba689cb69523144d10606096ef686002dd7285" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-wvfx-f2w6-5jrg/GHSA-wvfx-f2w6-5jrg.json b/advisories/unreviewed/2024/05/GHSA-wvfx-f2w6-5jrg/GHSA-wvfx-f2w6-5jrg.json new file mode 100644 index 00000000000..add8c461ac9 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-wvfx-f2w6-5jrg/GHSA-wvfx-f2w6-5jrg.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wvfx-f2w6-5jrg", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47314" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: fsl_ifc: fix leak of private memory on probe failure\n\nOn probe error the driver should free the memory allocated for private\nstructure. Fix this by using resource-managed allocation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47314" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3b45b8a7d549bd92ec94b5357c2c2c1a7ed107e4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/443f6ca6fd186b4fa4e6f377b6e19a91feb1a0d5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/48ee69825f7480622ed447b0249123236d3b3ad0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7626ffbea708e5aba6912295c012d2b409a1769f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8018476756066e97ecb886c3dc024aeb7d5792ad" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8e0d09b1232d0538066c40ed4c13086faccbdff6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a6b45b4932f7b0c36b41fb56a35ad679ece939a0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b5789e23773f4a852fbfe244b63f675e265d3a7f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ee1aa737ba0b75ab8af3444c4ae5bdba36aed6e6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-wxhc-3989-9jq8/GHSA-wxhc-3989-9jq8.json b/advisories/unreviewed/2024/05/GHSA-wxhc-3989-9jq8/GHSA-wxhc-3989-9jq8.json new file mode 100644 index 00000000000..096f9c41957 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-wxhc-3989-9jq8/GHSA-wxhc-3989-9jq8.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wxhc-3989-9jq8", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47288" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()\n\nFix an 11-year old bug in ngene_command_config_free_buf() while\naddressing the following warnings caught with -Warray-bounds:\n\narch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]\narch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]\n\nThe problem is that the original code is trying to copy 6 bytes of\ndata into a one-byte size member _config_ of the wrong structue\nFW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a\nlegitimate compiler warning because memcpy() overruns the length\nof &com.cmd.ConfigureBuffers.config. It seems that the right\nstructure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains\n6 more members apart from the header _hdr_. Also, the name of\nthe function ngene_command_config_free_buf() suggests that the actual\nintention is to ConfigureFreeBuffers, instead of ConfigureBuffers\n(which takes place in the function ngene_command_config_buf(), above).\n\nFix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS\ninto new struct config, and use &com.cmd.ConfigureFreeBuffers.config as\nthe destination address, instead of &com.cmd.ConfigureBuffers.config,\nwhen calling memcpy().\n\nThis also helps with the ongoing efforts to globally enable\n-Warray-bounds and get us closer to being able to tighten the\nFORTIFY_SOURCE routines on memcpy().", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47288" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4487b968e5eacd02c493303dc2b61150bb7fe4b2" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d4abca95ecc82fc8c41912fa0085281f19cc29f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b9a178f189bb6d75293573e181928735f5e3e070" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c6ddeb63dd543b5474b0217c4e47538b7ffd7686" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e617fa62f6cf859a7b042cdd6c73af905ff8fca3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e818f2ff648581a6c553ae2bebc5dcef9a8bb90c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e991457afdcb5f4dbc5bc9d79eaf775be33e7092" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ec731c6ef564ee6fc101fc5d73e3a3a953d09a00" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-x52v-qr6m-xx85/GHSA-x52v-qr6m-xx85.json b/advisories/unreviewed/2024/05/GHSA-x52v-qr6m-xx85/GHSA-x52v-qr6m-xx85.json new file mode 100644 index 00000000000..44c8f9f7173 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-x52v-qr6m-xx85/GHSA-x52v-qr6m-xx85.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x52v-qr6m-xx85", + "modified": "2024-05-21T15:31:38Z", + "published": "2024-05-21T15:31:38Z", + "aliases": [ + "CVE-2020-36788" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: avoid a use-after-free when BO init fails\n\nnouveau_bo_init() is backed by ttm_bo_init() and ferries its return code\nback to the caller. On failures, ttm_bo_init() invokes the provided\ndestructor which should de-initialize and free the memory.\n\nThus, when nouveau_bo_init() returns an error the gem object has already\nbeen released and the memory freed by nouveau_bo_del_ttm().", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36788" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/548f2ff8ea5e0ce767ae3418d1ec5308990be87d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bcf34aa5082ee2343574bc3f4d1c126030913e54" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f86e19d918a85492ad1a01fcdc0ad5ecbdac6f96" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-x56w-x8rv-273m/GHSA-x56w-x8rv-273m.json b/advisories/unreviewed/2024/05/GHSA-x56w-x8rv-273m/GHSA-x56w-x8rv-273m.json new file mode 100644 index 00000000000..5d71cd91482 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-x56w-x8rv-273m/GHSA-x56w-x8rv-273m.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x56w-x8rv-273m", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47335" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances\n\nAs syzbot reported, there is an use-after-free issue during f2fs recovery:\n\nUse-after-free write at 0xffff88823bc16040 (in kfence-#10):\n kmem_cache_destroy+0x1f/0x120 mm/slab_common.c:486\n f2fs_recover_fsync_data+0x75b0/0x8380 fs/f2fs/recovery.c:869\n f2fs_fill_super+0x9393/0xa420 fs/f2fs/super.c:3945\n mount_bdev+0x26c/0x3a0 fs/super.c:1367\n legacy_get_tree+0xea/0x180 fs/fs_context.c:592\n vfs_get_tree+0x86/0x270 fs/super.c:1497\n do_new_mount fs/namespace.c:2905 [inline]\n path_mount+0x196f/0x2be0 fs/namespace.c:3235\n do_mount fs/namespace.c:3248 [inline]\n __do_sys_mount fs/namespace.c:3456 [inline]\n __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3433\n do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe root cause is multi f2fs filesystem instances can race on accessing\nglobal fsync_entry_slab pointer, result in use-after-free issue of slab\ncache, fixes to init/destroy this slab cache only once during module\ninit/destroy procedure to avoid this issue.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47335" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/79fa5d944c875711253a23b8155b36883c696409" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/86786603014e0a22d0d6af8e80ae4b8687927048" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cad83c968c2ebe97905f900326988ed37146c347" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e472b276a0d2180808009be38105e12754432e2a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-x5fc-mwch-j73r/GHSA-x5fc-mwch-j73r.json b/advisories/unreviewed/2024/05/GHSA-x5fc-mwch-j73r/GHSA-x5fc-mwch-j73r.json new file mode 100644 index 00000000000..209d4369afc --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-x5fc-mwch-j73r/GHSA-x5fc-mwch-j73r.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x5fc-mwch-j73r", + "modified": "2024-05-21T15:31:43Z", + "published": "2024-05-21T15:31:43Z", + "aliases": [ + "CVE-2021-47349" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmwifiex: bring down link before deleting interface\n\nWe can deadlock when rmmod'ing the driver or going through firmware\nreset, because the cfg80211_unregister_wdev() has to bring down the link\nfor us, ... which then grab the same wiphy lock.\n\nnl80211_del_interface() already handles a very similar case, with a nice\ndescription:\n\n /*\n * We hold RTNL, so this is safe, without RTNL opencount cannot\n * reach 0, and thus the rdev cannot be deleted.\n *\n * We need to do it for the dev_close(), since that will call\n * the netdev notifiers, and we need to acquire the mutex there\n * but don't know if we get there from here or from some other\n * place (e.g. \"ip link set ... down\").\n */\n mutex_unlock(&rdev->wiphy.mtx);\n...\n\nDo similarly for mwifiex teardown, by ensuring we bring the link down\nfirst.\n\nSample deadlock trace:\n\n[ 247.103516] INFO: task rmmod:2119 blocked for more than 123 seconds.\n[ 247.110630] Not tainted 5.12.4 #5\n[ 247.115796] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[ 247.124557] task:rmmod state:D stack: 0 pid: 2119 ppid: 2114 flags:0x00400208\n[ 247.133905] Call trace:\n[ 247.136644] __switch_to+0x130/0x170\n[ 247.140643] __schedule+0x714/0xa0c\n[ 247.144548] schedule_preempt_disabled+0x88/0xf4\n[ 247.149714] __mutex_lock_common+0x43c/0x750\n[ 247.154496] mutex_lock_nested+0x5c/0x68\n[ 247.158884] cfg80211_netdev_notifier_call+0x280/0x4e0 [cfg80211]\n[ 247.165769] raw_notifier_call_chain+0x4c/0x78\n[ 247.170742] call_netdevice_notifiers_info+0x68/0xa4\n[ 247.176305] __dev_close_many+0x7c/0x138\n[ 247.180693] dev_close_many+0x7c/0x10c\n[ 247.184893] unregister_netdevice_many+0xfc/0x654\n[ 247.190158] unregister_netdevice_queue+0xb4/0xe0\n[ 247.195424] _cfg80211_unregister_wdev+0xa4/0x204 [cfg80211]\n[ 247.201816] cfg80211_unregister_wdev+0x20/0x2c [cfg80211]\n[ 247.208016] mwifiex_del_virtual_intf+0xc8/0x188 [mwifiex]\n[ 247.214174] mwifiex_uninit_sw+0x158/0x1b0 [mwifiex]\n[ 247.219747] mwifiex_remove_card+0x38/0xa0 [mwifiex]\n[ 247.225316] mwifiex_pcie_remove+0xd0/0xe0 [mwifiex_pcie]\n[ 247.231451] pci_device_remove+0x50/0xe0\n[ 247.235849] device_release_driver_internal+0x110/0x1b0\n[ 247.241701] driver_detach+0x5c/0x9c\n[ 247.245704] bus_remove_driver+0x84/0xb8\n[ 247.250095] driver_unregister+0x3c/0x60\n[ 247.254486] pci_unregister_driver+0x2c/0x90\n[ 247.259267] cleanup_module+0x18/0xcdc [mwifiex_pcie]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47349" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/35af69c7c0490fdccfc159c6a87e4d1dc070838a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a3041d39d3c14da97fa3476835aba043ba810cf0" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-x6vg-gvf6-hmp9/GHSA-x6vg-gvf6-hmp9.json b/advisories/unreviewed/2024/05/GHSA-x6vg-gvf6-hmp9/GHSA-x6vg-gvf6-hmp9.json new file mode 100644 index 00000000000..77c54a1edce --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-x6vg-gvf6-hmp9/GHSA-x6vg-gvf6-hmp9.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x6vg-gvf6-hmp9", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47375" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: Fix uaf in blk_trace access after removing by sysfs\n\nThere is an use-after-free problem triggered by following process:\n\n P1(sda)\t\t\t\tP2(sdb)\n\t\t\techo 0 > /sys/block/sdb/trace/enable\n\t\t\t blk_trace_remove_queue\n\t\t\t synchronize_rcu\n\t\t\t blk_trace_free\n\t\t\t relay_close\nrcu_read_lock\n__blk_add_trace\n trace_note_tsk\n (Iterate running_trace_list)\n\t\t\t relay_close_buf\n\t\t\t\t relay_destroy_buf\n\t\t\t\t kfree(buf)\n trace_note(sdb's bt)\n relay_reserve\n buf->offset <- nullptr deference (use-after-free) !!!\nrcu_read_unlock\n\n[ 502.714379] BUG: kernel NULL pointer dereference, address:\n0000000000000010\n[ 502.715260] #PF: supervisor read access in kernel mode\n[ 502.715903] #PF: error_code(0x0000) - not-present page\n[ 502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0\n[ 502.717252] Oops: 0000 [#1] SMP\n[ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360\n[ 502.732872] Call Trace:\n[ 502.733193] __blk_add_trace.cold+0x137/0x1a3\n[ 502.733734] blk_add_trace_rq+0x7b/0xd0\n[ 502.734207] blk_add_trace_rq_issue+0x54/0xa0\n[ 502.734755] blk_mq_start_request+0xde/0x1b0\n[ 502.735287] scsi_queue_rq+0x528/0x1140\n...\n[ 502.742704] sg_new_write.isra.0+0x16e/0x3e0\n[ 502.747501] sg_ioctl+0x466/0x1100\n\nReproduce method:\n ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\n ioctl(/dev/sda, BLKTRACESTART)\n ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\n ioctl(/dev/sdb, BLKTRACESTART)\n\n echo 0 > /sys/block/sdb/trace/enable &\n // Add delay(mdelay/msleep) before kernel enters blk_trace_free()\n\n ioctl$SG_IO(/dev/sda, SG_IO, ...)\n // Enters trace_note_tsk() after blk_trace_free() returned\n // Use mdelay in rcu region rather than msleep(which may schedule out)\n\nRemove blk_trace from running_list before calling blk_trace_free() by\nsysfs if blk_trace is at Blktrace_running state.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47375" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3815fe7371d2411ce164281cef40d9fc7b323dee" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/488da313edf3abea7f7733efe011c96b23740ab5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5afedf670caf30a2b5a52da96eb7eac7dee6a9c9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/677e362ba807f3aafe6f405c07e0b37244da5222" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a5f8e86192612d0183047448d8bbe7918b3f1a26" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d56171d9360c0170c5c5f8f7e2362a2e999eca40" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dacfd5e4d1142bfb3809aab3634a375f6f373269" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ebb8d26d93c3ec3c7576c52a8373a2309423c069" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-x858-gx5h-mfp9/GHSA-x858-gx5h-mfp9.json b/advisories/unreviewed/2024/05/GHSA-x858-gx5h-mfp9/GHSA-x858-gx5h-mfp9.json new file mode 100644 index 00000000000..892c7c054be --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-x858-gx5h-mfp9/GHSA-x858-gx5h-mfp9.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x858-gx5h-mfp9", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47425" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: acpi: fix resource leak in reconfiguration device addition\n\nacpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a\nreference on the adapter which is never released which will result in a\nreference count leak and render the adapter unremovable. Make sure to\nput the adapter after creating the client in the same manner that we do\nfor OF.\n\n[wsa: fixed title]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47425" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3d9d458a8aaafa47268ea4f1b4114a9f12927989" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/60bacf259e8c2eb2324f3e13275200baaee9494b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6558b646ce1c2a872fe1c2c7cb116f05a2c1950f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/90f1077c9184ec2ae9989e4642f211263f301694" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b8090a84d7758b929d348bafbd86bb7a10c5fb63" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f86de018fd7a24ee07372d55ffa7824f0c674a95" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-x95x-w6hq-mwxc/GHSA-x95x-w6hq-mwxc.json b/advisories/unreviewed/2024/05/GHSA-x95x-w6hq-mwxc/GHSA-x95x-w6hq-mwxc.json new file mode 100644 index 00000000000..36edf2a8763 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-x95x-w6hq-mwxc/GHSA-x95x-w6hq-mwxc.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x95x-w6hq-mwxc", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47316" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix NULL dereference in nfs3svc_encode_getaclres\n\nIn error cases the dentry may be NULL.\n\nBefore 20798dfe249a, the encoder also checked dentry and\nd_really_is_positive(dentry), but that looks like overkill to me--zero\nstatus should be enough to guarantee a positive dentry.\n\nThis isn't the first time we've seen an error-case NULL dereference\nhidden in the initialization of a local variable in an xdr encoder. But\nI went back through the other recent rewrites and didn't spot any\nsimilar bugs.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47316" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xchp-7x95-36g7/GHSA-xchp-7x95-36g7.json b/advisories/unreviewed/2024/05/GHSA-xchp-7x95-36g7/GHSA-xchp-7x95-36g7.json new file mode 100644 index 00000000000..b5028b7b1f0 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xchp-7x95-36g7/GHSA-xchp-7x95-36g7.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xchp-7x95-36g7", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47407" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Handle SRCU initialization failure during page track init\n\nCheck the return of init_srcu_struct(), which can fail due to OOM, when\ninitializing the page track mechanism. Lack of checking leads to a NULL\npointer deref found by a modified syzkaller.\n\n[Move the call towards the beginning of kvm_arch_init_vm. - Paolo]", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47407" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4664318f73e496cd22c71b10888e75434a123e23" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/deb2949417677649e2413266d7ce8c2ff73952b4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/eb7511bf9182292ef1df1082d23039e856d1ddfb" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xj33-wwm4-p8mw/GHSA-xj33-wwm4-p8mw.json b/advisories/unreviewed/2024/05/GHSA-xj33-wwm4-p8mw/GHSA-xj33-wwm4-p8mw.json new file mode 100644 index 00000000000..3d2d88655c8 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xj33-wwm4-p8mw/GHSA-xj33-wwm4-p8mw.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xj33-wwm4-p8mw", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47426" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, s390: Fix potential memory leak about jit_data\n\nMake sure to free jit_data through kfree() in the error path.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47426" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/29fdb11ca88d3c490a3d56f0dc77eb9444d086be" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/686cb8b9f6b46787f035afe8fbd132a74e6b1bdd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a326f9c01cfbee4450ae49ce618ae6cbc0f76842" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d590a410e472417a22336c7c37685bfb38e801f2" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xm9j-x4hp-v2x3/GHSA-xm9j-x4hp-v2x3.json b/advisories/unreviewed/2024/05/GHSA-xm9j-x4hp-v2x3/GHSA-xm9j-x4hp-v2x3.json new file mode 100644 index 00000000000..2b795034c6e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xm9j-x4hp-v2x3/GHSA-xm9j-x4hp-v2x3.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xm9j-x4hp-v2x3", + "modified": "2024-05-21T15:31:45Z", + "published": "2024-05-21T15:31:45Z", + "aliases": [ + "CVE-2021-47422" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/kms/nv50-: fix file release memory leak\n\nWhen using single_open() for opening, single_release() should be\ncalled, otherwise the 'op' allocated in single_open() will be leaked.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47422" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0b3d4945cc7e7ea1acd52cb06dfa83bfe265b6d5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0b4e9fc14973a94ac0520f19b3633493ae13c912" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/65fff0a8efcdca8d84ffe3e23057c3b32403482d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xmfc-6x2r-fqv5/GHSA-xmfc-6x2r-fqv5.json b/advisories/unreviewed/2024/05/GHSA-xmfc-6x2r-fqv5/GHSA-xmfc-6x2r-fqv5.json new file mode 100644 index 00000000000..fb091d48f59 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xmfc-6x2r-fqv5/GHSA-xmfc-6x2r-fqv5.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xmfc-6x2r-fqv5", + "modified": "2024-05-21T15:31:42Z", + "published": "2024-05-21T15:31:42Z", + "aliases": [ + "CVE-2021-47319" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-blk: Fix memory leak among suspend/resume procedure\n\nThe vblk->vqs should be freed before we call init_vqs()\nin virtblk_restore().", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47319" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/04c6e60b884cb5e94ff32af46867fb41d5848358" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/102d6bc6475ab09bab579c18704e6cf8d898e93c" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/29a2f4a3214aa14d61cc9737c9f886dae9dbb710" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/381bde79d11e596002edfd914e6714291826967a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/600942d2fd49b90e44857d20c774b20d16f3130f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/863da837964c80c72e368a4f748c30d25daa1815" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b71ba22e7c6c6b279c66f53ee7818709774efa1f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ca2b8ae93a6da9839dc7f9eb9199b18aa03c3dae" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cd24da0db9f75ca11eaf6060f0ccb90e2f3be3b0" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xp4x-rp64-962g/GHSA-xp4x-rp64-962g.json b/advisories/unreviewed/2024/05/GHSA-xp4x-rp64-962g/GHSA-xp4x-rp64-962g.json new file mode 100644 index 00000000000..ed7e0cd97a1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xp4x-rp64-962g/GHSA-xp4x-rp64-962g.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xp4x-rp64-962g", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47358" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: greybus: uart: fix tty use after free\n\nUser space can hold a tty open indefinitely and tty drivers must not\nrelease the underlying structures until the last user is gone.\n\nSwitch to using the tty-port reference counter to manage the life time\nof the greybus tty state to avoid use after free after a disconnect.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47358" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4dc56951a8d9d61d364d346c61a5f1d70b4f5e14" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/64062fcaca8872f063ec9da011e7bf30470be33f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/92b67aaafb7c449db9f0c3dcabc0ff967cb3a42d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/92dc0b1f46e12cfabd28d709bb34f7a39431b44f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9872ff6fdce8b229f01993b611b5d1719cb70ff1" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a5cfd51f6348e8fd7531461366946039c29c7e69" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b9e697e60ce9890e9258a73eb061288e7d68e5e6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xqq2-v4rf-49qr/GHSA-xqq2-v4rf-49qr.json b/advisories/unreviewed/2024/05/GHSA-xqq2-v4rf-49qr/GHSA-xqq2-v4rf-49qr.json new file mode 100644 index 00000000000..f01eb2ab74f --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xqq2-v4rf-49qr/GHSA-xqq2-v4rf-49qr.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xqq2-v4rf-49qr", + "modified": "2024-05-21T15:31:41Z", + "published": "2024-05-21T15:31:41Z", + "aliases": [ + "CVE-2021-47290" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix NULL dereference on XCOPY completion\n\nCPU affinity control added with commit 39ae3edda325 (\"scsi: target: core:\nMake completion affinity configurable\") makes target_complete_cmd() queue\nwork on a CPU based on se_tpg->se_tpg_wwn->cmd_compl_affinity state.\n\nLIO's EXTENDED COPY worker is a special case in that read/write cmds are\ndispatched using the global xcopy_pt_tpg, which carries a NULL se_tpg_wwn\npointer following initialization in target_xcopy_setup_pt().\n\nThe NULL xcopy_pt_tpg->se_tpg_wwn pointer is dereferenced on completion of\nany EXTENDED COPY initiated read/write cmds. E.g using the libiscsi\nSCSI.ExtendedCopy.Simple test:\n\n BUG: kernel NULL pointer dereference, address: 00000000000001a8\n RIP: 0010:target_complete_cmd+0x9d/0x130 [target_core_mod]\n Call Trace:\n fd_execute_rw+0x148/0x42a [target_core_file]\n ? __dynamic_pr_debug+0xa7/0xe0\n ? target_check_reservation+0x5b/0x940 [target_core_mod]\n __target_execute_cmd+0x1e/0x90 [target_core_mod]\n transport_generic_new_cmd+0x17c/0x330 [target_core_mod]\n target_xcopy_issue_pt_cmd+0x9/0x60 [target_core_mod]\n target_xcopy_read_source.isra.7+0x10b/0x1b0 [target_core_mod]\n ? target_check_fua+0x40/0x40 [target_core_mod]\n ? transport_complete_task_attr+0x130/0x130 [target_core_mod]\n target_xcopy_do_work+0x61f/0xc00 [target_core_mod]\n\nThis fix makes target_complete_cmd() queue work on se_cmd->cpuid if\nse_tpg_wwn is NULL.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47290" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a47fa41381a09e5997afd762664db4f5f6657e03" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e7732c5a19a15a62b0b23fd683a639b0483e1f40" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xwrf-hhx9-vmhv/GHSA-xwrf-hhx9-vmhv.json b/advisories/unreviewed/2024/05/GHSA-xwrf-hhx9-vmhv/GHSA-xwrf-hhx9-vmhv.json new file mode 100644 index 00000000000..2707de978f9 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xwrf-hhx9-vmhv/GHSA-xwrf-hhx9-vmhv.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwrf-hhx9-vmhv", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47391" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\n\nThe FSM can run in a circle allowing rdma_resolve_ip() to be called twice\non the same id_priv. While this cannot happen without going through the\nwork, it violates the invariant that the same address resolution\nbackground request cannot be active twice.\n\n CPU 1 CPU 2\n\nrdma_resolve_addr():\n RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY\n rdma_resolve_ip(addr_handler) #1\n\n\t\t\t process_one_req(): for #1\n addr_handler():\n RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND\n mutex_unlock(&id_priv->handler_mutex);\n [.. handler still running ..]\n\nrdma_resolve_addr():\n RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY\n rdma_resolve_ip(addr_handler)\n !! two requests are now on the req_list\n\nrdma_destroy_id():\n destroy_id_handler_unlock():\n _destroy_id():\n cma_cancel_operation():\n rdma_addr_cancel()\n\n // process_one_req() self removes it\n\t\t spin_lock_bh(&lock);\n cancel_delayed_work(&req->work);\n\t if (!list_empty(&req->list)) == true\n\n ! rdma_addr_cancel() returns after process_on_req #1 is done\n\n kfree(id_priv)\n\n\t\t\t process_one_req(): for #2\n addr_handler():\n\t mutex_lock(&id_priv->handler_mutex);\n !! Use after free on id_priv\n\nrdma_addr_cancel() expects there to be one req on the list and only\ncancels the first one. The self-removal behavior of the work only happens\nafter the handler has returned. This yields a situations where the\nreq_list can have two reqs for the same \"handle\" but rdma_addr_cancel()\nonly cancels the first one.\n\nThe second req remains active beyond rdma_destroy_id() and will\nuse-after-free id_priv once it inevitably triggers.\n\nFix this by remembering if the id_priv has called rdma_resolve_ip() and\nalways cancel before calling it again. This ensures the req_list never\ngets more than one item in it and doesn't cost anything in the normal flow\nthat never uses this strange error path.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47391" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xwvh-fxhh-3qrr/GHSA-xwvh-fxhh-3qrr.json b/advisories/unreviewed/2024/05/GHSA-xwvh-fxhh-3qrr/GHSA-xwvh-fxhh-3qrr.json new file mode 100644 index 00000000000..cd1dccf1f4e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xwvh-fxhh-3qrr/GHSA-xwvh-fxhh-3qrr.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwvh-fxhh-3qrr", + "modified": "2024-05-21T15:31:44Z", + "published": "2024-05-21T15:31:44Z", + "aliases": [ + "CVE-2021-47402" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: flower: protect fl_walk() with rcu\n\nPatch that refactored fl_walk() to use idr_for_each_entry_continue_ul()\nalso removed rcu protection of individual filters which causes following\nuse-after-free when filter is deleted concurrently. Fix fl_walk() to obtain\nrcu read lock while iterating and taking the filter reference and temporary\nrelease the lock while calling arg->fn() callback that can sleep.\n\nKASAN trace:\n\n[ 352.773640] ==================================================================\n[ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower]\n[ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987\n\n[ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2\n[ 352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[ 352.781022] Call Trace:\n[ 352.781573] dump_stack_lvl+0x46/0x5a\n[ 352.782332] print_address_description.constprop.0+0x1f/0x140\n[ 352.783400] ? fl_walk+0x159/0x240 [cls_flower]\n[ 352.784292] ? fl_walk+0x159/0x240 [cls_flower]\n[ 352.785138] kasan_report.cold+0x83/0xdf\n[ 352.785851] ? fl_walk+0x159/0x240 [cls_flower]\n[ 352.786587] kasan_check_range+0x145/0x1a0\n[ 352.787337] fl_walk+0x159/0x240 [cls_flower]\n[ 352.788163] ? fl_put+0x10/0x10 [cls_flower]\n[ 352.789007] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220\n[ 352.790102] tcf_chain_dump+0x231/0x450\n[ 352.790878] ? tcf_chain_tp_delete_empty+0x170/0x170\n[ 352.791833] ? __might_sleep+0x2e/0xc0\n[ 352.792594] ? tfilter_notify+0x170/0x170\n[ 352.793400] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220\n[ 352.794477] tc_dump_tfilter+0x385/0x4b0\n[ 352.795262] ? tc_new_tfilter+0x1180/0x1180\n[ 352.796103] ? __mod_node_page_state+0x1f/0xc0\n[ 352.796974] ? __build_skb_around+0x10e/0x130\n[ 352.797826] netlink_dump+0x2c0/0x560\n[ 352.798563] ? netlink_getsockopt+0x430/0x430\n[ 352.799433] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220\n[ 352.800542] __netlink_dump_start+0x356/0x440\n[ 352.801397] rtnetlink_rcv_msg+0x3ff/0x550\n[ 352.802190] ? tc_new_tfilter+0x1180/0x1180\n[ 352.802872] ? rtnl_calcit.isra.0+0x1f0/0x1f0\n[ 352.803668] ? tc_new_tfilter+0x1180/0x1180\n[ 352.804344] ? _copy_from_iter_nocache+0x800/0x800\n[ 352.805202] ? kasan_set_track+0x1c/0x30\n[ 352.805900] netlink_rcv_skb+0xc6/0x1f0\n[ 352.806587] ? rht_deferred_worker+0x6b0/0x6b0\n[ 352.807455] ? rtnl_calcit.isra.0+0x1f0/0x1f0\n[ 352.808324] ? netlink_ack+0x4d0/0x4d0\n[ 352.809086] ? netlink_deliver_tap+0x62/0x3d0\n[ 352.809951] netlink_unicast+0x353/0x480\n[ 352.810744] ? netlink_attachskb+0x430/0x430\n[ 352.811586] ? __alloc_skb+0xd7/0x200\n[ 352.812349] netlink_sendmsg+0x396/0x680\n[ 352.813132] ? netlink_unicast+0x480/0x480\n[ 352.813952] ? __import_iovec+0x192/0x210\n[ 352.814759] ? netlink_unicast+0x480/0x480\n[ 352.815580] sock_sendmsg+0x6c/0x80\n[ 352.816299] ____sys_sendmsg+0x3a5/0x3c0\n[ 352.817096] ? kernel_sendmsg+0x30/0x30\n[ 352.817873] ? __ia32_sys_recvmmsg+0x150/0x150\n[ 352.818753] ___sys_sendmsg+0xd8/0x140\n[ 352.819518] ? sendmsg_copy_msghdr+0x110/0x110\n[ 352.820402] ? ___sys_recvmsg+0xf4/0x1a0\n[ 352.821110] ? __copy_msghdr_from_user+0x260/0x260\n[ 352.821934] ? _raw_spin_lock+0x81/0xd0\n[ 352.822680] ? __handle_mm_fault+0xef3/0x1b20\n[ 352.823549] ? rb_insert_color+0x2a/0x270\n[ 352.824373] ? copy_page_range+0x16b0/0x16b0\n[ 352.825209] ? perf_event_update_userpage+0x2d0/0x2d0\n[ 352.826190] ? __fget_light+0xd9/0xf0\n[ 352.826941] __sys_sendmsg+0xb3/0x130\n[ 352.827613] ? __sys_sendmsg_sock+0x20/0x20\n[ 352.828377] ? do_user_addr_fault+0x2c5/0x8a0\n[ 352.829184] ? fpregs_assert_state_consistent+0x52/0x60\n[ 352.830001] ? exit_to_user_mode_prepare+0x32/0x160\n[ 352.830845] do_syscall_64+0x35/0x80\n[ 352.831445] entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 352.832331] RIP: 0033:0x7f7bee973c17\n[ \n---truncated---", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47402" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/694b0cee7f8546b69a80996a29cb3cf4149c0453" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d0d520c19e7ea19ed38dc5797b12397b6ccf9f88" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d5ef190693a7d76c5c192d108e8dec48307b46ee" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/dab4677bdbffa5c8270e79e34e51c89efa0728a0" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-21T15:15:25Z" + } +} \ No newline at end of file